Acceptable Use Policy

This Acceptable Use Policy (“AUP”) governs use of RECON ONE websites, services, systems, and cybersecurity capabilities.

It supplements any applicable customer agreement.

1. Authorized and Lawful Use

RECON ONE services may be used only:

• for lawful purposes;
• within the scope of appropriate authorization;
• in accordance with applicable agreements; and
• in compliance with applicable laws, regulations, policies, and contractual obligations.

Customers are responsible for ensuring that they possess authority to provide systems, networks, data, files, captures, logs, credentials, configurations, or other materials to RECON ONE for analysis.

2. Prohibited Use

You may not use RECON ONE systems, services, deliverables, or materials to:

• gain unauthorized access to systems, accounts, devices, networks, or data;
• facilitate malware deployment or malicious code execution;
• conduct unauthorized reconnaissance, scanning, exploitation, credential attacks, or persistence;
• interfere with or disrupt systems or services;
• evade security controls for an unlawful or unauthorized purpose;
• commit fraud, theft, extortion, harassment, or other unlawful conduct;
• violate another person’s privacy or confidentiality rights;
• unlawfully collect, intercept, disclose, or distribute information;
• disguise malicious activity as authorized cybersecurity research;
• misrepresent RECON ONE findings, reports, or authorization; or
• violate applicable sanctions, export-control requirements, or other applicable law.

3. Cybersecurity Testing and Assessment

Cybersecurity testing or technical activities must remain within the expressly authorized scope.

Where RECON ONE performs technical work, scope limitations, approved targets, testing methods, timing, exclusions, and other authorization requirements may be established in a statement of work or similar document.

Authorization for one environment, system, organization, or engagement does not constitute authorization for another.

4. Sensitive Information

Do not provide unnecessary:

• passwords;
• authentication tokens;
• private keys;
• cryptographic secrets;
• regulated personal information;
• unrelated confidential information; or
• other sensitive material.

Where such information is necessary for an approved engagement, it must be handled through an authorized method agreed with RECON ONE.

5. Customer Responsibility

Customers are responsible for:

• obtaining necessary internal and third-party approvals;
• identifying relevant restrictions on supplied information;
• accurately describing authorization and ownership;
• complying with applicable legal obligations; and
• notifying RECON ONE of material scope or authorization changes.

6. Service Restrictions

RECON ONE may decline, pause, limit, or terminate work when we reasonably believe:

• authorization is insufficient or unclear;
• requested activity may be unlawful;
• activity exceeds the agreed scope;
• continuing creates an unacceptable security or safety risk;
• supplied information violates applicable requirements; or
• continued activity would conflict with RECON ONE’s professional, contractual, or legal obligations.

7. Violations

Suspected misuse may result in restriction or termination of access or services and, where appropriate, preservation of relevant records or referral to affected organizations or lawful authorities.

8. Contact

Questions about authorized use may be sent to:

info@recon-one.com

Security vulnerabilities affecting RECON ONE should instead be reported under the Responsible Disclosure Policy at:

disclosure@recon-one.com