Acceptable Use Policy

What you may not do with CyberWave Sentinel and the related services

1. Purpose, and how this policy fits the Agreement

1.1 Why this policy exists. CyberWave Sentinel is a multi-tenant platform. Every customer's data sits in the same infrastructure as every other customer's, and one customer's misuse can degrade the service, expose another customer, or put CyberWave in breach of the law. This policy states the limits plainly so that nobody has to guess where they are, and so that enforcement is predictable rather than arbitrary.

1.2 Capitalised terms. Capitalised terms used and not defined here have the meaning given in the Terms of Service — in particular Account, Administrator, AI Features, AI Output, Applicable Law, Authorized User, Customer, Customer Data, Input, Plan, Services, Third-Party Service, Trial and Workspace. In this policy, "you" and "your" mean the Customer and, where the context requires, an Authorized User.

1.3 Relationship to the Terms. This policy supplements the Terms of Service; it does not replace them and it does not narrow them. Where this policy and §21 of the Terms conflict, the Terms prevail (Terms §40.2). Nothing in this policy limits a right CyberWave has under the Terms or at law, and nothing in it creates a right for a third party.

1.4 Language. This policy is published in English. Where Applicable Law requires a French version for a particular customer, that version must be made available on the same basis as the Terms (Terms §2.5), and CyberWave will not charge for producing it.

2. Who this policy binds, and on what footing

2.1 Who is bound. This policy applies to the Customer, to every Authorized User, and to anyone else who accesses the Services using the Customer's credentials or Workspace — whether or not the Customer authorised that access. You are responsible for acts and omissions under your Workspace as if they were your own, including those of your employees, contractors and any Third-Party Service you connect.

2.2 Business use, and the authority to accept. The person who accepts the Terms represents and warrants that they are of legal age to enter a binding contract, that the Services are being acquired and used for business or professional purposes and not for personal, family or household purposes, and that they have authority to bind the organisation identified in the Account, which is the Customer. If you do not have that authority, do not accept the Terms and do not use the Services.

2.3 Mandatory consumer law prevails. This policy is written for business customers. If, despite §2.2, mandatory consumer protection law or other mandatory law applies and gives you rights that this policy would reduce, that law prevails to the extent of the conflict and the rest of this policy continues to apply. Nothing here excludes a right that cannot lawfully be excluded.

3. What CyberWave is, and what it is not

Some prohibitions below only make sense against an accurate picture of the product, so that picture is stated here.

Sentinel supports readiness, governance, assessment, evidence organisation and control management. CyberWave does not certify compliance, does not issue audit opinions, does not guarantee compliance, and does not replace independent auditors, certification bodies or legal counsel. Framework references are informational readiness mappings. CyberWave is not an insurer or an insurance broker, does not bind coverage, does not interpret policy coverage as legal advice, and does not guarantee coverage, premium reduction, claim payment or insurer acceptance. CyberWave does not operate a security operations centre and does not provide 24/7 monitoring, managed detection and response, emergency incident response or incident response retainers, penetration testing, forensics, legal representation, or audit and certification services.

Two consequences follow for acceptable use. First, the Services are not a security operations tool and must not be used as one — see §5.4. Second, output produced in Sentinel is a readiness artifact, not an attestation, and presenting it as one is prohibited by §4.5.

4. Prohibited use — unlawful, harmful and abusive activity

You must not use the Services, and must not permit any person to use them, to:

4.1 Break the law. Engage in, facilitate, promote or conceal any activity that breaches Applicable Law, including criminal law, privacy law, anti-spam law, export control and sanctions law, and the law of any jurisdiction in which you or the affected person is located.

4.2 Harass or abuse. Harass, threaten, stalk, defame, intimidate or abuse any person, including another Authorized User, an individual named in a control record or assessment, a person identified in an uploaded document, and CyberWave personnel. Content that a reasonable person would regard as harassing or discriminatory has no place in a Workspace, and it is a breach of this policy to put it there.

4.3 Publish or transmit unlawful content. Store, transmit or make available content that is unlawful, including child sexual abuse material, content that promotes violence or terrorism, and content that constitutes criminal harassment or hate speech. Where CyberWave becomes aware of content of this kind it will act under §15.4 and will report it where Applicable Law requires.

4.4 Deceive. Impersonate a person or organisation, misrepresent your affiliation or authority, forge or manipulate identifiers or metadata to disguise the origin of data or a message, or use the Services in furtherance of fraud, phishing or a payment or invoicing scam.

