Acceptable use

Effective date: 9 November 2026. Last updated: 9 November 2026.

1. Scope and purpose

1.1 Who this policy applies to

This Acceptable Use Policy ("AUP") applies to every Customer, Authorised User and any other person who accesses or uses Prava AI, including the Platform, Modules, Agents, APIs, the Prava AI assistant and any professional services provided by SwiftSafe ("SwiftSafe", "we", "us"). "SwiftSafe" means the SwiftSafe company that contracts with the Customer under section 1.1 of the Terms of Service: SwiftSafe LLC, our United States office, for Customers based in the Americas, and SwiftSafe Cybersecurity Technologies India Pvt Ltd, our headquarters in India, for all other Customers. It forms part of the Terms of Service. Capitalised terms have the meaning given in the Terms of Service.

1.2 Why this policy matters

Prava AI is a dual-use security product. The same capabilities that let defenders find vulnerabilities, analyse malware, monitor dark-web sources and contain intrusions could cause serious harm if misused. This AUP sets the boundaries that keep use of the Services lawful, ethical and defensive. It applies in addition to the Module Terms, which contain further conditions for particular Modules, and to Applicable Law.

1.3 Customer responsibility

The Customer is responsible for ensuring that its Authorised Users, contractors and anyone else using its account comply with this AUP. A breach by any of them is treated as a breach by the Customer.

1.4 Interpretation

The examples in this AUP are illustrative and not exhaustive. If you are unsure whether an intended use is permitted, ask us at legal@prava.dev before you proceed.

2. Authorised targets only

2.1 General rule

You may only monitor, scan, test, collect data from or take action against assets that you own or that you are lawfully authorised in writing to monitor, scan or test. "Assets" include devices, servers, networks, IP ranges, domains, applications, APIs, cloud accounts, email systems, user accounts and IoT/OT devices.

2.2 Written authorisation for active testing

Before using the AI-guided penetration testing Module, continuous attack-surface discovery with active probing, or any other active or offensive capability, you must have a written authorisation that:

• is signed by a person with legal authority over each in-scope asset (for third-party assets, the owner or operator of that asset, and not merely a user or tenant of it);
• clearly defines the scope, including the specific IP addresses, ranges, hostnames, domains, applications, cloud accounts and environments that may be tested, and those that are expressly excluded;
• sets out rules of engagement, including permitted testing windows, permitted techniques, prohibited techniques (for example, destructive payloads, social engineering, denial of service or data exfiltration), rate limits, and emergency contacts and stop procedures; and
• has not expired or been withdrawn.

You must provide a copy of the authorisation to SwiftSafe on request, and before any engagement that SwiftSafe scopes and delivers. SwiftSafe may refuse to start, or may stop, any test where it is not satisfied that valid authorisation exists.

2.3 Cloud and hosted assets

Testing of assets hosted with cloud, hosting, content-delivery or software-as-a-service providers must also comply with that provider's penetration testing policy. You are responsible for any notification or approval that provider requires.

2.4 Staying within scope

You must configure Prava AI so that active testing stays within the authorised scope. If Prava AI discovers assets that appear related to you but are not in scope (for example, through attack-surface discovery), you must not test them actively until you have confirmed ownership and obtained authorisation. Passive discovery from public sources is permitted.

2.5 Monitoring of individuals

You may only use Agents, email analysis, identity monitoring and other Modules to monitor individuals where you have a lawful basis to do so under Applicable Law, including the Digital Personal Data Protection Act, 2023, and have given any required notices and obtained any required consents, as set out in section 5.2 of the Terms of Service. Monitoring must be proportionate to a legitimate security, compliance or operational purpose.

3. Prohibited uses

You must not use the Services, the Outputs or any information obtained through them to do, attempt, facilitate or encourage any of the following.

3.1 Attacking third parties

• Scanning, probing, testing, exploiting or attacking any system, network or account that you do not own or are not authorised in writing to test, or that is outside your agreed scope.
• Gaining or attempting unauthorised access to any computer, computer system or computer network, or downloading, copying, extracting, damaging, disrupting or denying access to data or systems without permission, including acts covered by sections 43 and 66 of the Information Technology Act, 2000, and equivalent computer misuse laws in other countries.
• Using credentials, session tokens, API keys or other secrets discovered through the Services (including leaked credentials surfaced by threat intelligence) to log in to or access any account or system, other than for verification on systems you are authorised to test and within your rules of engagement.
• Pivoting from an in-scope asset into systems belonging to third parties.

