Acceptable Use & Authorized Testing Policy

DRAFT, not yet reviewed by a lawyer.
Effective date: [EFFECTIVE DATE]
Last updated: 11 November 2026

GLAV is a tool for authorised security testing. This policy sets out what you may and may not do with it. It forms part of our Terms of Service and applies to every user of every account, including team members and invited clients.

The core rule is simple: only test what you own or have explicit written permission to test, and only within the agreed scope.

1. Authorised targets only

1.1 You may submit a target (a domain, subdomain, IP address or range, URL, application, API, repository, cloud account or other asset) only if:

• (a) your organisation owns or controls it; or

• (b) you hold explicit, written authorisation from its owner to perform automated security testing, such as a signed engagement letter, statement of work or rules-of-engagement document.

1.2 Verbal permission, implied permission, or the fact that a system is publicly reachable is not authorisation.

1.3 Where a target is hosted by a third party (for example a cloud, hosting or SaaS provider), you are responsible for complying with that provider’s own penetration testing policy.

1.4 You must keep records of your authorisation for at least [AUTHORISATION RECORD RETENTION] and provide them to GLAV promptly on request.

2. Explicit scope

2.1 Every test must have a defined scope that matches your authorisation, including:

• the exact assets in scope and any exclusions;

• permitted testing windows (dates and times);

• permitted techniques and intensity; and

• any constraints set by the asset owner (for example, no testing of production payment flows).

2.2 You must not configure a scope wider than your authorisation. If your authorisation expires, is withdrawn or changes, you must stop or update the affected tests immediately.

3. Domain and asset verification

3.1 Before testing, GLAV may require you to verify control of a target, for example by adding a DNS TXT record, placing a file at a specified path on the web server, or another method we offer.

3.2 Verification shows technical control of an asset. It does not prove you are legally authorised to test it, and it does not shift responsibility for authorisation to GLAV.

3.3 Where you test on behalf of a client, verification should be performed by, or with the knowledge of, that client.

4. The scope gate

4.1 The Service includes a scope and authorisation gate that checks each test request against the verified, in-scope assets for your project. Requests for out-of-scope or unverified targets are blocked.

4.2 Automated controls cannot catch every case. You remain responsible for making sure every test is authorised, even if the scope gate allows it.

5. Prohibited uses

You must not use the Service, or any finding or output from it, to:

• (a) scan, probe, test or attack any system, network or application that you do not own and are not explicitly authorised in writing to test, including third-party systems connected to an in-scope asset;

• (b) carry out denial-of-service or stress testing, or deliberately degrade the availability of any system, unless this is explicitly authorised by the owner and supported by the Service;

• (c) test critical infrastructure, essential services, healthcare, emergency services, industrial control systems, government or military systems without specific written authorisation from the owner and compliance with any applicable sector rules;

• (d) create, distribute, host or deploy malware, ransomware, botnets, persistent backdoors or other malicious code;

• (e) access, copy, alter, delete or exfiltrate data beyond what is strictly necessary to demonstrate a vulnerability within your authorised scope;

• (f) evade, disable, circumvent or tamper with the scope gate, domain verification, rate limits, logging, tenant isolation or any other safeguard, including by manipulating DNS, redirects, proxies or target definitions;

• (g) use findings, credentials, exploits or reports to attack, extort, harass or gain unauthorised access to anyone, or sell or disclose them to anyone not entitled to receive them;

• (h) send spam or phishing messages, or conduct social engineering against people who have not consented as part of an authorised engagement;

• (i) attempt to access other customers’ data or tenants, or test the GLAV platform itself other than under our Responsible Disclosure Policy;

• (j) violate any applicable law, including export control and sanctions laws; or

• (k) help or allow anyone else to do any of the above.

6. Handling of sensitive data found during testing

6.1 Tests may surface credentials, secrets, personal data or other sensitive information. Use such data only to validate and report the vulnerability, do not reuse discovered credentials outside the authorised scope, and handle such data in line with your agreement with the asset owner and applicable data protection law.

6.2 Report any accidental out-of-scope access to the asset owner and to GLAV at [SECURITY CONTACT EMAIL] without delay.

7. Logging, monitoring and cooperation with authorities

7.1 GLAV logs test activity, including who started each test, against which targets, with which settings, and when. Audit logs are kept for [AUDIT LOG RETENTION] and are used to operate the Service, enforce this policy and investigate abuse.

7.2 We may review activity and test configurations where we suspect misuse.

7.3 Unauthorised access to or interference with computer systems is a criminal offence in many countries, including under the offences against computer systems, programs and data in the Croatian Criminal Code (Kazneni zakon), the United States Computer Fraud and Abuse Act (18 U.S.C. § 1030) and the United Kingdom Computer Misuse Act 1990, as well as other national laws implementing the EU rules on attacks against information systems.

7.4 We cooperate with law enforcement and competent authorities. Where we are legally required to, or where we reasonably believe it is necessary to prevent or address serious harm or crime, we may preserve and disclose relevant account information, logs and test data to them, in line with our Privacy Policy and applicable law.

8. Consequences of breach

If we reasonably believe this policy has been breached, we may, without liability and without prior notice where the situation is urgent:

• stop or block running and scheduled tests;

• suspend or terminate the user or account;

• withhold or delete outputs generated in breach of this policy;

• notify the affected asset owner;

• report the matter to the authorities; and

• seek recovery of our losses under the indemnity in our Terms.

Fees for tests stopped because of a breach of this policy are not refunded.

9. Reporting abuse

If you believe GLAV is being used to test your systems without authorisation, contact [SECURITY CONTACT EMAIL] with the affected assets, dates and times (with time zone), and any relevant source IP addresses or log extracts. We will investigate promptly.

10. Changes

We may update this policy to respond to new risks or legal requirements. The latest version is always available at glav.ai/acceptable-use.