Acceptable Use Policy (AUP)
Last updated: 30/10/2026
This policy defines acceptable and prohibited uses of the Nulink platform, covering both Nulink Cloud and Nulink Exposure Management.
This AUP is also reproduced as Section 7 of the Master Subscription Agreement, and subscription customers are bound by it under Section 6.4 of the MSA. Where this page and the MSA differ in wording, the MSA governs.
Permitted Use
You agree to use the Product solely for its intended purpose and in compliance with all applicable laws and regulations. You may use Nulink only to:
- Scan cloud environments, repositories and domains that you own or are authorized to assess
- Improve security posture and compliance
- Conduct defensive security operations
Authorization is your responsibility
Nulink Cloud requires you to grant read-only access to your own cloud accounts and link your own repositories.
Nulink Exposure Management will only scan a root domain after you have verified it by publishing a DNS TXT record that Nulink issues. That record is your proof of ownership and authorization. You must not verify or scan a domain you do not own or are not authorized to assess. Removing the record takes the domain out of scope.
Prohibited Use
You agree not to engage in any unlawful, harmful, deceptive, or unauthorized activity in connection with, or directed at, the Product. You agree not to:
-
Redistribute, sell, sub-license or lease the Product to any third party, unless you have entered into a separate Partner Agreement with Nulink that authorizes such resale or white-label distribution, in which case such activity is permitted solely within the scope of, and subject to, that Partner Agreement.
-
Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Product.
-
Attempt to gain unauthorized access to, interfere with, damage, or disrupt the Product, its servers, systems or networks.
-
Circumvent, disable, or interfere with security features, authentication mechanisms or access controls of the Product or any related systems.
-
Upload, distribute, or transmit malware, spyware or other harmful or malicious code, including any code designed to disrupt, damage or gain unauthorized access.
-
Engage in any activity that could harm or exploit users, including phishing, social engineering or other fraudulent practices.
-
Collect, access, use or share sensitive personal data without proper authorization and lawful basis, or in violation of applicable data protection laws.
-
Engage in deceptive, misleading or abusive behavior, including impersonation or misrepresentation of affiliation.
-
Send spam, unsolicited communications or promotional content in violation of applicable laws.
-
Access or attempt to access accounts, systems or data belonging to others without authorization.
In addition, you must not scan third-party systems without authorization, use Nulink for offensive or malicious activities, attempt to bypass platform safeguards, or abuse API limits or platform resources.
Credential and Breach Data
Nulink Exposure Management surfaces credentials belonging to your organization that already appear in publicly circulating breach corpora, matched against your verified domains. You must:
- Use this information only to remediate your own organization's exposure
- Not use recovered credentials to access any account or system
- Handle the data in accordance with applicable data protection law, and provide any notices required to affected personnel
Enforcement
Nulink may suspend access immediately and without liability if your use poses a security risk to the Product or other clients, or violates applicable law or this AUP, as set out in Section 9.5 of the MSA. Access may be restored once the issue is resolved.
Violations may also result in termination under Section 9.4 of the MSA, or legal action.
You indemnify Nulink against third-party claims arising from your breach of this AUP, as set out in Section 13.3 of the MSA.
Reporting Misuse
To report misuse of the platform, contact info@nulinksec.com. To report a security vulnerability, see Security & Responsible Disclosure.