ACCEPTABLE USE POLICY

1. Purpose and scope

This Acceptable Use Policy (the "AUP") is part of the Terms of Service of Sovereign AI Cloud. It applies to every use of the platform — the API, the cabinet, dedicated instances and the documentation — by a customer, its users and anyone acting through its API keys. Where this AUP says "you", it means the customer and everyone it allows to use the Services.

2. Prohibited uses

You may not use the Services, or allow them to be used, to:

2.1 Practices prohibited by Article 5 of the EU AI Act (Regulation (EU) 2024/1689)

• deploy subliminal, manipulative or deceptive techniques that distort a person's behaviour and cause or are likely to cause significant harm;
• exploit the vulnerabilities of a person or a group due to age, disability or social or economic situation, to distort behaviour in a way that causes or is likely to cause significant harm;
• evaluate or classify natural persons over time on the basis of their social behaviour or personal characteristics in a way that leads to detrimental or disproportionate treatment (social scoring);
• assess or predict the risk that a natural person commits a criminal offence based solely on profiling or on personality traits;
• create or expand facial-recognition databases through untargeted scraping of facial images from the internet or CCTV;
• infer the emotions of a natural person in the workplace or in education, except for medical or safety reasons;
• categorise natural persons biometrically to deduce race, political opinions, trade-union membership, religious or philosophical beliefs, sex life or sexual orientation;
• perform real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes.

2.2 Unlawful, harmful or abusive content and conduct

• generate, store or distribute child sexual abuse material, or material that sexualises minors, in any form;
• plan, promote or facilitate violence, terrorism or serious crime;
• create malware, exploits or tools for unauthorised access to systems, or carry out attacks against any system, including ours;
• send unsolicited bulk messages, run phishing or fraud, or impersonate a person or organisation in a deceptive way;
• harass, threaten, defame or discriminate against people, or generate content that incites hatred against a protected group;
• infringe intellectual property rights, trade secrets or contractual confidentiality;
• collect, process or disclose personal data unlawfully, including unlawful scraping, de-anonymisation or surveillance;
• generate medical, legal or financial statements that are presented to end users as authoritative professional advice without a qualified human in the loop.

2.3 Obligations you keep when you build on the Services

• if your system is a high-risk AI system under Annex III of the EU AI Act, you remain responsible for its conformity, documentation, human oversight and registration; the Services are a general-purpose component and do not make your system compliant;
• you comply with the transparency obligations of Article 50 of the EU AI Act towards your users (see the AI Transparency Notice);
• you do not use the Services for decisions with legal or similarly significant effects on persons without meaningful human review.

2.4 Platform integrity

• circumvent or attempt to circumvent rate limits, budgets, quotas, tenant isolation or any other technical control;
• probe, scan or test the vulnerability of the platform without written permission (see the responsible-disclosure rules on the Security and Trust page);
• reverse engineer, decompile or extract the control plane, the cabinet or the Sovereign AI Machine, except where the law allows it notwithstanding this clause;
• share an API key between organisations, or use the Services on behalf of a third party as a managed service, without our written consent — resale of the Services is not permitted without consent;
• misrepresent the Services as your own infrastructure in a way that misleads your customers about who processes their data.

3. Your security obligations

Keep API keys confidential and rotate them on suspected exposure; keep your own systems that call the API reasonably secure; apply the limits and budgets that fit your use; tell us at [CONTACT EMAIL] without undue delay if you detect abuse of your keys.

4. How we respond to abuse

4.1 We investigate reports and signals of abuse. Because request content is not stored, our investigation is based on metadata (request patterns, volumes, error rates, source addresses), on the report itself, and on what you tell us.

4.2 Depending on the severity, we may warn you, limit a project, revoke a key, suspend a project or an organisation, or terminate the agreement. For a serious or urgent violation we act first and explain afterwards; otherwise we tell you what we found and give you a reasonable period to respond before we act.

4.3 We tell you the reason for any limitation, what restores access, and how to appeal, unless the law forbids us to. Appeals go to [CONTACT EMAIL] and are answered by a person who was not involved in the original decision.

4.4 Where the law requires it, we report illegal content or conduct to the competent authorities.

5. Reporting abuse

Anyone can report a suspected violation of this AUP to [CONTACT EMAIL]. Please include the date and time, the behaviour you observed and, if you have it, the request identifier. We acknowledge reports within two business days.

6. Changes

We may update this AUP. A material change is announced at least 30 days in advance to the administrators of registered organisations by email; changes required by law or needed to stop ongoing harm may take effect on publication.