Purple Team Tools Logo

Acceptable Use Policy (AUP)

Last updated: June 6, 2026

This Acceptable Use Policy (“AUP”) describes rules that apply to all use of Purple Team Tools’s web vulnerability scanning services (“Services”). By using the Services, you agree to follow this AUP in addition to our Terms of Service.

1) Authorized Scanning Only

  • You may scan only systems, applications, domains, IPs, or other assets that you own or for which you have express, written authorization to test.
  • You are solely responsible for verifying authorization prior to each scan and for complying with any scope, timing, or rate-limit restrictions imposed by the asset owner.
  • Where the Services require you to verify ownership or control of a domain before scanning it, completing that verification step does not by itself constitute legal authorization to test; you remain responsible for ensuring you have a lawful basis and any required permission for every scan.

2) Prohibited and Restricted Uses

  • Illegal activity of any kind, including unauthorized access or testing.
  • Denial-of-service (DoS/DDoS) activity, traffic flooding, resource exhaustion, or any action designed to degrade, disrupt, or disable a target or network.
  • Delivery, distribution, or execution of malware, ransomware, spyware, or any harmful code; exploitation of discovered vulnerabilities for non-defensive purposes.
  • Scanning of third-party assets that contain personal data in jurisdictions where you lack a lawful basis or required authorization.
  • Attempting to access, probe, or circumvent Purple Team Tools’s own systems beyond normal product use; interfering with other customers’ use of the Services.
  • Using VPNs, proxies, or other means to evade geoblocking or export-control restrictions (see Terms for blocked regions).

3) Data Handling and Responsible Use

  • Treat all scan results as confidential. Share only with authorized personnel with a legitimate need to know.
  • Use findings solely for defensive remediation, verification, and risk reduction—not for exploitation, extortion, public shaming, or other abusive purposes.
  • Follow responsible disclosure practices applicable to your organization or client agreements when reporting vulnerabilities.

4) Rate, Scope, and Safety

  • Configure scans conservatively for production environments (e.g., avoid intrusive payloads on sensitive systems, respect robots/no-scan directives if required by your authorization).
  • Schedule scans during approved maintenance windows where appropriate, and back up critical systems before testing.

5) Enforcement

  • Violations may result in immediate suspension or termination of access without refund and may be reported to appropriate authorities.
  • Purple Team Tools may investigate suspected violations and may access relevant log data in accordance with the Privacy Policy and applicable law.

Questions about this AUP or potential violations can be sent to [email protected].