Legal
Acceptable use policy
Last updated: October 10, 2026
Veync may be used only against systems you own or have written permission to test, within a scope agreed in advance. Testing anything else is prohibited, and we will stop any engagement that crosses that line.
Purpose and scope
This Acceptable Use Policy (the "Policy") sets out the rules for using the Veync platform, its API, the related services and Veync Labs material (together, the "Services"), provided by VEYNC. It forms part of the Terms of Service and of every customer agreement, and it applies to the Customer, its Authorized Users and anyone acting on their behalf.
The Services carry out real adversarial activity against live systems. That is what makes them useful, and it is why this Policy is strict.
Written authorization is mandatory
Before any engagement, you must own the target systems or hold written authorization from their owner, granted by a person with the authority to give it. The authorization must cover the specific systems, the techniques and the time window of the engagement.
Scope and rules of engagement are agreed in writing before execution and are enforced by the platform's control plane. If ownership, authority, scope or the systems themselves change, you must confirm authorization again before the engagement continues.
We may ask to see evidence of authorization at any time, and we will not start or continue an engagement until it is provided.
Authorized targets only
You may not use the Services to test, scan, probe or attack any system, network, application, AI model, agent or account that you do not own or are not expressly authorized in writing to test. This applies equally to the systems of your customers, suppliers, partners, former employers and competitors.
Systems hosted by third-party cloud, SaaS and AI providers may be tested only to the extent that the provider's published testing policy and terms permit, and only within your own tenancy or account. A provider's shared infrastructure is never in scope unless the provider has authorized it in writing.
Prohibited activities
You must not use the Services to gain or attempt unauthorized access to any system or data; to attack, disrupt or degrade any third party; to carry out denial-of-service or load testing outside the agreed scope and rate limits; to create, deploy or distribute malware outside a contained, agreed test; to exfiltrate, copy or retain data beyond what the agreed scope requires; to run credential stuffing, password spraying or phishing against people or organisations outside the authorized scope; or to monitor communications you are not authorized to monitor.
You must not circumvent or tamper with the platform's control plane, kill switch, scope limits, rate limits or audit logging; share, resell or sublicense access to the Services; reverse engineer the Services or use them to build a competing product; use the Services in breach of export-control or sanctions law; or use them to store, generate or distribute unlawful content.
Handling findings and data
Treat engagement findings, credentials and any data encountered during testing as confidential. Use them only to remediate and to meet your own risk, audit and compliance obligations, and delete test data once it is no longer needed.
If an engagement reveals a vulnerability in a third party's product or service, it must be handled through coordinated disclosure with that vendor, never published or exploited. Veync Labs can coordinate the disclosure on your behalf under the vulnerability disclosure policy published on this site.
Platform safeguards and our right to intervene
The platform enforces scope, rate limits and a kill switch, and records every action in an audit log. These safeguards protect you and third parties; they are not a substitute for your own authorization.
We may refuse, pause or stop any engagement, and suspend access to the Services, if we reasonably believe that authorization is missing or exceeded, that the activity risks harm to a third party, or that this Policy has been breached.
Reporting misuse
If you believe the Services are being used against a system without authorization, report it to [email protected] with as much detail as you can, such as source addresses, times and the systems affected. Reports with legal implications can also be sent to [email protected]. We investigate every report and act on it.
Enforcement and consequences
A breach of this Policy may lead to the immediate suspension or termination of access, termination of the customer agreement, and referral to law enforcement where appropriate. The Customer is responsible for breaches by its Authorized Users and indemnifies VEYNC as set out in the Terms of Service.
Changes to this policy
We may update this Policy to reflect new capabilities, threats or legal requirements. The date at the top of this page identifies the current version, and we notify customers of material changes in advance.
Governing law
This Policy is governed by the laws of the State of Delaware, USA, without regard to its conflict-of-laws rules, and the state and federal courts located in Delaware have exclusive jurisdiction over any dispute arising from it.
Contact
Questions about this Policy: [email protected]. Help with scoping or authorizing an engagement: [email protected].