Acceptable Use Policy

1. Scope

This Acceptable Use Policy (“AUP”) applies to everyone who uses the Services of plasmatic dev (“plasmatic”, “we”), including the plasmatic.dev website, the ZeroDay app and the digital goods we sell. It forms part of our Terms of Service and the ZeroDay EULA.

The examples below are not exhaustive. If you are not sure whether something is allowed, ask us at legal@plasmatic.dev before you do it.

2. Malware development and detection evasion

Our engine exists to detect malicious software. You may not use any part of the Services to make malicious software more effective. In particular, you may not:

• submit malware, or variants of it, to ZeroDay in order to check whether it is detected, so that you can modify it until it is not (sometimes called “AV checking” or “scan-and-tweak”);
• operate or support a service that tells others whether their malicious code is detected, such as a “no-distribute” scanner, crypter or packer service;
• use our verdicts, definitions, behaviour reports or other outputs to develop, test, validate, obfuscate or improve malware, exploit kits, phishing kits or other attack tools intended for use against people or systems without their authorisation;
• use ZeroDay to distribute malware, or to host, deliver or command malware; or
• probe our detection logic to extract signatures or models in order to defeat them.

Where the line is. Testing whether your own security product, your organisation’s defences or an authorised red-team exercise detects a threat is legitimate, as is analysing malware you have found in order to defend against it. The difference is purpose: using our engine to protect systems is welcome; using it as a quality check to make malicious code undetectable before it is used against others is not.

3. Data you have no right to submit

Only submit files, URLs, hashes and other data that you have the right to share with us for analysis. You may not submit:

• other people’s confidential or proprietary files, or personal data, unless you have the authority and a lawful basis to send them to us;
• data you obtained through unauthorised access, a data breach or other unlawful means, except where a security team or researcher is analysing it to defend against a threat and has the right to do so;
• URLs that contain passwords, session tokens, password reset links or other secrets belonging to someone else;
• classified information, or data whose transfer to us is restricted by law or by contract; or
• child sexual abuse material under any circumstances. If you come across it, report it to the authorities or to a specialist hotline, and do not send it to us.

4. Abuse of the Services

You may not:

• share, sell, lend or publish account access, or let people outside your organisation use it;
• create multiple accounts, or use other techniques, to get around limits or billing;
• scrape our website or bulk-harvest verdicts, for example by enumerating hashes or URLs you have not encountered, in order to copy our detection data;
• resell or redistribute raw verdicts or derived data as a competing threat-intelligence feed without an agreement;
• try to discover what other customers or users have submitted, or to link submissions to the people who made them;
• use automated tools to create accounts, or use the Services in a way that degrades them for others; or
• misuse our support, abuse and security channels, for example with spam or automated reports that have not been reviewed by a person.

5. Attacks on our infrastructure

You may not attack, disrupt or gain unauthorised access to our systems or those of our users. This includes:

• denial-of-service attacks, load testing or traffic flooding against the website or our update servers;
• accessing, or trying to access, accounts, data or systems you are not authorised to access;
• deliberately submitting content designed to escape or attack our analysis sandboxes, or using our analysis infrastructure to attack third parties, for example by submitting URLs that trigger actions against someone else’s systems;
• interfering with ZeroDay updates, distributing modified or fake ZeroDay installers, or impersonating our update or reputation services; and
• vulnerability scanning or exploitation beyond what our disclosure policy allows.

6. Illegal, harmful and deceptive use

You may not use the Services to:

• break any law, including computer misuse, data protection, export control and sanctions laws;
• monitor, track or collect data about people without their knowledge and a lawful basis, for example through stalkerware or covert surveillance;
• commit or support fraud, phishing, spam or other deceptive practices;
• harass, threaten or harm anyone;
• infringe anyone’s intellectual property or other rights; or
• impersonate plasmatic or ZeroDay, misrepresent our verdicts, or suggest that we endorse you or your product without our written permission.

7. Security research is welcome

We want to hear about weaknesses in our products. Good-faith security research on our website and the ZeroDay app is welcome when you follow our vulnerability disclosure policy, which explains what is in scope, how to test safely and how to report what you find. Research carried out under that policy is authorised, and we will not treat it as a breach of this AUP, the EULA or our other terms.

Analysing malware, publishing research about threats and comparing detection products using legitimately obtained samples are also welcome.

8. Reporting abuse

If you believe someone is misusing our Services, for example a fake ZeroDay installer, email abuse@plasmatic.dev. Please include:

• what you observed and when, including dates and times with a time zone;
• relevant URLs, file hashes, IP addresses or screenshots; and
• how we can contact you if we have questions.

Do not attach live malware to an ordinary email. Send a hash first and we will tell you how to share the file safely. We may not be able to tell you what action we take, but we review every report.

Other kinds of report have their own channels: send security vulnerabilities to security@plasmatic.dev, and false positives or missed threats to support@plasmatic.dev, as described on our Security page.

9. Enforcement

If we reasonably believe this AUP has been breached, we may take action that is proportionate to the breach, including:

• contacting you to ask you to stop or to fix the problem;
• throttling requests or blocking specific content;
• suspending features;
• suspending or closing your account, and ending your licence to use ZeroDay or any digital goods; and
• reporting unlawful activity to law enforcement or other appropriate authorities, and cooperating with them.

Where it is reasonable, we will warn you and give you a chance to fix the problem first. We may act immediately where there is a risk of harm to people, to our Services or to other customers, or where the law requires it. Fees are not refunded when an account is closed for a serious or repeated breach, except where the law requires a refund. If you think we have made a mistake, reply to our notice or email legal@plasmatic.dev and we will review the decision.

10. Changes

We may update this AUP as threats and our Services change. We will post the updated version here with a new “Last updated” date and, for material changes, give notice as described in section 18 of the Terms of Service.