3.2 Denial of service and disruption

• Conducting denial-of-service, distributed denial-of-service, resource exhaustion or flooding attacks against any target, including assets you own, unless expressly permitted in a written scope agreed with SwiftSafe.
• Interfering with, overloading or disrupting the Platform, other customers' use of it, or the networks and infrastructure that support it.
• Running active scans or response actions against safety-critical, medical or industrial control systems contrary to the Module Terms.

3.3 Unlawful surveillance and stalkerware

• Monitoring, tracking or intercepting the communications, location, devices or activity of any individual without a lawful basis, required notice or required consent.
• Deploying Agents covertly on personal devices of employees, family members, partners or any other person, or using the Services as stalkerware, spyware or for domestic surveillance.
• Using the Services to profile, target, harass, intimidate or discriminate against individuals, including journalists, activists, whistleblowers, employees exercising legal rights, or members of protected groups.
• Monitoring individuals for purposes unrelated to security or compliance, such as covert productivity scoring, unless permitted by Applicable Law and disclosed to them.

3.4 Misuse of dark-web and threat intelligence

• Buying, selling, trading, brokering, advertising or otherwise acquiring or distributing stolen data, leaked credentials, personal data, access to compromised systems, exploits or malware.
• Using threat intelligence about third parties (for example, a competitor's leaked data) for commercial advantage, extortion, harassment or any purpose other than protecting your own organisation or your authorised clients.
• Republishing or further disclosing leaked personal data surfaced by the Services, except to the affected organisation, to affected individuals or to authorities as required by law.

3.5 Engaging with threat actors

• Using the Platform, or any SwiftSafe account, persona or infrastructure, to contact, negotiate with, pay, recruit or collaborate with threat actors, ransomware operators or criminal marketplaces.
• Making or facilitating ransom or extortion payments through the Platform or with the involvement of SwiftSafe personnel. SwiftSafe does not negotiate with or pay threat actors on behalf of customers, except where separately agreed in writing under the Module Terms for forensics and incident response and permitted by Applicable Law. Any decision you take about a ransom demand is yours alone and must comply with Applicable Law, including sanctions law.

3.6 Weaponising malware and exploits

• Using malware samples, sandbox outputs, reverse-engineering results, proof-of-concept exploits, payloads, scripts or other Outputs to create, improve, obfuscate, package or deploy malicious software or attacks against anyone.
• Asking Prava AI to generate functional malware, ransomware, credential stealers, evasion techniques for defensive tools, or exploits for use outside an authorised engagement.
• Distributing exploit code or payloads generated through the Services to third parties, except to the owner of the affected system or to a vendor or coordinator under section 6.

3.7 Misuse of the Platform

• Reverse engineering, decompiling, disassembling or attempting to extract the source code, model weights, system prompts, training data or detection logic of the Platform or Agents, except to the extent Applicable Law expressly permits despite this restriction.
• Probing, scanning or testing the vulnerability of the Platform, except under our responsible disclosure policy.
• Circumventing licence limits, user limits, rate limits, usage quotas, authentication or security controls, or tampering with or disabling Agents in ways not described in the Documentation.
• Sharing accounts, reselling access, or providing the Services to third parties without a written partner agreement with SwiftSafe.
• Using the Services or Outputs to build, train, fine-tune, benchmark for commercial purposes, or improve a product or model that competes with Prava AI, including by systematically extracting Outputs, detection rules or model responses.

3.8 Sanctions, export controls and other unlawful activity

• Using the Services in breach of the export control and sanctions provisions in section 21 of the Terms of Service (which cover Indian law, US export controls under the EAR and US sanctions administered by OFAC, among others), including for the benefit of sanctioned persons or territories, or for military end uses or weapons of mass destruction programmes where restricted.
• Uploading or processing content that is illegal to possess, including child sexual abuse material. If such material is encountered during an investigation, you must stop, preserve it only as required by law, and report it to the appropriate authorities.
• Any use that infringes intellectual property, privacy or other rights, or that is fraudulent, deceptive or otherwise unlawful under Applicable Law.

