Acceptable use policy

This policy forms an integral part of the contractual set. It exhaustively defines the purposes for which the service may be used and the uses that are prohibited. It applies to the customer, its users, its staff and its subcontractors, for whom it is responsible.

1. Permitted purposes

Use of the service is limited to the following purposes, listed exhaustively:

• the security of the customer's information systems and digital assets, in particular detecting compromised accounts and the related remediation;
• preventing, detecting and investigating fraud affecting the customer;
• threat intelligence, threat modelling and risk assessment specific to the customer;
• the performance, by a duly mandated partner, of cybersecurity services for the benefit of the end customer concerned;
• demonstrating the customer's security diligence to a supervisory authority, an insurer or an auditor.

Any use foreign to these purposes is prohibited. Where there is doubt as to whether a contemplated use falls within one of them, the customer refers the matter to Stealed beforehand.

2. Prohibited uses

The customer shall not:

• search, or have searched, a perimeter of which it is not the legitimate owner or for which it holds no documented mandate;
• contact, for any purpose whatsoever, individuals whose credentials have been exposed, other than its own staff and solely for remediation purposes;
• use the service for disciplinary purposes, individual surveillance, professional evaluation or economic intelligence on a third party;
• republish, resell, redistribute, make available to a third party or upload to a database accessible to third parties all or part of the leak data disclosed;
• attempt unauthorised access to the Platform, circumvent its restrictions, share a named account, or use automated extraction outside the API provided for that purpose;
• develop, support or improve, directly or indirectly, a competing service from the leak data disclosed;
• use leak data to train, fine-tune or evaluate a machine learning model, save with prior written authorisation;
• carry out penetration or load testing on the Platform without prior written authorisation and an agreed protocol.

The last prohibition applies neither to threat-led penetration testing conducted under Articles 26 and 27 of Regulation (EU) 2022/2554 (DORA), nor to penetration testing conducted by a customer that is an essential entity within the meaning of Directive (EU) 2022/2555 (NIS 2), under the corresponding addenda.

3. Keyword rules

Keywords submitted for monitoring are directly linked to the security purpose pursued and contain no personal data. Prohibited are keywords corresponding to the name of a natural person, the name of a competitor, the name of a third party for which the customer is not responsible, and terms liable to reveal data falling under Article 9 of Regulation (EU) 2016/679.

Every keyword is subject to Stealed's prior approval, which may be refused without reasons and withdrawn at any time if its continued use appears incompatible with this policy.

4. Benchmarking and public statements

The customer shall not publish, without Stealed's prior written agreement, any benchmark, performance measurement or element of the Platform's methodology. This restriction covers the technical and methodological elements belonging to Stealed.

It does not prevent the customer from expressing an opinion on the service, from using data relating to its own exposure, or from disclosing information to a supervisory authority, an auditor, an insurer or in legal proceedings.

5. Customer's duty of care

The customer takes appropriate measures to prevent any misuse of the service by its users, staff and subcontractors. It informs Stealed without delay of any non-compliant use of which it becomes aware and puts an immediate stop to it.

It keeps its user list up to date, revokes without delay the access of persons who have left or changed roles, and applies to data extracted from the Platform the minimum measures set out in the security policy.

6. Monitoring and sanctions

Stealed logs sensitive actions performed on the Platform and may carry out sample checks on compliance with this policy, without accessing the content of the customer's internal communications.

Any breach constitutes a material breach of the contractual set and permits immediate suspension of access, then termination by operation of law if the breach is not remedied within the period set by the formal notice.