Acceptable use policy

Purpose

DarkRisk may be used to assess and monitor the external security posture of your own organisation and of the third parties you have a genuine business relationship with, or are evaluating for one. It is not a tool for targeting, harassing, investigating or attacking anyone.

What you add to DarkRisk

You are responsible for the vendors, domains, IP ranges and autonomous systems you add. You must have a legitimate business reason to assess each one.

• Domains and vendors must be your own, or belong to organisations you work with or are evaluating for that purpose.
• IP ranges and autonomous systems may only be added where you own them, or their owner has authorised you to have them assessed. They are scanned only after approval, and we may ask for evidence of authority at any time.
• Do not add assets to learn about an organisation you have no relationship with, such as a competitor, a journalist’s subject or a target of a dispute.

Scanning and testing

DarkRisk observes what is publicly reachable, as described in ourScanning practices. It does not exploit vulnerabilities, guess passwords or use credentials. You must not use DarkRisk, or anything you learn from it, to probe, penetrate or test a third party’s systems without that party’s clear authorisation, or to plan or support an attack.

Using findings

Findings, scores and reports are for your internal risk management and for working with the vendor concerned. You must not:

• publish findings about another organisation, or use them to embarrass, threaten or pressure it;
• sell findings or share them with anyone who has no legitimate need to know;
• present a score or finding as a certification, guarantee or audit opinion;
• use breach or exposure information to access systems or accounts, contact affected individuals, or identify people; or
• take a decision that has legal consequences for, or substantially affects, an organisation solely on the basis of a score or finding, without human review.

Sharing a vendor’s findings with that vendor, to help it improve, is encouraged.

Questionnaires and documents

Only send questionnaires to people who expect to hear from you about the relationship, and do not use questionnaires for marketing. Documents shared through DarkRisk are confidential to the assessment and may only be used for it.

If you answer a questionnaire, your answers, documents and attestations must be accurate and complete, and you must be authorised to give them for your organisation. Do not upload content you have no right to share, personal information that the assessment does not need, or files that contain malicious code.

AI-assisted features

Review AI-generated answers, summaries and recommendations against the evidence before relying on or sending them. Do not submit content to AI features that you are not permitted to process, and do not try to make them produce harmful content, ignore their instructions, or reveal information belonging to another customer.

Protecting the platform

Do not disrupt DarkRisk, bypass rate limits, plan limits or security controls, attempt to access another customer’s data, share accounts or API keys, scrape data at scale, load-test the platform, or access it by means other than the interfaces we provide. Security research on DarkRisk itself must follow our disclosure policy.

Prohibited use

You must not use DarkRisk:

• for anything unlawful, fraudulent or that infringes another person’s rights;
• to process personal information without a lawful basis under POPIA, the GDPR or other applicable law;
• to assess or make decisions about individuals, such as for employment, credit, insurance or tenancy;
• to harass, intimidate, defame or discriminate against anyone;
• to build, train or benchmark a competing product without our written consent;
• to resell or provide the platform or its output to others except as your agreement allows;
• in breach of sanctions, export controls or anti-corruption law; or
• in a way that could expose DarkRisk, its customers or third parties to harm.

Enforcement

If we reasonably believe this policy has been breached, we may remove assets, stop scanning, withhold output, revoke API keys, suspend users or accounts, or end access, as set out in our terms of service. Where it is safe and lawful we will tell you first and give you a chance to respond; where harm or unlawful use is involved we may act immediately. Fees remain payable during a suspension caused by a breach.

We may preserve relevant records, report suspected unlawful activity to the authorities, and cooperate with lawful investigations. You are responsible for breaches by your users and by the vendors you invite.

Reporting misuse

If you believe DarkRisk is being misused, including against your organisation, contact compliance@darkrisk.io.