4. Handling malware samples and leaked data

4.1 Submitting samples

You may submit malware samples and suspicious files for analysis only where they were obtained from your own systems, from systems you are authorised to investigate, or from legitimate security sources. You must label them accurately where the Platform asks you to, and must not submit samples with the intention of using the analysis to develop or improve malicious software.

4.2 Safe handling

Malware samples must be handled only within the Platform's sandbox and analysis environment, or in your own properly isolated environment. You must not download live samples to production systems, transmit them through unencrypted channels, or store them in locations accessible to people who do not need them. Samples downloaded from the Platform are provided in password-protected or defanged form where possible, and you must keep them that way.

4.3 Retention and sharing of samples

As explained in the AI and Data Use Policy and sections 6.4 and 6.5 of the Terms of Service, samples you submit are stored and analysed in data centres in your Region. SwiftSafe may use malware samples and other Threat Indicators across its customer base and across Regions for collective defence only after they have been stripped of Personal Data and Customer Confidential Information. If a sample contains your confidential documents or Personal Data (for example, a weaponised document built from a real file), only the indicators extracted from it, such as hashes, signatures and malicious infrastructure, are used outside your Region. Tell us if you believe a sample needs special handling.

4.4 Leaked and exposed data

Where the threat intelligence Module surfaces leaked credentials, documents or personal data, you must:

• use it only to assess and reduce risk to your organisation, such as by resetting credentials, notifying affected people, or meeting legal reporting duties;
• access and store only the minimum data needed, restrict access to people who need it, and delete it when no longer needed;
• not attempt to download full data dumps from criminal sources yourself through the Platform or as a result of its findings; and
• consider your own notification obligations, including under the Digital Personal Data Protection Act, 2023 and CERT-In directions, where the leak involves your data.

4.5 Forensic evidence

Evidence collected through the DFIR Module must be handled in accordance with the chain-of-custody procedures provided by the Platform. You must not alter, selectively delete or fabricate evidence, or use the Services to destroy evidence relevant to a legal proceeding or investigation.

5. Rules for Prava AI and its models

5.1 No jailbreaking or prompt injection

You must not attempt to bypass, disable or manipulate the safety controls, guardrails, system instructions or access restrictions of the Prava AI assistant and models. This includes jailbreaking, crafting prompts designed to make Prava AI produce prohibited content, and planting prompt-injection content in emails, files, logs, web pages or other data so that Prava AI misclassifies threats, leaks information, or takes unintended actions. Red-teaming of Prava AI is permitted only under a written agreement with SwiftSafe or through our responsible disclosure policy.

5.2 No extraction of models or other customers' data

You must not attempt to extract model weights, training data or system prompts, to infer information about other customers from model behaviour, or to conduct membership inference, model inversion or similar attacks.

5.3 Human oversight

You must keep appropriate human oversight of Outputs and Autonomous Actions, as required by section 8.3 and section 9 of the Terms of Service. You must not use Outputs as the sole basis for decisions with legal or similarly significant effects on an individual, such as dismissal, disciplinary action, or a report naming an individual to law enforcement, without qualified human review.

5.4 Accurate representation

You must not present Outputs as the work of a human expert, as a certification, or as an audit opinion when they are not. Where you share AI-generated reports with third parties, you must not remove notices that they were generated with AI assistance where the report contains such a notice.

5.5 Inputs

You must not deliberately submit inputs designed to poison or degrade models, such as fabricated Threat Indicators or mislabelled feedback intended to cause false negatives for other customers.

5.6 Generated rules and scripts

Before deploying YARA or Sigma rules, scripts, queries, policies or configuration changes generated by Prava AI, you must review and test them. Generated scripts must only be run against systems within your authorisation.

6. Responsible disclosure of third-party vulnerabilities

6.1 When this applies

Through the Services you may learn of vulnerabilities, misconfigurations or exposures in software, hardware or services provided by third parties, such as a flaw in a vendor's product, or a supplier's exposed database identified through attack-surface discovery or threat intelligence.