4.5 Misrepresent a security posture. Produce, alter or use a document, score, report, evidence record or package generated in or exported from the Services in a way that misrepresents any organisation's security posture, control status or evidence to an insurer, broker, underwriter, auditor, certification body, regulator, customer or other third party. You remain responsible for the completeness and truthfulness of what you present (Terms §11.4). Back-dating an evidence record, marking a control as implemented when it is not, or editing an exported report to change a finding are each a breach of this §4.5.

4.6 Interfere with others' use. Consume resources in a way that degrades the Services for other customers, or take any action intended to harm another customer, another customer's Workspace, or CyberWave.

5. Prohibited use — the security and integrity of the Services

5.1 Unauthorised access. You must not access, or attempt to access, any part of the Services, any Account, any Workspace, any data or any system that you are not authorised to access. This includes accessing another customer's data, accessing a colleague's Account without their authority, and using a credential, token, key, session or link that was not issued to you.

5.2 Tenant isolation. Each customer's data is held in its own Workspace, and isolation is enforced by PostgreSQL row-level security together with server-side authorisation. You must not attempt to circumvent, weaken, probe for a weakness in, or test the boundaries of that isolation, including by manipulating identifiers in a request, by crafting an Input intended to make an AI Feature return another tenant's content, or by any other means. If you believe you have found a way to cross a tenant boundary, stop immediately and report it under the Responsible Disclosure Policy — that is a report, not a research programme, and §12 explains the difference.

5.3 Access controls, limits and security measures. You must not circumvent or attempt to circumvent an authentication step, authorisation check, access control, entitlement check, usage limit, rate limit, content filter, safety control or other security or metering measure, whether by technical means, by using an undocumented interface, or by exploiting a defect.

5.4 Malicious code, and using the Services as a weapon. You must not upload, store, transmit or execute malicious code — including a virus, worm, trojan, ransomware, rootkit, keylogger, exploit, or an offensive security tool or payload — whether or not it is active, and whether or not you intend it to run. You must not use the Services, or any resource made available through them, to conduct or assist an attack on, intrusion into, or denial of service against any third party or any system, including your own systems and your vendors' systems. Sentinel is a governance and evidence platform. It is not a testing range, not a malware repository, and not attack infrastructure.

5.5 Credential theft and interception. You must not harvest, phish for, guess, brute-force, buy, sell, share or otherwise obtain a credential, token, API key, session or authentication factor belonging to another person or organisation, and you must not intercept, sniff or tamper with traffic to or from the Services.

5.6 Interference with the platform. You must not overload, flood, mirror, fork, tunnel through, or otherwise interfere with the Services or the infrastructure that provides them, disable or damage any part of them, or introduce anything designed to do so.

6. Prohibited use — automated access, rate limits and data extraction

6.1 How to reach the Services. You must access the Services only through the interfaces CyberWave provides for that purpose, and only in accordance with their documented limits.

6.2 Rate limits are real, and circumventing them is a breach. The Services apply rate limits. You must not circumvent, evade or defeat a rate limit or usage limit — including by rotating Accounts, credentials, API keys, IP addresses, tenants or devices, by distributing requests to stay under a threshold, by parallelising work across Authorized Users for that purpose, or by retrying at a rate designed to exhaust capacity.

6.3 Automated collection. You must not use a robot, crawler, spider, scraper, headless browser, macro, recorded session, or any other automated means to extract data or content from the Services at scale, to enumerate identifiers, records, users or endpoints, or to reconstruct a CyberWave framework mapping, control catalogue, questionnaire library, template or methodology. Ordinary automation of your own workflow through an interface CyberWave provides for that purpose is permitted; bulk extraction dressed as automation is not.

6.4 Your own data. This §6 does not restrict your right to get your own data out. Owners and admins of a Workspace can export its data in the product (Terms §25.1), and that is the supported route. Use it rather than scraping.

7. Prohibited use — Accounts, seats and credentials

7.1 One Account, one individual. An Account is for one named individual. You must not share an Account or its credentials between individuals, use a generic or role-based login as a substitute for individual Accounts, or allow a person who is not an Authorized User to use the Services under your Workspace.

7.2 Seats. Each Plan includes a number of Authorized Users — for Managed vCISO and Custom, the number agreed with you — and you must not exceed it other than as Terms §5.4 permits. Additional users are available as an add-on; buying a seat is the supported answer to needing another user, and sharing a credential is not. All amounts are in US dollars and exclude taxes.

