Introduction
This Acceptable Use Policy ("AUP") is part of our Terms of Service. It explains how you may and may not use ValiqAI. By creating an account, starting a scan, or otherwise using the Service, you agree to this policy.
ValiqAI is built for quality, accessibility, authentication, and security testing of web applications you own or are explicitly authorized to test. It is not a general-purpose crawler, not a load-testing product, and not a tool for attacking anyone else's systems.
Unauthorized scanning can be a crime, including under laws such as the U.S. Computer Fraud and Abuse Act and the U.K. Computer Misuse Act, and similar laws in other countries. Checking a box in ValiqAI does not make an unauthorized scan legal. We do not authorize you to test any system; you are the one directing each scan.
What a scan actually does
Before you start a scan, you need to understand what you are authorizing. Depending on the options you enable, ValiqAI may:
Open the target in a real browser, click through the product, and record screenshots, console output, and network requests
Find signup and login flows, create a test inbox, handle OTP or magic-link email, and create or use a test account
Submit forms, write data into the target, and trigger emails or other notifications from the target
Run security probes against surfaces it finds, such as cookie and session checks, CSRF checks, password-policy checks, and limited repeated requests to see whether rate limits exist
If you enable AI security testing, send adversarial prompts (prompt injection, jailbreak, leakage, and similar probes) to AI features on the target
Those actions can create leftover accounts, database rows, tickets, and email. They can add load. They can fail in ways that affect production users. You accept those side effects on every target you submit. Scan results are information to help you improve your application. They are not a certification that the target is secure, accessible, or legally compliant.
Your authorization warranty
For every URL, domain, application, and environment you submit, you represent and warrant that:
You own it, operate it, or have documented permission from someone who does — typically a written contract, statement of work, or email from the owner
That permission covers automated browser testing, account creation, form submission, and security probing of the kind described above, not merely "looking at the site"
You have authority to accept the side effects on that system, including in production if that is what you scan
Any per-scan checkbox, attestation, or domain-verification step in the product is true. Those steps record your representation. They are not a substitute for actual legal authority, and they do not mean we have independently confirmed that you own the target
Keep records of authorization. If we, the target's owner, or a hosting provider asks, you must be able to show them. A false attestation is a material breach of the Terms and of this policy.
What you may do
On systems covered by the warranty above, you may use ValiqAI to:
Test your own applications. Scan websites and apps you own, operate, or are responsible for maintaining.
Test for a client or employer. Scan systems they own when they have given you explicit written permission.
Run quality and accessibility checks. Look for functional bugs, broken flows, console errors, and WCAG-related issues.
Test authentication on those systems. Exercise signup, login, OTP, magic-link, and authenticated sessions using test accounts.
Run authorized security testing. Use the probes ValiqAI ships — including session, cookie, CSRF, password-policy, and similar checks — to find issues so you can fix them.
Red-team your own AI features. If you enable AI security testing, probe chatbots and other AI surfaces you are authorized to test for injection, jailbreak, leakage, and related failures.
Use staging and CI. Point scans at pre-production environments and, where your plan allows, integrate them into development workflow.
Owner permission is what matters. A site's public terms of service often forbid automated tools. That public language does not replace owner authorization, and owner authorization does not let you test a third party's systems that happen to appear on the page.
Your app vs third-party services
Permission to scan "your app" is not permission to attack everything the browser touches. Many applications embed or redirect to systems you do not own, such as:
Sign-in providers (Google, GitHub, Microsoft, Apple, Auth0, Clerk, and similar)
Payment processors and checkout (Stripe and similar)
Hosted chat and support widgets (Intercom, Drift, Zendesk, Crisp, and similar)
CDNs, WAFs, bot management, and CAPTCHA providers
Do not use ValiqAI to probe, bypass, or load those third-party services unless that vendor has separately authorized the test. Where the product lets you skip third-party widgets, use that option if your authorization does not cover them. You are responsible for the full path the agent takes.
What you may not do
The following is prohibited. This list is not exhaustive. If you are unsure, ask before you scan. Violations may result in immediate suspension or termination.
