Acceptable Use Policy

This Acceptable Use Policy governs your use of Necio, an AI security testing and behavioral compliance platform operated by Prompt SecOps, LLC. This policy is incorporated into our Terms of Service. If you do not agree to this policy, you may not use the Service.

Necio is intended only for lawful, authorized security testing. You must be at least 18 years old and must have legal authority for every system, application, API, model, endpoint, account, dataset, or digital asset you test.

AI Can Make Mistakes — Human Verification Required

Necio's prompts, grades, scores, verifications, and reports are produced by artificial intelligence and can be inaccurate, incomplete, or fabricated, even when more than one model agrees. Treat every result as a lead to be confirmed, not as an established fact.

Before you act on, escalate, publish, or share a Necio result — including reporting a vulnerability to a system owner, opening a ticket, blocking a release, or presenting findings to a customer, auditor, or regulator — a qualified human must review and independently verify it. You must not present Service output as a certification, attestation, audit result, or proof that a system is secure or compliant, and must not present it as a professional opinion you have not actually formed.

You are solely responsible for what you do with Service output. To the maximum extent permitted by applicable law, Prompt SecOps is not responsible or liable for decisions made or actions taken in reliance on it.

Handle Sensitive Findings Responsibly

Use synthetic or minimized test data where possible. Do not intentionally use Necio reports, analytics, notifications, logs, or exports to collect or distribute personal information or credentials exposed by a target. Do not bypass evidence masking or attempt to restore masked values in shared artifacts.

If testing exposes a live credential or personal information, restrict its use to your authorized investigation and follow your incident response and credential rotation procedures. Masking preserves investigation context while reducing secondary exposure; it does not authorize access to, use of, or disclosure of the underlying sensitive information.

1. Authorization and Ownership

You may only use Necio to test systems, applications, APIs, AI systems, LLM endpoints, chat interfaces, bots, channels, and digital assets that you:

• Own outright
• Have administrative control over
• Have explicit written authorization to test from the legal owner
• Are authorized to test as part of your legitimate job responsibilities

You accept full responsibility for your actions using the Service and will maintain proper documentation of all testing authorizations.

Holding an account on a service is not authorization to attack it. Being a paying customer or a signed-in user of a chat product, workspace, or bot does not give you the right to run adversarial testing against it or to automate it. Authorization must come from the party that owns the system.

Testing unauthorized systems constitutes unauthorized access and may be prosecuted under computer crime laws, including the Computer Fraud and Abuse Act (18 U.S.C. § 1030), the UK Computer Misuse Act 1990, and equivalent laws in other jurisdictions.

2. Browser-Driven and Channel-Based Testing

Necio can test targets that are not APIs: a chat page it reaches by driving an automated browser session, or a bot it reaches through Discord, Slack, Telegram, or Microsoft Teams. These targets belong to somebody, and the obligations in Section 1 apply to them in full. In addition, you must:

• Only automate a chat interface you own or have permission to automate. A valid account does not override restrictions on automated access in the service terms.
• Use only credentials for an account you are entitled to use. Prefer a dedicated test account with the minimum required permissions. Never use another person's credentials.
• Accept that the automated session will accept cookie, consent, and terms-of-use dialogs on the target site in order to reach the chat, and take responsibility for whether you are entitled to accept them there
• Not use browser automation to bypass CAPTCHAs, bot detection, paywalls, geographic restrictions, or rate limits. Stop the run if the target presents one of these controls.
• Only create channels in, invite bots to, and send messages through a workspace, server, or account you administer or are authorized to test in
• Only test bots you own or have permission to test. A bot being reachable does not authorize adversarial testing.
• Respect the target platform's rate limits, automation rules, and developer terms, and accept responsibility for any enforcement action the platform takes against your account

Prompts and replies for these target types transit the third-party platform or automation service involved. That platform keeps its own records under its own retention policy, which neither you nor Prompt SecOps can delete from within Necio. Factor that in before sending sensitive content through a channel-based test.

