Acceptable use policy

1. Who this applies to

This policy applies to every organization that uses GhostAudit and to each of its users. It is part of our terms of service. It concerns your use of GhostAudit; it is separate from the AI acceptable use policy you may write for your own employees.

2. Use the sensors lawfully and openly

The browser extension and desktop agent run on devices used by your employees and contractors. You must:

• deploy them only to devices and browser profiles that your organization owns or manages, or where the user has agreed;
• have a lawful basis for the monitoring and comply with the employment, privacy and telecommunications laws that apply to you;
• inform the people affected, before deployment, of what is collected and why;
• consult or obtain the agreement of employee representatives where the law requires it.

You must not:

• deploy the sensors covertly, or to the devices of people who have no working relationship with you;
• modify the sensors, or combine them with other software, to collect prompts, page content, keystrokes, screenshots or other content, or to report activity outside your list of AI tools;
• use usage data to target individuals for reasons unrelated to AI governance, or in a way that unlawfully discriminates;
• attempt to reverse a pseudonymous identity to identify a person, unless you have a documented, lawful reason and have followed your own procedures for doing so.

3. Do not misuse the service

You must not:

• break the law, or infringe or violate the rights of others, in using the service;
• access or attempt to access another customer's data or any account that is not yours;
• probe, scan or test the vulnerability of the service without our written permission, or circumvent any security or authentication measure. Good-faith security research is welcome; write to [email protected] first;
• interfere with the service or place an unreasonable load on it, including by automated means beyond the documented interfaces;
• upload malware or content that is unlawful;
• resell or provide the service to third parties, or use it to build a competing product, without our agreement;
• misrepresent generated documents as legal advice, as a certification, or as an audit performed by GhostAudit.

4. Keep credentials safe

Keep enrollment tokens, integration credentials and user passwords confidential. Revoke tokens and devices that are no longer needed. Tell us promptly at [email protected] if you believe a credential has been exposed.

5. Content you enter

Do not enter special categories of personal data, payment card numbers or secrets into free-text fields or uploaded documents. The service is designed to hold information about AI systems and their governance.

6. What happens if this policy is breached

If we believe this policy has been breached we will normally contact your account owner and give you a chance to put it right. Where a breach is serious, unlawful or puts other customers or the service at risk, we may suspend the account immediately, and may terminate it under the terms of service.

7. Reporting misuse

To report misuse of GhostAudit, including a concern that it is being used to monitor you unlawfully, write to [email protected]. We will look into every report.