Acceptable Use Policy

This Acceptable Use Policy (“AUP”) governs your use of the KeyVault Edge platform, APIs, SDKs, and related services (collectively, the “Service”). It supplements our Terms of Service and is incorporated by reference into those Terms. By using the Service you agree to this AUP.

KeyVault Edge is a developer security platform. Its purpose is to protect API keys from exposure and misuse — not to enable circumvention of security controls, abuse of third-party services, or harm to others. Anything that undermines that purpose is a violation of this AUP.

You may use the Service to:

• Proxy API requests to third-party providers using API keys you own or are authorised to use on behalf of your organisation.
• Sanitize and host-bind API keys so that stolen tokens cannot be used outside your authorised domains.
• Monitor, detect, and alert on unauthorized access attempts against your own API keys.
• Integrate the KeyVault Edge proxy into your own products and services, including as a library or sub-processor, provided your end users are given appropriate notice.
• Build internal tooling, automation, and CI/CD pipelines that authenticate via tokens you control.
• Test the Service using sandbox or test API keys issued by upstream providers.

You may not use the Service to:

Security and reverse-engineering

• Attempt to reverse-engineer, decompile, or extract the encryption algorithms, key material, or internal logic of the Service.
• Probe, scan, or test the security of KeyVault Edge infrastructure without prior written authorisation from security@keyvaultedge.com.
• Attempt to bypass, defeat, or circumvent host-binding, rate limits, HMAC verification, or any other security control.
• Use the Service as a tool to attack, scrape, or abuse third-party services or APIs.

Unauthorized keys and credentials

• Register or proxy API keys that you do not own and have not been explicitly authorized to use on behalf of their owner.
• Use keys obtained via theft, credential stuffing, phishing, or any other unauthorized means.
• Deliberately proxy keys that violate the terms of service of the upstream provider (e.g. reselling access to an API whose terms prohibit sub-licensing).

Illegal and harmful content

• Facilitate any activity that is illegal under applicable law, including but not limited to fraud, money laundering, CSAM, or sanctions evasion.
• Generate, distribute, or proxy requests that produce CSAM or non-consensual intimate imagery.
• Proxy requests to services that support illegal weapons, controlled substances, or human trafficking.

Platform abuse

• Create multiple accounts to circumvent plan limits, free-tier restrictions, or enforcement actions.
• Resell, sublicense, or white-label access to the Service itself without a written reseller agreement.
• Use the Service in a way that disrupts, degrades, or interferes with the experience of other users.
• Automate account creation or key registration at scale without prior written consent.

The Service is designed for use with API keys you own or are expressly authorised to manage. “Own” means you are the account holder or authorised representative of the account that issued the key with the upstream provider.

If you manage keys on behalf of clients or end users, you are responsible for ensuring:

• Each key-holder has consented to having their credentials managed through a third-party proxy.
• You comply with any data processing or sub-processing obligations this creates under GDPR or equivalent law.
• You notify key-holders of any breach event detected by the Service.

You are responsible for:

• Keeping your KeyVault Edge account credentials and dashboard API key secure.
• Configuring host-binding on tokens to the narrowest set of domains required by your application.
• Responding promptly to breach alerts and revoking or rotating compromised tokens.
• Not sharing your service-role or dashboard API key in public repositories, client-side bundles, or other insecure locations.

We provide the platform and the controls — you are responsible for configuring them correctly. Security failures caused by misconfiguration or negligence on your part do not create liability for KeyVault Edge beyond what is stated in our Terms of Service.

We reserve the right to investigate any suspected violation of this AUP. Actions we may take include, in our sole discretion:

• Warning — an email notice describing the violation and required remediation.
• Suspension — temporary suspension of affected tokens or the entire account pending investigation.
• Termination — permanent termination of your account without refund, as permitted under the Terms of Service.
• Reporting — disclosure to law enforcement or the affected upstream provider where required by law or where necessary to protect others.

We will try to give notice before suspending or terminating an account except where immediate action is necessary to protect the platform or other users.

If you believe someone is using KeyVault Edge in violation of this AUP, or if you have discovered a security vulnerability in the Service, please contact us:

• AUP violations: abuse@keyvaultedge.com
• Security vulnerabilities: security@keyvaultedge.com — see our Responsible Disclosure Policy for guidelines.

Good-faith reports are protected under our disclosure policy. We do not pursue legal action against reporters who follow the rules of engagement set out there.

We may update this AUP from time to time. Material changes will be communicated by email to account holders at least 14 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated AUP.

Questions about this AUP? legal@keyvaultedge.com. We aim to respond within 2 business days.