Acceptable Use

What you may use it for

• Assessing systems you control or for which you have the owner’s authorization.
• Evaluating tools and vendors you are considering, on the basis of publicly available information and documents the vendor itself has given you.
• Assessing projects you hand over to clients, once you have their consent.

What you may not do

• Commission an assessment of a system you have no right to. A statement that you hold an authorization is part of the request.
• Use the results for blackmail, pressure or publicly discrediting anyone.
• Publish technical details of findings about someone else’s system before it is fixed and without the owner’s consent.
• Impersonate someone else when submitting a request or when claiming a vendor profile.
• Use arLET’S to prepare an attack on anyone’s system.
• Automatically retrieve content from our sites in a way that puts load on the service.

What we do when someone crosses the line

1. We suspend the work and ask for the grounds for commissioning the assessment.
2. If there are no grounds, we refuse to perform it and refund the payment less the costs actually incurred.
3. In the case of serious abuse we block access and, where the law requires it, notify the competent authorities.
4. We inform the system owner if it concerned them and if doing so does not conflict with the law.

What we will not do, even if asked

• We will not bypass sign-in, anti-bot protections or rate limits on the side of the system being assessed.
• We will not perform denial-of-service tests.
• We will not use social engineering against employees of the company being assessed without that company’s separate, explicit consent.
• We will not retrieve other people’s data in a quantity greater than needed to demonstrate the problem.
• We will not change or delete anything in the system being assessed.

Reporting abuse

If someone is using arLET’S against you or your system, write to arlets@yesfor.ai. We reply within 3 business days.