SecureGraph Acceptable Use Policy

1. Purpose and scope

This AUP applies to your use of the Platform, including all modules, APIs, connectors, Assessment Services, and any output (reports, findings, alerts). Breach of this AUP is a material breach of the Terms and may result in immediate suspension or termination and, where conduct is unlawful, referral to the appropriate authorities.

2. Authorized use only

You may use the Platform only to assess, discover, or test systems you own or for which you hold written authorization from the lawful owner. Before initiating any active testing, you must confirm ownership or authorization in the Platform. The Platform records your confirmations and activity for audit purposes.

• You must not test, scan, or probe any asset outside your confirmed in-scope set.
• You must not redirect, resell, or white-label the Platform or its outputs without SecureGraph's prior written consent.
• You must not use the Platform to provide testing services to third parties for assets you are not authorized to test.

3. Prohibited conduct

The following are strictly prohibited and may constitute offences under the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (as amended), the NDPA 2023, or other Nigerian law:

• Unauthorized access to any computer system or network (Section 6 of the Cybercrimes Act).
• Denial-of-service, or any act that seriously hinders the functioning of a computer system (Section 8).
• Distribution of malware, ransomware, viruses, or spyware (Section 32(3)).
• Phishing or attempts to obtain passwords, credentials, or card details by deception (Section 32).
• Password or credential trafficking and use of devices designed to overcome security measures (Section 28).
• Cyberstalking, harassment, or sending offensive or threatening messages (Section 24).
• Data exfiltration or theft of information you are not authorized to access.
• Scanning or testing any system designated as Critical National Information Infrastructure without lawful authority.
• Use of the Platform to facilitate fraud, money laundering, or financing of terrorism.
• Circumventing or interfering with the Platform's own security, rate limits, or access controls.

4. Cloud-hosted and third-party assets

Where a Submitted Asset is hosted by a third party (for example a cloud provider or managed service), you must comply with that provider's own vulnerability-testing and acceptable-use policies, and obtain any permission the provider requires, in addition to the owner's authorization. You are responsible for ensuring your testing does not breach the provider's terms.

5. Targets we can't verify technically

Some targets, such as IP addresses and IP ranges, can't be tied to an owner by a DNS or file check. When you add such a target or start a test against it, you confirm that you own it or hold current written authorization from its lawful owner to test it, and that the test is within the scope of that authorization. SecureGraph relies on this confirmation and does not independently verify it. You are solely responsible for every such target and for all consequences of testing it, including claims by its owner or hosting provider, and you indemnify SecureGraph under the Terms of Service. You must produce the authorization on request. SecureGraph may suspend testing or your account if you can't, and records every target, test and confirmation for audit and, where the law requires, for the authorities.

6. Data and privacy obligations

You must not upload, process, or extract personal data except as necessary for the lawful operation of the Platform and in compliance with the NDPA 2023 and NDPR 2019. Where the Platform processes personal data on your behalf, you remain responsible for the lawfulness of that processing and for discharging data subject rights.

7. Reporting and cooperation

You agree to cooperate with SecureGraph and with law enforcement and regulators in connection with any investigation of suspected unlawful or unauthorized activity. Nothing in this AUP limits SecureGraph's right to report suspected criminal conduct, or to comply with legal process. As an organization operating computer systems, you are independently responsible for complying with incident reporting duties, including reporting attacks to the National CERT Coordination Centre within the timeframes required by Section 21 of the Cybercrimes Act, and notifying the NDPC of personal data breaches under Section 40 of the NDPA.

8. Monitoring and enforcement

SecureGraph may monitor Platform activity to detect violations of this AUP, protect the security and integrity of the Platform, and comply with legal obligations. We may suspend or terminate accounts that violate this AUP, with or without notice, and may preserve and disclose records as required by law or in response to lawful requests.

9. Changes to this policy

SecureGraph may update this AUP. Material changes will be announced with at least thirty (30) days' notice; continued use of the Platform after the effective date constitutes acceptance.

10. Contact

To report a suspected violation of this AUP, or to request clarification, contact us through the Platform's support channel.