Acceptable Use Policy

SecureByte is built to help your organisation evidence compliance, not to support activities that are illegal, harmful to others, or abusive of the platform itself. The clauses below set out what you may not do with the service. This policy is published by SecureByte Consulting (Pty) Ltd and is binding under our Terms of Service.

You may not use the SecureByte service to:

• Violate applicable law, including South African law (the Cybercrimes Act, POPIA, and the Electronic Communications and Transactions Act) and any equivalent law in jurisdictions where you operate.
• Process personal information without a lawful basis, or where you are not authorised by the responsible party.
• Misrepresent control state or evidence integrity — submitting forged evidence, tampering with the audit chain, or fabricating control results in any way.
• Use the service to attack or scan third-party systems you do not own or have written permission to test.
• Reverse-engineer, decompile, or attempt to extract source code from the service.
• Probe the service for vulnerabilities outside of our security-research disclosure process at security@securebyte.co.za.
• Reuse SecureByte-provided artefacts (sample reports, control documentation, templates) outside your own organisation in a way that constitutes redistribution for commercial advantage.
• Resell or sublicense the service to third parties — except as expressly permitted under the Enterprise+ MSP tier or under a written reseller agreement.
• Submit unlawful, harmful, or otherwise prohibited content (such as CSAM or terrorism-related material) to any platform feature.

When connecting third-party systems (cloud accounts, identity providers, code repositories, security or HR tooling) to SecureByte, you must:

• only connect systems you own or are authorised to connect, and only with credentials you are permitted to use;
• grant the minimum scopes required — cloud-posture connections are designed to be read-only, and you should not grant write access that the Service does not request;
• not use a SecureByte integration as a means to access, scan, or exfiltrate data from systems you do not have permission to access; and
• keep the credentials and tokens you provide secure, and revoke them through SecureByte when they are no longer needed.

Where you enable AI-assisted features, you must not:

• present AI-generated content to an auditor or regulator as verified fact without human review;
• use AI features to fabricate evidence, control results, or compliance narratives that misrepresent your actual posture;
• generate content that infringes intellectual-property rights, defames any person, or is otherwise unlawful; or
• submit content to AI features that you are not permitted to disclose to a third-party processor (unless you are using your own provider key under the BYOK option).

AI output is advisory; you remain responsible for the accuracy of anything you rely on or submit to a third party.

You may not:

• Generate excessive load that degrades service quality for other customers, beyond the limits documented for your plan, or attempt to circumvent rate limits.
• Attempt to bypass authentication, authorisation, rate-limit, or per-tenant isolation controls.
• Use automated systems against the service (scrapers, bots) without prior written permission, except for the documented API.
• Use credentials issued to one user for access by multiple individuals; each person accessing the service needs their own account.

Violations of this Acceptable Use Policy may result in warning, throttling, account suspension, or termination depending on severity. Where a violation poses an immediate security risk to other customers or to SecureByte, we may suspend the affected accounts without prior notice and restore them once the risk is resolved.

To report abuse of the SecureByte service, or to disclose a security vulnerability, email security@securebyte.co.za. See the Security page for our coordinated disclosure process.