{"data":{"id":"aup","title":"Acceptable Use Policy","version":"0.9.0-draft","hash":"693cc486fafa6e407b4b4f66feeae30a56cd8de53033d1a99ce587e438acef6c","status":"Draft — pending qualified counsel review","markdown":"---\ntitle: Acceptable Use Policy\ndocument_id: aup\nversion: 0.9.0-draft\neffective_date: \"[[LEGAL_REVIEW_REQUIRED: effective date set at launch]]\"\nstatus: \"Draft — pending qualified counsel review\"\noperator: Audon Software LLC\nproduct: Audon\n---\n\n# Audon — Acceptable Use Policy\n\nThis Acceptable Use Policy (\"**AUP**\") is incorporated into the Audon Terms of Service (document id `terms`). It applies to every Customer, Authorized User and Agent using the Services operated by **Audon Software LLC**. Capitalized terms have the meanings given in the Terms.\n\n## 1. Purpose\n\nAudon is a read-only tool for auditing and monitoring AI provider spend. This AUP sets out what you must not do, so that the Services stay secure and reliable for all customers. It applies equally to actions taken directly by people and to actions taken by Agents.\n\n## 2. Lawful and authorized connection\n\nYou must not:\n\n1. connect a provider account, or supply an admin API key, that you or your organization are not authorized to use for this purpose;\n2. supply credentials belonging to a third party without that party's authorization;\n3. use the Services to monitor any organization other than your own (or a client organization that has authorized you in writing);\n4. use the Services in violation of applicable sanctions, export control, anti-bribery, privacy or other laws; or\n5. use the Services in breach of your agreements with your AI providers.\n\n## 3. Security and integrity\n\nYou must not:\n\n1. access, or attempt to access, data, accounts or organizations belonging to any other customer, including by manipulating identifiers in URLs, API or MCP requests;\n2. probe, scan or test the vulnerability of the Services, except under our vulnerability reporting process described in the Security Overview and without accessing other customers' data;\n3. circumvent authentication, rate limits, quotas, scopes, human-approval steps or other security controls;\n4. share, sell or publish session tokens, API keys or OAuth grants;\n5. introduce malware, or submit data designed to exploit the Services (including payloads intended for server-side request forgery, injection or deserialization attacks);\n6. use webhook endpoints that you do not control, or that target internal or third-party systems without authorization; or\n7. interfere with or overload the Services, including by automated traffic beyond documented limits.\n\n## 4. Data you submit\n\nYou must not submit to the Services, including in Telemetry metadata keys or values, organization or project names, or support messages:\n\n1. prompts, model responses, files or other content from your AI workloads;\n2. passwords, API keys (other than provider admin keys submitted through the connector flow), tokens or other secrets;\n3. personal data about end users or customers of your services;\n4. special category or sensitive personal data (for example, health, biometric, financial account or government identifier data); or\n5. any data you do not have the right to share with us.\n\nThe Telemetry API rejects metadata keys that suggest prompts, content, personal data or secrets, but this filter cannot detect every misuse. You remain responsible for what you send.\n\n## 5. Agents and automation\n\nYou are responsible for every Agent you connect. You must:\n\n1. grant each Agent only the scopes it needs, and revoke Agents you no longer use;\n2. ensure that an Agent accepting terms, starting a checkout or cancelling a subscription on your behalf does so only under authority you have actually given;\n3. not configure Agents to bypass, simulate or automate the human confirmations required by the Services (for example, by scripting a human owner's session to approve organization deletion or optimization proposals);\n4. not instruct an Agent to misrepresent who it is acting for, or to impersonate a human user;\n5. not use Agents to make high-volume or repetitive requests intended to degrade the Services; and\n6. not rely on Agent output from the Services to take **unsafe automated financial actions**, such as automatically purchasing, cancelling or reconfiguring provider resources, moving funds or committing to contracts, solely on the basis of a Finding or Estimate without appropriate human review in your own systems.\n\nOur Services never change your infrastructure. Any change made on the basis of a Finding is made by you and is your responsibility.\n\n## 6. Use of outputs\n\nYou must not:\n\n1. present Findings or Estimates as audited financial statements, accounting, tax, legal or investment advice, or as a security certification;\n2. represent a potential saving or validated opportunity as a verified saving;\n3. state or imply that Audon, OpenAI, Anthropic or any other provider endorses your product or results; or\n4. use the Services or their outputs to build a competing product by copying our features, data structures or detection methods, or to scrape data in bulk beyond your export rights.\n\n## 7. Free Audit abuse\n\nYou must not create multiple accounts or organizations to obtain additional free Agent Waste Audits, or otherwise evade the limits of the free offer.\n\n## 8. Enforcement\n\nIf we reasonably believe this AUP has been breached, we may investigate, and may take proportionate action, including warning you, revoking specific credentials or Agent connections, limiting features, or suspending access under Section 11.2 of the Terms. We will give notice where reasonably possible and lift restrictions when the issue is resolved. Serious or repeated breaches may lead to termination. Where we are legally required, or it is necessary to protect others, we may report unlawful activity to the relevant authorities.\n\n## 9. Reporting misuse\n\nPlease report suspected misuse or security issues to [[LEGAL_REVIEW_REQUIRED: support contact email]].\n\n## 10. Changes\n\nWe may update this AUP. Material changes are notified in the same way as changes to the Terms (Section 13 of the Terms).\n"},"meta":{"request_id":"req_01m62htx6n6vk7v8wrsh0b","operation":"legal.get"}}