Acceptable Use Policy

1. Scope

This Acceptable Use Policy governs all use of the Sanctum SecOps LLC web estate, APIs, RPC endpoints, gated portals, certificate and attestation services, zero-trust overlay and distributed client software. It applies to customers, their users and anyone accessing our systems, and supplements any signed agreement.

2. Prohibited conduct

• Unlawful activity, IP infringement or violation of another party’s privacy rights.
• Unauthorized access attempts, privilege escalation, or circumvention of access gates, authentication, licensing or rate limits.
• Sharing, reselling or delegating credentials, tokens or certificates without written authorization.
• Distributing malware, ransomware, phishing infrastructure or command-and-control tooling.
• Automated scraping, enumeration or bulk harvesting outside published API terms.
• Misrepresenting identity or affiliation, including impersonating Sanctum SecOps personnel or certificate authorities.

3. Security testing and disclosure

Unauthorized scanning, fuzzing, denial-of-service and load testing are prohibited. Good-faith research is welcome under coordinated disclosure: report to security@sanctumsecops.com, stay in scope, avoid data exfiltration, lateral movement, persistence and service degradation, and allow a reasonable remediation window before publication.

4. Certificate and PKI obligations

• Provide accurate enrollment information and request certificates only for names, devices and identities you demonstrably control.
• Protect private keys, using hardware-backed storage where the applicable policy requires it, and never transmit or share them.
• Report suspected key compromise, misissuance or attestation failure within 24 hours and cooperate with revocation.
• Do not present privately trusted certificates as publicly trusted, and do not use test or development hierarchies in production.
• Do not attempt to induce issuance outside the profile constraints of the applicable Certificate Policy.

5. Infrastructure, API and RPC use

• Respect published rate limits and quotas; do not shard traffic across identities to evade them.
• Do not proxy, resell or white-label our endpoints without written authorization.
• No mining, transaction flooding, spam anchoring or resource abuse through blockchain and RPC endpoints.
• Never use our infrastructure as a staging point, relay or amplifier for attacks on third parties.
• Do not anchor unlawful content in the evidence ledger; anchored data is permanent.

6. Content restrictions

Prohibited content includes child sexual abuse material, malware and exploit kits, phishing pages, stolen credentials or data, unlawful surveillance tooling, and material whose distribution is restricted by law.

7. Export control and sanctions

Our cryptographic software and services are subject to United States export control law. You may not access, export or re-export them in violation of the Export Administration Regulations or applicable sanctions programs, from embargoed jurisdictions, or as a denied or restricted party.

8. Monitoring and enforcement

We monitor for abuse and integrity violations. On suspected violation we may throttle traffic, tighten access gates, suspend accounts, revoke certificates, remove content or terminate service — immediately and without prior notice where there is active harm, legal compulsion or risk to the trust fabric. Enforcement evidence is preserved in signed, tamper-evident logs.

9. Reporting abuse

Report abuse to abuse@sanctumsecops.com and vulnerabilities to security@sanctumsecops.com. Include UTC timestamps, affected hostnames, request identifiers such as cf-ray, and any relevant certificate serial numbers.

10. Appeals and changes

Suspension decisions may be appealed to legal@sanctumsecops.com; reinstatement requires remediation and, where relevant, re-attestation of affected endpoints. This policy is version controlled and may be updated; continued use after the effective date constitutes acceptance.