Acceptable use policy

This Acceptable Use Policy ("Policy") governs the use of the PentestOps platform, the PentestOps agent, and every other software service that Extranet Systems Pty Ltd (ABN 29 632 743 189) ("Extranet Systems", "we", "us") hosts or provides for use over the internet (together, the "Services"). It forms part of the agreement under which you use the Services, including our Terms and Conditions and any subscription or services agreement with you ("Agreement"). If this Policy conflicts with a written Agreement, the Agreement prevails. By using the Services, or by allowing anyone else to use them through your account, you agree to this Policy on your own behalf and on behalf of every user you authorise.

1. Authorised targets only

PentestOps performs security testing. Running it against a system without authority is likely to be an offence under Part 10.7 of the Criminal Code Act 1995 (Cth), Part 6 of the Crimes Act 1900 (NSW) and equivalent laws in other jurisdictions. You must not direct the Services at any system, network, application, address or account (a "Target") unless:

• you own the Target, or
• you hold current written authorisation from the owner of the Target, and from every other person whose consent is required (for example a hosting provider whose terms require notice of testing), that expressly permits the testing you intend to perform, during the period in which you perform it.

You must keep records of that authorisation for the term of your use of the Services and for seven years afterwards, and provide them to us within two business days of a request. You must configure the Services so that testing stays within the authorised scope, including the addresses, hostnames, time windows and test types authorised. You are responsible for every Target you add, including for the accuracy of its ownership details.

2. Prohibited uses

You must not, and must not permit anyone to, use the Services to:

• test, probe, scan, attack or interfere with any Target that is not authorised under section 1;
• gain or attempt to gain unauthorised access to any system, data or account, or exceed the access you have been authorised;
• cause or attempt to cause a denial of service, data loss, data corruption or damage to any system, including an authorised Target, beyond what the authorised testing scope expressly permits;
• exfiltrate, copy, retain or disclose data obtained from a Target beyond what is necessary to demonstrate a finding to the Target's owner;
• develop, distribute or deploy malware, ransomware or any tool intended to cause harm;
• break the law, infringe any person's intellectual property, privacy or other rights, or breach any contract with a third party;
• interfere with the Services themselves or with other customers, including by circumventing usage limits, security controls, licence restrictions or authorisation checks;
• reverse engineer, decompile or extract the source code of the Services or the PentestOps agent except to the extent the law expressly permits despite this restriction;
• resell, sublicense, time-share or provide the Services to third parties except as a managed service provider under a written Agreement with us that permits it;
• upload or transmit material that is unlawful, defamatory, harassing or infringing, or that contains personal information you are not entitled to disclose;
• misrepresent your identity, your organisation, or your authority to test a Target, including by providing false authorisation records.

3. Your responsibilities

• Accounts and credentials. You are responsible for all activity under your accounts. Keep credentials and agent keys confidential, use multi-factor authentication where offered, grant access only to people who need it, and remove access promptly when it is no longer needed. Tell us immediately at info@extranetsystems.com.au if you suspect an account or key has been compromised.
• Impact on Targets. Security testing can affect the availability of a Target. You are responsible for choosing test types, intensity and time windows appropriate to each Target, for backing up Targets before testing, and for informing the people who operate a Target.
• Findings and data. Findings, evidence and data that the Services collect from your Targets are your information. You are responsible for handling them lawfully, including under the Privacy Act 1988 (Cth) where they contain personal information, and for deleting them from the Services when they are no longer needed.
• Users and clients. If you provide services to your own clients using the Services, you must ensure your clients and users comply with this Policy and you remain responsible to us for their compliance.
• Export and sanctions. You must not use the Services in breach of Australian or applicable foreign export control or sanctions laws, or from or on behalf of a country, entity or person subject to such sanctions.

4. Monitoring and investigation

We may monitor use of the Services to operate, secure and improve them and to verify compliance with this Policy, consistent with our Privacy Policy. We may investigate suspected breaches and may disclose information to law enforcement, regulators, Target owners or others where we are required to by law or reasonably believe disclosure is necessary to prevent harm or to protect our rights or the rights of others.

5. Suspension and termination

We may suspend or restrict your access to the Services, immediately and without notice where we consider it necessary, if we reasonably believe that you or a user you authorised has breached this Policy, that your use creates a risk to any Target, to the Services, to other customers or to us, or that we are required to do so by law or by a lawful request. We will tell you of the suspension and the reason as soon as practicable and, where the breach can be remedied, give you a reasonable opportunity to remedy it. A serious or repeated breach of this Policy is a material breach of the Agreement and entitles us to terminate it. Fees are not refundable for periods of suspension or after termination for breach.

6. Liability and indemnity

You are solely responsible for your use of the Services and for every Target you add. To the maximum extent permitted by law, you indemnify Extranet Systems and its related bodies corporate, directors, employees and contractors against all loss, damage, liability, cost and expense, including reasonable legal costs, arising from any breach of this Policy by you or by a user you authorised, from testing of any Target that was not authorised under section 1, and from any claim by a Target owner or third party in connection with your use of the Services. Nothing in this Policy excludes, restricts or modifies any guarantee, right or remedy under the Competition and Consumer Act 2010 (Cth) or any other law that cannot be excluded.

7. Reporting misuse

If you believe the Services are being used in breach of this Policy, or that your systems have been tested without your authorisation, email info@extranetsystems.com.au with the subject "Acceptable use". Include the addresses, dates and times involved and we will investigate promptly.

8. Changes and governing law

We may update this Policy from time to time by publishing a new version at extranetsystems.com.au/policies/acceptable-use/. Changes apply from the date published, and continued use of the Services after that date is acceptance of the changes; we will give reasonable notice of changes that materially reduce your rights. This Policy is governed by the laws of New South Wales, Australia, and you submit to the non-exclusive jurisdiction of its courts.

Contact

See all our policies