LEGAL · ACCEPTABLE USE POLICY

Acceptable Use Policy

Effective date: 2026-01-01 · Last updated: 2026-05-09

Pythorix is a defensive security platform. This Acceptable Use Policy is binding on every user. Violations result in immediate suspension and may be reported to law enforcement.

1. Scope of permitted scanning

You may submit assets to Pythorix only if you can produce, on request:

Proof of ownership of the asset (DNS records, registrar, cloud account); OR
A written engagement letter or scope-of-work signed by the asset owner; OR
A bug-bounty program scope that explicitly authorises external scanning of the asset.

For production assets, Pythorix offers ownership verification via the/.well-known/mythos-<token>.txt file. Continuous monitoring schedules require verified ownership.

2. Prohibited uses

Scanning assets you do not own and are not authorised to assess.
Targeting government, critical-infrastructure, or healthcare systems without explicit authorisation.
Using Pythorix as part of an unauthorised offensive operation.
Attempting to bypass plan quotas, rate limits, or audit logging.
Sharing API keys or login credentials.
Using the platform to facilitate any illegal activity.

3. Defensive-only commitment

Pythorix is engineered to be defensive. We don't generate destructive payloads. We don't mutate target state. We don't enable evasion of detection. If a feature could cross into offensive territory, we'll constrain it or refuse to ship it.

4. Rate limits and fair use

Plan quotas exist to protect the platform and your scan targets. Don't attempt to bypass them. Don't use Pythorix as a load-test substitute. Excessive scanning can degrade the target asset; that's your responsibility, not ours.

5. Reporting concerns

If you observe abuse or believe an asset is being scanned without authorisation, contact us. Mark messages ABUSE for fast routing.

6. Enforcement

We may suspend any account, organisation, or scan we believe violates this policy without prior notice. We cooperate with law enforcement and CERTs on confirmed abuse.

7. Changes

This policy can be updated. Material changes are notified via email and posted here.