Acceptable Use Policy

This policy is part of the Terms of Service. It applies to you, to everyone you invite to a workspace you control, and to anything you configure the service to do on your behalf — including AI workers, workflows and scheduled jobs.

If in doubt, ask: [email protected].

Do not break the law

Do not use CogniWork to plan, carry out, facilitate or conceal unlawful activity, or to process content whose possession or distribution is unlawful where you are or where we operate.

Do not harm people

Do not use the service to:

• produce or distribute child sexual abuse material, in any form, under any pretext;
• harass, threaten, stalk, defame or incite violence against anyone;
• generate content designed to deceive people about who they are dealing with, including impersonating a real person or organisation;
• create material intended to interfere with an election or a legal proceeding;
• develop weapons, or provide operational assistance for violence.

Do not attack systems

Do not use the service — or any agent, worker or automation you configure in it — to:

• gain unauthorised access to any system, account or data, including ours;
• scan, probe or test the security of systems you do not own or have written permission to test;
• distribute malware, ransomware or credential-harvesting tooling;
• conduct denial-of-service attacks, or generate load intended to degrade any service;
• evade rate limits, quotas, access controls or usage metering, whether ours or a third party’s.

Security research on CogniWork itself is welcome under our Responsible Disclosure Policy, which grants a safe harbour this policy otherwise does not.

Do not misuse other people’s data

• Do not upload personal data you have no lawful basis to process.
• Do not upload data whose contract or licence prohibits processing by a third-party service.
• Do not use the service to build profiles of people for surveillance, scoring or tracking without their knowledge and a lawful basis.
• Do not use the service to make solely automated decisions producing legal or similarly significant effects on a person without meaningful human review.

Sensitive data — health records, government identifiers, financial account credentials, biometric data, precise location, and data about children — carries additional obligations under law. You are responsible for meeting them. If your use case is regulated (for example, under HIPAA), do not put regulated data into the service without a written agreement with us covering it.

Do not abuse connected systems

CogniWork can connect to systems you supply credentials for, and can send messages through channels you connect.

• Only connect systems you are authorised to connect.
• Only grant an integration the access it needs.
• Do not use connected messaging channels to send unsolicited bulk messages, or to contact people who have not consented to be contacted.
• You remain responsible for everything an automation does with the access you gave it.

Do not abuse the platform

• Do not resell, sublicense or provide the service to third parties as your own.
• Do not reverse-engineer the service, or use it to extract model weights, system prompts or training data.
• Do not use the service to develop a competing product.
• Do not run workloads whose primary purpose is to consume capacity rather than to do work.
• Do not circumvent usage metering, or create multiple accounts to evade limits or a suspension.

Automated agents: your responsibility

Autonomous agents make this policy sharper, not looser. A worker you scheduled, acting at 3am with credentials you supplied, is your act.

Before you give an agent access to something, satisfy yourself that:

• its brief cannot reasonably be read as instructing prohibited activity;
• the credentials you gave it are scoped to what it needs;
• actions with external effect — sending messages, writing to other people’s systems, spending money — are ones you intend it to take unsupervised.

Enforcement

If we reasonably believe your use violates this policy, we may restrict, suspend or terminate access, remove offending content, or report the matter to law enforcement where required.

We will give you notice and a chance to fix the problem where we can. Where the risk is immediate — an active attack, illegal content, a threat to another customer — we may act first and notify you afterwards.

Reporting abuse

To report a violation by another user: [email protected]. To report a security vulnerability: see Responsible Disclosure.