7.3 Your obligations when something goes wrong. You must provision and de-provision Authorized Users promptly, keep credentials confidential, and notify CyberWave without undue delay at support@cyberwave.ca if you know or suspect that an Account has been compromised or that a credential has been disclosed.

8. Prohibited use — data you may not submit

8.1 Authority to submit. You must not upload, submit or direct the Services to receive any data unless you have the rights, consents and lawful authority necessary for CyberWave and its subprocessors to process it as the Agreement contemplates (Terms §11.2). Data you obtained without authority, data you are contractually barred from disclosing to a service provider, and another organisation's confidential information that you hold under a duty inconsistent with uploading it, are each prohibited.

8.2 Categories that are prohibited unless expressly agreed in writing. The Services are not configured for these categories and you must not submit them unless CyberWave has agreed in writing that they may be used for that purpose:

If you need to hold a category listed above, ask first. The answer may be no, and a clear "no" is better for both parties than a quiet upload.

8.3 Minimise. Evidence of a control does not usually require the personal information inside the record. Redact before you upload where redacting still proves the point. This is a request rather than a prohibition, and it reduces risk for both of us.

9. Prohibited use — intellectual property, reverse engineering, competing products and resale

9.1 Rights of others. You must not use the Services to infringe or misappropriate any person's intellectual property, moral, personality, privacy, publicity, confidentiality or trade-secret rights, or to remove or obscure a proprietary notice.

9.2 Reverse engineering, with the limit the law imposes. You must not reverse engineer, decompile, disassemble, or attempt to derive the source code, underlying ideas, algorithms, structure or organisation of the Services, except to the extent that a restriction of that kind is unenforceable under Applicable Law, or the conduct is expressly permitted by Applicable Law notwithstanding a contractual restriction. Where you intend to rely on that exception, tell us first at support@cyberwave.ca: in most cases we can give you what you need without anybody testing the boundary.

9.3 Competing products. You must not use the Services, the Documentation, Inputs or AI Output to build, train, evaluate, benchmark for publication, or improve a competing product, service or artificial intelligence model, and you must not access the Services for the purpose of competitive analysis on behalf of a competitor.

9.4 Resale and third-party access. You must not rent, lease, resell, sublicense, time-share, white-label, or provide the Services as a service bureau, managed service, consultancy deliverable or bureau offering to any third party, and you must not give a third party access to your Workspace for that purpose, except as an Order Form or a written partner or reseller agreement with CyberWave expressly permits. A consultant or advisor you engage may be made an Authorized User to work in your Workspace on your behalf; that is normal use and is not resale. Operating your own clients' programmes out of one Workspace is resale, and needs an agreement.

10. Prohibited use — messages sent through the Services

10.1 What the Services send. The Services send transactional and operational email on your instruction — account verification, password reset, user invitations, notifications and digests. They are not a bulk email, marketing automation or mass-messaging platform, and must not be used as one.

10.2 No spam, and no using our invitations as a mailing list. You must not use the Services, or any messaging or invitation feature in them, to send unsolicited commercial electronic messages, chain messages, or repeated messages to a person who has asked you to stop. You must not enter an address into an invitation, sharing or notification feature unless the person has a genuine reason to receive the message in connection with your use of the Services, and you must not use those features to distribute marketing content or to reach a purchased, rented, scraped or enrichment-vendor list.

10.3 Anti-spam law is your responsibility as well as ours. You are responsible for having a lawful basis for any message you cause the Services to send, and for the accuracy of the sender identification and content of that message.

11. Prohibited use — AI Features

11.1 The general rule. Everything prohibited elsewhere in this policy is equally prohibited when done with, or through, an AI Feature. Using an AI Feature to draft, plan, refine, translate, obfuscate or automate conduct that this policy prohibits is a breach of this policy.

11.2 Specific prohibitions. You must not:

• (a) use an AI Feature to generate, refine or debug malicious code, an exploit, a phishing message, a credential-harvesting page, or instructions for attacking a system without authorisation;
• (b) craft an Input intended to make an AI Feature disclose another tenant's data, CyberWave's system instructions, credentials, or the content of another Authorized User's Workspace;
• (c) attempt to circumvent a content filter, safety control, rate limit or metering measure applying to an AI Feature, or to induce the underlying model to ignore them;
• (d) submit as an Input any material you lack the rights to submit, or any category prohibited by §8.2;
• (e) use AI Features or AI Output to develop, train, evaluate or improve a competing artificial intelligence model or product; or
• (f) present AI Output as an audit finding, a certification, an attestation, professional advice, or the verified security posture of any organisation.

