Acceptable Use Policy — Security Research

The Security Research tier provides unrestricted models for authorized, lawful security work. Access is granted to verified security professionals and is governed by this policy. Misuse results in immediate revocation.

Escada de garantia (Assurance Ladder)

A evidência exigida em cada nível e o limite diário de tokens que este desbloqueia. O nível de cartão abre o limite gratuito de investigação; as verificações de identidade e de governação elevam o limite a partir daí.

Payment method on file
Evidence: a live credit/debit card (prepaid rejected) verified with a $0 check

Free allowance: 50 requests per UTC day

Limite: 102400 tokens/day · limite 102400
Identity verified
Evidence: optional: a Stripe Identity document + selfie check bound to the principal, on top of the card
Limite: 102400 tokens/day · limite 200000
Business verified
Evidence: a company on a public registry, a proven domain claim, clean screening
Limite: 2000000 tokens/day · limite 8000000
Contracted researcher
Evidence: named researchers, a signed authorized-scope statement, a contract
Limite: 8000000 tokens/day · limite 32000000

Utilizações permitidas

Vulnerability research
Exploit and proof-of-concept (PoC) development
Malware analysis and deobfuscation
Reverse engineering
Authorized phishing and social-engineering assessments

Estritamente proibido

Child sexual abuse material (CSAM)
Chemical, biological, radiological, nuclear weapons or other weapons of mass destruction (CBRN/WMD)
Large-scale fraud-as-a-service

CSAM and CBRN/WMD content is strictly blocked; confirmed cases are handled through our incident and abuse process.

Capacidade ofensiva, sob condições

Payload and shellcode development, command-and-control (C2) tooling and weaponized exploits are permitted only inside a live engagement you have attested to — a named client, a named scope and an end date — at the contracted rung, on top of this policy.

Privacidade

Content is screened for Acceptable Use Policy compliance
It is not used to train or fine-tune foundation models
Chat and research content is stored on operator servers for the life of the account until account delete; retention and operator access are described in the Privacy Policy and Terms

Limite de execução local

The service never executes tools, code, commands or network actions server-side; a tool call the model emits is returned to the caller as data (tool_calls) and runs, if at all, on the caller's own machine
Tool use, command execution and automation stay entirely on the user's local machine, driven by the user's own agent
Generated exploit or payload text is data returned to the caller — it is never run by kotoba.cloud