6.2 What you must do

• Do not exploit the vulnerability beyond what is necessary to confirm it on systems within your authorised scope, and do not access, modify or exfiltrate third-party data.
• Report the vulnerability to the affected vendor or owner through their published disclosure channel, or, where there is none or the owner does not respond, to a coordinator such as CERT-In (for issues affecting Indian systems), CISA or the CERT Coordination Center (for issues affecting US systems), or another national CERT.
• Give the vendor or owner a reasonable time to fix the vulnerability before public disclosure, in line with generally accepted coordinated disclosure practice (commonly 90 days, adjusted where the vulnerability is being actively exploited).
• Not demand payment or other benefit as a condition of disclosure or of withholding disclosure.

6.3 SwiftSafe's role

If SwiftSafe identifies a vulnerability in third-party software while providing the Services, we may report it to the vendor or a coordinator, without identifying you or disclosing your Confidential Information unless you agree. Where SwiftSafe personnel identify a critical issue affecting a third party during your engagement, we will discuss coordinated disclosure with you first where practicable.

6.4 Vulnerabilities in Prava AI

Vulnerabilities in Prava AI itself must be reported to security@prava.dev under our responsible disclosure policy.

7. Monitoring and enforcement

7.1 How we monitor

To protect the Platform, our customers and third parties, SwiftSafe monitors use of the Services for signs of abuse. This may include automated review of scan targets against registered scope, checks on prompts and Outputs for prohibited content, rate and pattern analysis, and review of reports from third parties. Monitoring is carried out in line with the Privacy Policy, the Data Processing Addendum and Applicable Law. Our personnel review Customer Data only where needed to investigate a suspected breach of this AUP or a security issue.

7.2 Technical controls

We may apply technical controls to prevent misuse, such as requiring verification of domain or asset ownership before active testing, blocking scans of certain targets (for example, government, critical infrastructure or third-party cloud control planes), limiting scan rates, and declining prompts that request prohibited content.

7.3 Investigations

If we suspect a breach of this AUP, we may ask you for information, including copies of written authorisations and scope documents, and you must respond promptly and accurately. We may suspend the relevant activity while we investigate.

7.4 No obligation

Our monitoring does not shift responsibility for compliance with this AUP to SwiftSafe, and we are not obliged to monitor all use.

8. Reporting abuse

If you believe that Prava AI is being used to attack, scan or monitor your systems or you without authorisation, or otherwise in breach of this AUP, please contact soc@prava.dev and include, where possible:

• the source IP addresses, timestamps (with time zone) and target assets involved;
• relevant log extracts or headers; and
• your contact details, so we can follow up.

We will acknowledge reports promptly, investigate them, and take appropriate action. We may not be able to share the outcome with you because of our confidentiality obligations to customers. Complaints about the handling of personal data can also be sent to our Grievance Officer at grievance@prava.dev. Reports of vulnerabilities in Prava AI should go to security@prava.dev.

9. Consequences of breach

9.1 Our response

If you breach this AUP, SwiftSafe may, depending on the seriousness of the breach and acting proportionately, take one or more of the following actions:

• issue a warning and require corrective action;
• stop a scan, test or Autonomous Action in progress;
• suspend or restrict specific Modules, features, Authorised Users or the whole account under section 19.2 of the Terms of Service;
• terminate the Customer's agreement immediately for serious breaches, such as using the Services to attack third parties, unlawful surveillance or trading in stolen data, under section 19.4 of the Terms of Service;
• remove or disable access to content that breaches this AUP; and
• preserve relevant records and report the matter to CERT-In, law enforcement or other competent authorities where required by Applicable Law or where we reasonably believe it is necessary to prevent harm.

9.2 Liability

Breach of this AUP is a material breach of the Terms of Service. The Customer's indemnity in section 17.2 of the Terms of Service applies, and the limitations of liability in section 18 of the Terms of Service do not limit the Customer's liability for such breaches. No refund is due when the Services are suspended or terminated because of a breach of this AUP.

9.3 Notice and appeal

Where practicable and lawful, we will tell you the reason for any enforcement action and give you an opportunity to respond. You may ask us to review a decision by writing to legal@prava.dev. We may act without prior notice where there is an imminent risk of harm or where notice would prejudice an investigation.

10. Changes and contact

We may update this AUP to reflect changes in the Services, the threat landscape or Applicable Law. Material changes will be notified in accordance with section 26.5 of the Terms of Service. Questions about this AUP can be sent to legal@prava.dev. Other legal documents are available in our Legal centre.