11.3 AI Output is assistive. AI Features are assistive and optional. Output may contain errors and does not replace professional judgement. You remain responsible for decisions made using it, and AI Output must be reviewed before it is relied on. Where an AI Feature is used, CyberWave's servers — never your browser — send the item you asked about, and often a summary of your Workspace such as record names, statuses, counts and saved answers, to CyberWave's AI provider to fulfil that request. CyberWave stores each AI result in your Workspace (the output, a short summary, and a short excerpt or label of the request of up to 300 characters) and records a short request excerpt in an append-only audit log. Some features also write AI Output into Workspace records, for example vendor and contract summaries and evidence review notes. AI use is metered against your Plan's monthly allowance, and a request is declined when the remaining allowance is too low. The AI Features & Data Use Notice describes the flow, and §4.5 of this policy applies to anything you do with the result.

12. Security testing and vulnerability research

12.1 No unauthorised testing. You must not test, probe, scan, fuzz, load-test, penetration-test or red-team the Services, and must not run an automated vulnerability scanner against them, except with CyberWave's prior written consent. The CyberWave Responsible Disclosure Policy is a route for reporting what you find; it does not itself permit testing.

12.2 If you find something, report it. A vulnerability discovered incidentally in ordinary use is welcome news and is not a breach of this policy. Stop, do not go further, do not access data that is not yours, and report it to support@cyberwave.ca with the subject line "Security". The Responsible Disclosure Policy explains what to include and what CyberWave will do.

12.3 Customer-commissioned testing. If your own compliance programme requires you to test a supplier, write to us before you test. A test conducted without prior written consent is a breach of §12.1 regardless of the requirement that prompted it, and it is also indistinguishable, in the moment, from an attack.

13. Reporting a suspected violation

Report a suspected breach of this policy to support@cyberwave.ca, with the topic in the subject line. Include what you observed, when, the Workspace or Account involved if you know it, and anything that would help us verify it. If the report concerns a security vulnerability, use the Responsible Disclosure Policy instead. If it concerns a suspected security incident affecting your own data, say so plainly in the first line so it is triaged as an incident.

Reports made in good faith are welcome, and CyberWave will not treat a good-faith report as a breach of the Agreement.

14. What CyberWave does, and does not, monitor

14.1 No general monitoring. CyberWave does not proactively review, screen or moderate Customer Data for breaches of this policy, and nothing in this policy creates an obligation to review, screen, moderate or scan Customer Data. CyberWave's own use of Customer Data, including access by CyberWave personnel, is governed by Terms §13.

14.2 What CyberWave does do. CyberWave operates the platform-level safeguards described in Terms §17.2 and investigates when it becomes aware of a possible breach — whether through a report, a support interaction or its own use of the platform. Becoming aware of one breach does not put CyberWave under a duty to look for others.

14.3 Why that is stated. A vendor that claims to monitor everything has made a promise it cannot keep, and customers rely on it. This section describes what actually happens.

15. Enforcement

15.1 Proportionality is the rule. CyberWave will use the least disruptive measure that addresses the problem, for no longer than the problem lasts. The response depends on the seriousness of the conduct, whether it is continuing, whether it is deliberate, whether it puts another customer or the Services at risk, and whether it has happened before.

15.2 The ladder. In ascending order, CyberWave may:

15.3 Notice, and the opportunity to remedy. CyberWave will give notice before taking a measure at step 2, 3 or 4, and, where circumstances permit, a reasonable opportunity to remedy the breach. Notice is given to the Administrator by email (Terms §36). Where advance notice is not practicable, notice will be given as soon as practicable afterwards, together with the reason.

15.4 Serious or repeated breach. CyberWave may terminate immediately, on written notice and without a cure period, where the breach is of §4.1, §4.3, §4.5, §5.1, §5.2, §5.4 or §5.5, where the breach is repeated after a notice under step 1, or where continuing to provide the Services would require CyberWave to break Applicable Law.

15.5 Restoration. A measure is lifted promptly once the ground for it is resolved. Where CyberWave has removed or quarantined content, it will restore it if the ground turns out not to have existed, so long as it is still technically possible to do so.

15.6 A measure taken in error. If CyberWave takes a measure under this policy and it later turns out there was no breach, that is CyberWave's error and not the Customer's, and the Customer's remedies are those in the Terms.