Unauthorized scanning
Scanning any website, API, subdomain, or environment you do not own and do not have documented permission to test
Scanning competitor sites to gather intelligence, copy features, or benchmark them
Scanning government, military, financial, healthcare, educational, or critical infrastructure systems without proper authorization from the operator
Using ValiqAI in a bug bounty or similar program unless that program expressly allows automated scanning tools of this kind
Testing authentication, signup, or login on a system you are not authorized to test, including credential stuffing, password spraying, and brute-force guessing
Using findings or the scanner as a weapon
Using scan results to attack, extort, defame, or compromise a system or person
Building, selling, or distributing exploits from ValiqAI findings except to remediate a system you are authorized to fix
Publishing vulnerability details before the owner has had a reasonable chance to fix them, unless they have asked you to disclose or the law requires it
Phishing, social engineering, or impersonating ValiqAI, another person, or another company
Turning ValiqAI into a denial-of-service, stress-testing, or load-testing tool. Product probes may send repeated requests to check that rate limits exist. That is not permission to knock a site over, to loop scans for that purpose, or to exceed the limits we set
Harm to our platform or other users
Submitting URLs or content meant to exploit, malware, or otherwise attack our scanners, workers, or infrastructure
Interfering with other users' scans or accounts
Circumventing rate limits, plan caps, domain verification, or other controls we put in place
Using ValiqAI as a general crawler, scraper, open proxy, or botnet
Jailbreaking or prompt-injecting ValiqAI itself, extracting hidden prompts or model weights, or using inputs and outputs to train a competing model
Illegal, abusive, or high-harm use
Any use that violates applicable law, including computer-misuse, privacy, export, sanctions, and child-protection laws
Scanning sites that host child sexual abuse material, or using ValiqAI (including its AI providers) to create, seek, or sexualize content involving anyone under 18, including AI-generated content. We will report this to relevant authorities
Scanning or supporting fraud, phishing, trafficking, weapons trafficking, or other criminal activity
Using ValiqAI to develop weapons, or to disrupt or gain unauthorized access to critical infrastructure such as power, water, medical devices, air traffic, voting, or emergency systems
Use by or for a person or entity that is subject to U.S. or other applicable sanctions, or in a way that violates export-control rules
Harassment, stalking, threats, or using scan data to harm individuals
Privacy and data misuse
Using ValiqAI to collect personal information you are not authorized to collect
Scraping user data, email addresses, or other personal information from scanned sites for your own database, marketing, or resale
Feeding real end-user accounts, real payment cards, real government IDs, or other real personal data into scans. Use dedicated test accounts and fake test data
Using scans in a way that spams real users — for example, pointing the agent at a production signup so it emails your customers
Account, API, and commercial abuse
Creating multiple accounts to dodge usage limits, bans, or reviews
Sharing passwords or API keys, or letting someone else operate your account
Reselling, sublicensing, or redistributing access to ValiqAI without our written permission
Accessing the Service with scrapers or automation outside the APIs we provide
Reverse engineering, decompiling, or extracting source code from the Service, except where the law gives you a non-waivable right to do so
AI providers
ValiqAI uses third-party AI providers, including Anthropic and OpenAI, to run parts of a scan. Those providers only receive public scan data you submit, such as the target URL and other public content from that target. They do not receive your private ValiqAI account data. Details are in our Privacy Policy and Subprocessors page.
You must not use ValiqAI in any way that would violate Anthropic's Usage Policy or OpenAI's Usage Policies. If those providers update their rules, those updates apply to your use of ValiqAI to the extent they cover the models we call.
Your responsibilities
These are requirements, not suggestions:
Authorization on file. Get written permission before scanning a system you do not yourself own. Keep that record.
Complete domain verification when the product asks for it. Verification helps us confirm control of a hostname. It does not expand your rights to third-party services on that host.
Hosting-provider rules. If the target runs on AWS, Azure, GCP, or another host that requires notice or forbids certain techniques, you are responsible for following those rules before you scan.
Test accounts only. Do not give ValiqAI credentials for real customers, employees (except a dedicated test user), or production admin accounts you are not prepared to have exercised by an agent.
Prefer staging. Run a new target in staging or development first. If you scan production, you accept the risk of emails, data writes, and load.
Protect keys and results. Treat API keys, scan reports, screenshots, and session replays as sensitive. Share them only with people who need them to fix the product.
Stay inside plan limits. Do not try to run more than your plan allows. If you need higher limits, contact us.
Secure integrations. If you connect Slack, Jira, GitHub, or similar, limit access to people who should see findings.
How we monitor and respond
We may log target URLs, scan configuration, timestamps, and related telemetry to operate the Service and to investigate abuse. We do not promise to review every scan in advance. The fact that a scan ran is not approval of that scan.
If we reasonably believe a scan violates this policy, the Terms, or the law, we may:
Pause or cancel scans in progress
Block URLs, domains, or accounts
Disclose relevant account and scan information to the owner of the scanned system, their hosting provider, or law enforcement
Keep records needed to investigate, even if you later close the account
Enforcement
Depending on severity, we may:
Warn you and require you to stop
Suspend the account while we investigate
Terminate the account permanently
Report the activity to law enforcement or other authorities
For a minor first-time mistake, we will usually contact you before taking action. For unauthorized scanning, attacks on critical systems, or illegal activity, we may act immediately. If we suspend or terminate for an AUP violation, you are not entitled to a refund for unused time or credits, to the extent the law allows.
Reporting violations
If you think someone is using ValiqAI in violation of this policy, or if your website is being scanned without your authorization, email us immediately at abhi@valiqai.com.
Include the target URL, approximate times, any scanner IP addresses you have, and anything else that would help us find the account. We will look into it as quickly as we can.
Changes to this policy
We may update this Acceptable Use Policy from time to time. If we make significant changes, we will notify you by email or by posting a notice in the application. Your continued use of ValiqAI after changes are posted means you accept the updated policy.
Questions
If you are not sure whether a use is allowed, email abhi@valiqai.com before you scan. If we cannot tell from your description, the safe answer is not to run it.