Acceptable Use Policy

Effective: [[EFFECTIVE_DATE]] Provider: Thinqmesh Technologies (https://thinqmesh.com) — Orfyn is a Thinqmesh product

This policy forms part of the Terms of Service. It applies to the Orfyn software, the relay, and the website.

Orfyn runs on your infrastructure, so most of what you do with it is genuinely your business. This policy covers the cases where it is not.

1. Authorisation

You may only direct agents at systems, repositories, accounts, and data that you own or are authorised to access. Using Orfyn to reach a system you are not permitted to reach is a breach of this policy, regardless of whether a technical control stopped you.

If you are running deployments inside a customer's environment, you are responsible for holding that customer's authorisation.

2. Prohibited uses

You must not use Orfyn to:

• Gain or attempt to gain unauthorised access to any system, network, or account
• Develop, deploy, or distribute malware, ransomware, or tooling whose primary purpose is unauthorised access, credential theft, or evading detection
• Conduct denial-of-service attacks, or generate load intended to degrade a third party's service
• Exfiltrate data you are not authorised to hold, or circumvent technical protection measures
• Conduct surveillance of individuals without a lawful basis, or build systems whose purpose is unlawful discrimination
• Generate child sexual abuse material, non-consensual intimate imagery, or content that sexualises minors
• Create content designed to defraud, including impersonation of real people or organisations, forged records, or fake reviews and endorsements
• Infringe intellectual property or misappropriate trade secrets
• Violate applicable law, including export control and sanctions

Security research, penetration testing, and red-teaming against systems you own or are contractually authorised to test are permitted and expected. The line is authorisation, not subject matter.

3. The relay specifically

When using the optional relay you must not:

• Attempt to decrypt, intercept, or tamper with traffic that is not yours
• Probe, scan, or stress-test relay infrastructure without written permission
• Circumvent rate limits or quotas, or use it as a general-purpose tunnel or proxy for traffic unrelated to Orfyn
• Use it to distribute unlawful material

The relay carries end-to-end encrypted traffic it cannot read. That is a protection for you; it is not an invitation to use it as anonymous transport.

4. Agent conduct is your conduct

Agents act under your credentials, on your infrastructure, at your direction. Anything an agent does is attributable to you. Scope what you point them at, and review what they propose before it reaches anything that matters.

Directing an agent to do something prohibited by this policy is prohibited, whether the instruction is explicit or the predictable result of the scope you gave it.

5. Reporting

Report abuse or a suspected vulnerability to security@thinqmesh.com. We will not pursue security researchers acting in good faith under coordinated disclosure.

6. Enforcement

Because the software runs on your infrastructure, our enforcement options are limited to what we control: we may suspend or terminate access to the relay, the website, and support, and we may terminate the Terms of Service. Where required by law we will cooperate with authorities.

We will use proportionate judgement. Where a breach appears inadvertent we will normally contact you first, except where the breach is severe or ongoing.

7. Changes

We may update this policy. The current version is always here with its effective date.