Acceptable Use Policy

Operator: IQaaS, a trading name; a registered legal entity will be named here. Contact for abuse reports and questions: [email protected]. Security reports (security issues only): [email protected]. Governing law: England and Wales. This text is not legal advice.

What the beta is

DQaaS profiles data, checks it against rules and keeps a catalogue. It is an invite-only test on a shared server. It has no uptime promise, and data may be reset with 30 days notice. Do not rely on it for anything you cannot recreate.

You may

• Upload or register data you have the right to use, and profile it.
• Use the console, REST API, CLI and MCP endpoint with your own sign-in or tokens.
• Test your own access: only your own organisation.

You may not

1. Upload data you have no right to use. You must have the right to process it with a third-party service. Do not upload health data, special category data, or children’s data without a written agreement with us first.
2. Probe internal networks through URL datasets. An HTTPS URL dataset makes our server fetch the address. The platform blocks private, loopback and similar addresses and checks where redirects go. Do not try to bypass this, scan hosts or ports, or use the fetch to reach anything you do not own or have written permission to test. The block is a safeguard, not permission to test it.
3. Scrape or crawl others through the service, or use URL datasets as a proxy or relay.
4. Attack anyone. No denial of service, brute force, vulnerability scanning or exploit attempts against our systems, other users or third parties.
5. Read or disturb another organisation’s data. If you find a way, report it to [email protected] and do not use it. Good-faith reports made without harming data or other users will not lead to action against you.
6. Host illegal or harmful content. No malware, phishing material, stolen data or credentials, content that exploits children, or anything illegal where you or we are located.
7. Abuse resources. No mining, no bulk jobs designed to exhaust capacity, no creating extra accounts or sharing tokens to avoid limits, no evading rate limits or quotas. Uploads, row scans, job time and sign-in attempts are capped; stay within them.
8. Misuse credentials. Keep your tokens private. You are responsible for activity under them. Do not register OAuth or MCP clients in bulk.
9. Resell or relay the service without our written agreement.
10. Present results as more than they are. Findings are heuristics and are labelled inferred. Do not describe them as verified or certified to others.

What we may do

• Suspend an organisation. The operator can suspend and resume an organisation (POST /v1/admin/orgs/{id}/suspend and /resume, with a recorded reason). While suspended, its tokens, MCP and OAuth access and schedules answer 403 tenant_suspended, queued jobs are cancelled and running ones are interrupted. Its data is kept, and an owner cannot delete a suspended organisation. Suspension applies to the whole organisation. There is no way to suspend a single user.
• Remove access for one person. An organisation owner (or the operator, by withdrawing an invite) can withdraw an unused invite (DELETE /v1/admin/invites/{id}), remove a member (DELETE /v1/orgs/{id}/members/{user}; this also revokes that person’s tokens and OAuth grants in the organisation) or change a member’s role. The last owner cannot be removed.
• Delete an organisation. The owner, or the operator (DELETE /v1/admin/orgs/{id}), can delete an organisation and all its data. This is not reversible.
• Stop the service in an emergency.
• Look at records. We keep an audit log, usage events and a request log (method, path, status, milliseconds) to run the service and investigate abuse. We do not read stored profile contents unless needed to investigate abuse or a security problem.
• Change limits, withdraw invites or end the beta.
• Report illegal activity to authorities where required.
• We aim to tell you why, unless the law or an active attack prevents it. We make no promise of notice.

Your responsibilities

• Keep tokens and the one-time token value private; rotate or revoke them if exposed.
• You are responsible for the data you upload and the connections you register. Connection details are stored encrypted, but you should use read-only credentials.
• You can delete your account (DELETE /v1/me) and organisation yourself.

Limits of the beta

Provided as is, with no SLA, no support commitment and no promise about accuracy of results. See the Terms of Use and the Privacy Notice.

Terms of Use | Acceptable Use | Privacy | Back to home