3. Lawful Use and Legal Compliance

You agree to comply with all applicable laws, regulations, contracts, and third-party terms, including:

• Computer Fraud and Abuse Act (CFAA) - 18 U.S.C. § 1030
• UK Computer Misuse Act 1990
• EU General Data Protection Regulation (GDPR)
• California Consumer Privacy Act and other state privacy laws
• State, local, and international cybersecurity and cybercrime laws
• The EU Artificial Intelligence Act and other AI-specific laws and regulations applicable to the systems you test
• Export control and sanctions regulations, including EAR, ITAR, OFAC, and equivalent restrictions
• The terms of service, developer terms, and automation and anti-scraping policies of any provider, chat service, or messaging platform you target

You may not use Necio in any jurisdiction, for any end use, or for any target where such use would violate applicable law, contract, sanctions, export controls, or authorization limits.

4. Responsible Vulnerability Disclosure

When Necio identifies vulnerabilities or risky behavior, you commit to:

• Have a qualified human independently verify a finding before reporting it as a vulnerability — AI-generated findings can be false positives
• Report vulnerabilities to appropriate system owners promptly
• Provide reasonable time for remediation before public disclosure
• Not exploit vulnerabilities for malicious purposes
• Handle discovered sensitive information with appropriate care
• Follow coordinated vulnerability disclosure practices

5. Data Protection and Privacy

Security testing may reveal personal, confidential, regulated, or otherwise sensitive information. You are responsible for:

• Protecting any sensitive data discovered during testing
• Minimizing personal, confidential, and regulated data submitted to the Service to what is reasonably necessary for authorized testing
• Complying with applicable privacy and data protection laws
• Limiting access to test results and discovered information
• Not sharing, storing, copying, or misusing discovered personal or sensitive information
• Implementing appropriate safeguards for test data and reports
• Using appropriately scoped provider credentials, rotating API keys under your organization's credential-management policy, and replacing them immediately after actual or suspected exposure
• Not entering personal, confidential, or regulated third-party data into free-text fields (such as a target system's name or description) that may be sent to third-party web search providers when web-search features are enabled
• Attaching only files you have the right to submit. Limit personal, confidential, and regulated content to what the authorized test needs. Attached files are sent to the target with your prompt.

Necio automatically expires or minimizes test content and evidence according to our Privacy Policy; files you attach to test prompts are deleted 48 hours after upload. You must not rely on the Service as your sole archive for records you are legally or contractually required to preserve.

30-day availability and compliance storage. Prompt SecOps does not undertake responsibility for storing, retaining, or making scan data, scan results, or web chat image artifacts available beyond 30 days after creation, except as required by applicable law or a separate written agreement. This is not a guarantee that every record will be deleted on day 30; the Privacy Policy describes the applicable data-processing retention schedule. If you need records for longer than 30 days for compliance, you must configure a SIEM connection in Settings → SIEM Integration before the applicable availability period ends. You are responsible for verifying successful delivery and configuring retention and access controls in your SIEM. SIEM delivery does not extend Necio storage and may not include every field or image artifact; separately export and preserve any required records or artifacts not delivered by the integration. Uploaded prompt attachments remain subject to their shorter 48-hour deletion period.

If an existing scheduled job uses a provider API key, replace it from the Schedule page using Edit schedule. The replacement applies to future scheduled runs without changing the job's target, templates, or recorded testing authorization.

6. Generated Attack Content

Necio uses AI models, including open-weight models, to write adversarial prompts. These models are selected partly because they can produce realistic attack content. Use the output only to test systems you have permission to test.

• Use generated prompts only against targets covered by your testing authorization
• Restrict access to people who need the prompts for the testing engagement, as with other offensive security material
• Do not publish, resell, or redistribute them, and do not accumulate them into an attack toolkit or training dataset
• Do not use Necio to obtain restricted content for purposes other than authorized testing of your configured target. Do not use generation to bypass another provider's safety controls.
• Do not ask the Service to generate content that is prohibited under Section 7 regardless of the target, framing, or stated testing purpose

A model's willingness to write a payload says nothing about whether sending it is lawful. That judgment is yours, and the authorization requirements in Sections 1 and 2 govern it.

