Acceptable Use Policy

Why this policy exists

GONATURELLE gives engineering teams powerful tools: sandboxes that drive agents through real tool calls, synthetic generators that turn one edge case into hundreds of variants, and red-team suites that produce prompt injection probes and adversarial inputs. These tools exist to find failures before patients, borrowers or policyholders do. This Acceptable Use Policy (AUP) sets out what you may and may not do with them so they stay pointed at that goal.

The AUP applies to every user of the Services and forms part of the Terms of Service. Customers are responsible for their users' compliance. Capitalised terms have the meanings given in the Terms.

Test only what you are authorised to test

You may use the Services to evaluate agents, models and tool endpoints that you own or that you have written permission to test. If your agent calls third-party APIs during evaluation, you must have the right to call them in that way, and you should point sandboxes at staging or test endpoints whenever the provider offers them.

• Do not run synthetic stress, red-team or prompt injection suites against systems you do not control or are not authorised to test.
• Do not configure an evaluation to execute real payments, transfers, trades, claim payments, prescriptions, orders or other actions with real-world effects. Tool calls that change state must target sandboxed or staging environments that you are entitled to modify.
• Do not use the Services to probe for vulnerabilities in GONATURELLE itself except through our responsible disclosure process at security@gonaturelle.si.

Data you upload

Keep the data you upload proportionate to the test you are running. Use GONATURELLE golden datasets, Synthetic Cases or de-identified data wherever they are sufficient.

• Do not upload protected health information unless your organisation has signed a Business Associate Agreement with GONATURELLE.
• Do not upload personal data you do not have a lawful basis or consent to process for testing, or data you are contractually prohibited from sharing with a processor.
• Do not upload payment card numbers, government identifiers, passwords, private keys or production secrets as test inputs. Use the secrets manager for credentials your agent needs, and use test values for identifiers.
• Do not upload content that is unlawful, infringes intellectual property, or depicts the sexual abuse or exploitation of children. We report such content to the appropriate authorities.

Synthetic and adversarial content

Synthetic Cases and red-team outputs are evaluation artefacts. They can look realistic, which is the point, so they need to be handled with care.

• Do not present Synthetic Cases as real medical, financial, insurance or legal records, or use them to support any real decision about a person.
• Do not export adversarial prompts, jailbreaks or injection payloads generated by the Services in order to attack systems you do not own, publish them as attack kits, or use them to cause harm.
• Do not use the Services to generate content intended to deceive regulators, auditors or courts, including fabricated evidence of testing that did not occur. Signed run manifests must reflect runs that actually executed.
• Do not use golden datasets or judge outputs to train a model offered to third parties, or to build a competing evaluation dataset, without our written consent.

Platform integrity

Shared infrastructure only works when everyone uses it in good faith.

• Do not circumvent plan limits, rate limits, seat restrictions or metering, including by sharing credentials or splitting one organisation across multiple trial accounts.
• Do not attempt to access another customer's data, escape a sandbox, or interfere with the operation of runners, judges or the API.
• Do not use automated means to scrape the Services or the website beyond what our APIs and robots.txt allow.
• Do not misrepresent GONATURELLE results publicly, for example by claiming an GONATURELLE certification, approval or endorsement, which we do not issue. You may share your own results accurately, citing the suite and version used.

Enforcement and reporting

If we reasonably believe the AUP has been breached, we may remove content, suspend a suite, revoke API keys or suspend an account, proportionately to the risk. Where possible we contact the customer first and give an opportunity to fix the issue; where there is an immediate risk to people, other customers or the platform, we may act first and explain afterwards. Repeated or serious breaches may lead to termination under the Terms.

Report suspected misuse of the Services to legal@gonaturelle.si and security vulnerabilities to security@gonaturelle.si. We do not take action against good-faith security researchers who follow our disclosure policy. We may update this AUP to address new risks, and will give account owners 30 days' notice of material changes except where a change is needed urgently to prevent harm.