16. Emergency suspension

16.1 The right. Where CyberWave reasonably believes there is a genuine and immediate risk to the security, integrity or availability of the Services, to another customer's data, or to a third party, it may suspend the conduct, the feature, the Authorized User, the Workspace or the Account immediately and without prior notice.

16.2 The limits on it. An emergency suspension will be no broader and no longer than CyberWave reasonably considers necessary to contain the risk. CyberWave will notify the Administrator as soon as practicable and will say what was suspended, why, and what is needed to restore it. CyberWave will work with the Customer to narrow the suspension as soon as the risk allows, and will restore access promptly once the risk is resolved.

16.3 It is not a termination. An emergency suspension does not terminate the Agreement and does not by itself end the Customer's right to export its data. Where a suspension prevents export, CyberWave will make a route available on request unless doing so would recreate the risk.

17. Investigation, preservation and disclosure to authorities

17.1 Investigation. CyberWave may investigate a suspected breach of this policy, including by reviewing platform logs and, where necessary and proportionate to the investigation, the specific Customer Data implicated. It will limit that review to what the investigation requires.

17.2 Preservation. CyberWave may preserve data relevant to a suspected breach, a security incident, or a legal claim, and may suspend a deletion where Applicable Law or valid legal process requires preservation (Terms §25.7). Where it does so it will say so, unless it is prohibited from saying so.

17.3 Disclosure. CyberWave will disclose Customer Data to a law enforcement agency, regulator or other authority only where Applicable Law or valid legal process requires it, or where the Customer has authorised it. The Privacy Policy describes how CyberWave handles legal demands, including the limits it applies to them. CyberWave does not volunteer Customer Data to authorities in order to be helpful.

17.4 Your cooperation. Where CyberWave asks for information reasonably needed to investigate a breach under your Workspace, you will provide it within a reasonable time. Where the breach was by an Authorized User or a person using your credentials, you will take the steps within your control to stop it.

18. Effect of enforcement on fees, data and the Agreement

18.1 Fees. A suspension is not a termination and does not relieve the Customer of its obligation to pay Fees for the Subscription Period (Terms §22.3). The treatment of prepaid Fees on a termination for breach is governed by the Terms.

18.2 Your data. A suspension or termination under this policy does not, by itself, delete Customer Data. Deletion, export and the position on backups are governed by Terms §25, which separates removal from the active systems that serve the Services from the backup lifecycle, because those have different timelines. Where CyberWave has removed or quarantined specific content under §15.2, that content is removed from the active systems in the ordinary way and the backup position in Terms §25.5 applies to it as it does to anything else.

18.3 Liability. Nothing in this policy expands either party's liability beyond the Terms, and the limitation of liability in Terms §32 applies to any claim arising out of a measure taken under this policy.

19. Trials

19.1 This policy applies in full during a Trial. A Trial is real access to the Plan you select, so every prohibition above applies to it. In practice, a Trial is where CyberWave has the least information about who is using the Services and why, so §5 and §6 are enforced there at least as firmly as on a paid subscription.

19.2 The Trial terms, stated plainly. A Trial is a 14-day free trial of the Plan you select — Essentials or Full Platform only. No payment card is required. There is no automatic charge. There is no automatic conversion to a paid subscription. A Trial is not a paid Plan and includes no fees. Continuing after a Trial means choosing a paid subscription. Your data is not deleted because a Trial ended.

19.3 Ending a Trial is not a charge. CyberWave may end a Trial as Terms §6.5 and §23.6 provide, and will end one immediately for a breach of this policy. Because a Trial requires no payment card and includes no fees, ending it produces no charge and no amount owing. If a Trial ends for breach, Terms §25 continues to govern export and deletion, and the fact that a Trial ended is not itself a reason for CyberWave to delete your data.

20. Changes to this policy

CyberWave may update this policy, and Terms §37 governs how. For a material change — in particular one that materially expands the Customer's obligations, which is treated as a material change for the purposes of §37 — CyberWave will give at least 30 days' notice before it takes effect, by email to the Administrator and by publishing the new version with a new version identifier and effective date. A change applies prospectively only. Prior versions are retained with their version identifier and effective date as Terms §37.5 describes, so it is possible to establish which version applied when.

21. Contact

Every route above is the same mailbox; put the topic in the subject line. Notices to CyberWave are given by email to that address.

CyberWave is CYBER WAVE INC., an Ontario corporation (Ontario Corporation Number 1000780137), located in Markham, Ontario, Canada.