7. Prohibited Uses

You must not use Necio to:

• Conduct unauthorized penetration testing, hacking, scanning, probing, scraping, or exploitation
• Launch attacks against systems you do not own, control, or have written authorization to test
• Steal, modify, destroy, exfiltrate, or misuse data without authorization
• Disrupt services, degrade systems, overload infrastructure, or cause malicious downtime
• Bypass authentication, rate limits, access controls, safety controls, or security measures for malicious purposes
• Defeat CAPTCHAs, bot detection, paywalls, or anti-automation measures on a target you are not authorized to automate
• Submit credentials belonging to another person, or credentials you are not entitled to use
• Generate jailbreaks, attack payloads, or other adversarial content for use outside authorized testing of systems you control
• Submit, request, generate, test, store, distribute, or attempt to obtain child sexual abuse material (CSAM), child sexual exploitation material, sexual content involving minors, or instructions involving exploitation of minors
• Create, facilitate, or conceal sexual exploitation, non-consensual sexual imagery, trafficking, grooming, extortion, harassment, doxxing, credential theft, phishing, malware deployment, unlawful surveillance, or other criminal activity
• Plan, facilitate, or promote terrorism or violent extremism; develop, acquire, or deploy chemical, biological, radiological, or nuclear weapons; or attack, disrupt, or compromise critical infrastructure
• Violate export controls, sanctions, embargoes, or restrictions on prohibited end users, jurisdictions, or end uses
• Use the Service to harass, intimidate, threaten, or harm individuals or organizations
• Test, probe, scan, or attack Necio itself, or bypass its authentication, rate limits, or security controls without prior written authorization from Prompt SecOps. Report suspected vulnerabilities to [email protected]
• Evade token metering or credit deductions, manipulate credit balances or payment confirmations, bypass insufficient-credit controls or automatic top-up consent, or use payment methods without authorization. Purchasing credits does not expand your testing authorization or exempt you from this policy.
• Share, resell, or transfer account access, create accounts by automated means, or use the Service to send spam, mine cryptocurrency, or otherwise abuse platform resources
• Copy, extract, or reuse Necio's proprietary prompt templates, scoring methodology, or outputs to develop, train, or market a competing product or service

8. User Responsibility and Legal Liability

You are solely responsible for all prompts, uploads, targets, outputs, testing activity, and account activity associated with your use of Necio. Prompt SecOps does not authorize, direct, control, endorse, or assume responsibility for user-generated prompts, user-selected targets, or illegal use of the Service.

If you submit, request, generate, test, store, or distribute CSAM, child sexual exploitation material, sexual content involving minors, or other illegal sexual content, you may be reported to law enforcement and are solely responsible for any civil, criminal, regulatory, or other legal consequences.

9. Professional and Ethical Standards

• Act with integrity and professionalism
• Apply your own professional judgment to AI-generated findings rather than forwarding, publishing, or acting on them unverified
• Respect the privacy, safety, and rights of others
• Use Necio only for legitimate security and compliance purposes
• Maintain confidentiality of discovered vulnerabilities
• Cooperate with legitimate security investigations
• Report suspected misuse or abuse of the platform

10. Enforcement

Violation of this policy may result in immediate account suspension or termination, removal of access to the Service, preservation of relevant records, reporting to affected service providers or system owners, reporting to law enforcement or regulatory authorities, and civil or criminal legal action.

We may stop an individual scan, suspend testing for an account, or pause hosted testing across the platform while we investigate a credible report or address a security or operational issue. Do not bypass a cancellation, suspension, pause, or other platform control by starting replacement jobs, switching accounts, or using internal endpoints. Stop testing promptly when the system owner withdraws permission or your authorized scope or testing period ends. Keep written authorization identifying the targets and permitted activities, and provide relevant evidence if we reasonably request it to investigate suspected misuse.

11. Reporting Abuse

To report suspected misuse, abuse, unauthorized testing, or illegal activity involving Necio, contact us at [email protected].