Acceptable use policy

What this covers

This policy applies to our websites, our tools and libraries, and any analysis service we perform. It is part of the terms of use, and where we have a signed agreement with you it is incorporated into that agreement too. It applies to you, to everyone at your organization who uses what we provide, and to anyone you let use it on your behalf.

The authorization rule

This is the whole policy in one sentence: you may only ask us to analyze an artifact you are authorized to have analyzed.

When you submit firmware, a binary, source, or any other artifact, you represent to us that at least one of the following is true, and that you can show it if we ask:

• You own it, or your organization does.
• You have written permission from the owner to have it analyzed, and that permission covers us as your service provider.
• You obtained it lawfully and the license it came under permits the analysis, for example software you bought or a device you own and extracted the firmware from.
• It is publicly available and analyzing it is lawful where you are and where we are.

You must not submit an artifact you obtained by breaking into someone else's system, an artifact that came from a leak or a breach, or an artifact a court order or an injunction bars you from sharing. If you are not sure, ask us before you submit it rather than after.

Findings are for fixing

Our output is a list of ways a product can be broken. What you may do with it:

• Fix your own product, and prove to your own customers and regulators that you fixed it.
• Report a finding to the vendor or maintainer whose code it is, under their disclosure process or ours.
• Make a purchasing or risk decision about a product you operate or are considering.

What you may not do:

• Use a finding to attack, or to help someone else attack, a system you are not authorized to test.
• Sell, broker, or trade a finding or an exploit to anyone whose purpose is offensive, including any exploit brokerage or gray-market buyer.
• Publish a finding in someone else's product before they have had a coordinated opportunity to fix it, other than on the timeline our disclosure policy describes or one you have agreed with them.
• Weaponise our output into malware, ransomware, a botnet, or an intrusion tool, or use it to build a capability whose purpose is unauthorized access.

Things we will not help with

We refuse this work regardless of who is asking and what it pays:

• Access to a system without the authorization of whoever runs it.
• Surveillance of people, and any capability whose purpose is to target an individual, a journalist, a lawyer, an activist, or a dissident.
• Denial of service, mass exploitation, mass scanning for exploitation, and anything whose scale is the point.
• Building detection evasion so an intrusion goes unseen.
• Supply-chain compromise, including anything intended to place code into someone else's build or update path.

A finding is operator-only until it is coordinated. We do not publish a vulnerability in a third party's product to make a point, and we will not do it for you either.

Use of our sites and infrastructure

Do not attempt to gain unauthorized access to our systems or to another customer's data, do not disrupt the service for anyone else, do not scrape or hammer the site, and do not use the contact form to send bulk or unsolicited mail. Security testing of our own site is welcome and is governed by the disclosure policy, whose safe harbour applies when you stay in scope and act in good faith.

Sanctions and export control

We are a United States company and our tools are subject to United States export law, including the Export Administration Regulations. You may not access or use what we provide, or receive our output, if you are located in, ordinarily resident in, or acting for a person or place under United States sanctions or embargo, or if you appear on a United States restricted-party list.

You may not re-export or transfer our tools or our findings in breach of those rules. If you are unsure whether an export license is needed for what you are proposing, tell us before the work starts.

What happens if this policy is broken

We may suspend or terminate access, refuse or stop a piece of work, and where a contract governs the relationship we may treat a breach of this policy as a breach of that contract. We will tell you what we found and give you a chance to answer, unless telling you would itself cause harm or we are legally barred from it.

Where we are legally obliged to report something, we will. We do not volunteer a customer's identity or their code to anyone otherwise.

Reporting a violation

If you believe someone is using our tools or our findings against this policy, tell us at security@2atomic.com. If the thing you want to report is a vulnerability rather than an abuse, use security@2atomic.com and the disclosure policy.

Changes

We version this page and date every change. A change applies from the date it is published. Where this policy is incorporated into a signed agreement, a change that materially narrows what you may do takes effect for you at your next renewal, unless it is required by law or by a regulator, in which case it takes effect when we say so and we will tell you why.