Acceptable Use Policy — Security Research

The Security Research tier provides unrestricted models for authorized, lawful security work. Access is granted to verified security professionals and is governed by this policy. Misuse results in immediate revocation.

Assurance ladder

प्रत्येक पातळीसाठी आवश्यक पुरावा आणि त्यामुळे अनलॉक होणारा दैनिक टोकन Allowance. कार्ड पातळी मुक्त संशोधन allowance उघडते; त्यानंतर ओळख व governance तपासण्या मर्यादा वाढवतात.

1. Payment method on file

   Evidence: a live credit/debit card (prepaid rejected) verified with a $0 check

   Allowance: 102400 tokens/day · मर्यादा 102400

2. Identity verified

   Evidence: Stripe Identity document + selfie check bound to the principal

   Allowance: 50000 tokens/day · मर्यादा 200000

3. Business verified

   Evidence: a company on a public registry, a proven domain claim, clean screening

   Allowance: 2000000 tokens/day · मर्यादा 8000000

4. Contracted researcher

   Evidence: named researchers, a signed authorized-scope statement, a contract

   Allowance: 8000000 tokens/day · मर्यादा 32000000

अनुमत वापर

• Vulnerability research
• Exploit and proof-of-concept (PoC) development
• Malware analysis and deobfuscation
• Reverse engineering
• Authorized phishing and social-engineering assessments

पूर्णपणे निषिद्ध

• Child sexual abuse material (CSAM)
• Chemical, biological, radiological, nuclear weapons or other weapons of mass destruction (CBRN/WMD)
• Large-scale fraud-as-a-service

CSAM and CBRN/WMD content is strictly blocked; confirmed cases are handled through our incident and abuse process.

आक्रमक क्षमता, अटींसह

Payload and shellcode development, command-and-control (C2) tooling and weaponized exploits are permitted only inside a live engagement you have attested to — a named client, a named scope and an end date — at the contracted rung, on top of this policy.

गोपनीयता

• Designed for zero data retention
• Request content is screened in memory
• When zero-data-retention is enabled, your content is not used for training

स्थानिक अंमलबजावणी सीमा

• The service never executes tools, code, commands or network actions server-side; a tool call the model emits is returned to the caller as data (tool_calls) and runs, if at all, on the caller's own machine
• Tool use, command execution and automation stay entirely on the user's local machine, driven by the user's own agent
• Generated exploit or payload text is data returned to the caller — it is never run by kotoba.cloud

Version: kotoba-security-aup-v1