Acceptable Use
It rehearses failure. Point it only at systems you are allowed to break.
A short policy, because a long one is a policy nobody reads before doing the thing it prohibits. The product's whole purpose is to drive an application into its worst conditions, which makes where you aim it the only question that matters.
Prohibited
What the product may not be pointed at.
- Pointing the agent at a system you are not authorised to test. The product exists to exercise an application until it breaks, and doing that to somebody else's is an attack however it is labelled.
- Naming a production database in source_url_env that you do not have the right to copy, including one holding another company's data under a contract that does not allow it.
- Using a golden as a way to move production data somewhere it is not allowed to go. A masked copy is still derived from the original, and masking is a reduction of risk rather than a change of jurisdiction.
- Running the load generator against a third party you do not control. Containment holds inside the environment; a host you allow through it is a host you are sending real traffic to.
- Feeding the product data you are prohibited from processing, including special category personal data, payment card data, and anything under an export control you have not cleared.
- Reselling access, or running the hosted control plane as a service for others, without a written agreement that says you may.
The other direction
What we will not do, which is the half worth writing down.
- Read your production database. The engine reaches a source only through pg_dump and a read only transaction, and no part of the hosted control plane holds a source connection string.
- Use your data to train a model. Nothing in this product sends customer data to a model provider for training, and there is no path that would.
- Take a snapshot of production into the hosted control plane. It is not a backup target, and the trust boundary is drawn so that it cannot become one.
- Enforce this policy by reading your environments. Enforcement is a conversation, because the alternative is a surveillance capability nobody asked for.
Enforcement
What happens if this is broken.
| How we would find out | A report, a bill, or a provider telling us. There is no monitoring of what an environment contains, and building one to enforce this policy would cost more privacy than the policy protects. |
|---|---|
| What we would do | Ask first. An organization can be suspended, which stops new work and leaves the data in place, and that mechanism exists in the control plane today. |
| Immediate suspension | Reserved for an active attack on somebody else, or a legal demand we have to act on. Everything else gets a conversation before anything stops. |
| Appeal | Write to the contact on this site. There is no formal appeal process yet and pretending otherwise would be worse than saying so. |
Drafted, not reviewed by counsel
No lawyer has read this. It describes what the software does and what we intend, and it has not been checked for whether it is enforceable or complete. It must be reviewed before the product takes money.
Next
Know what happens before you deploy.
Create a disposable production twin for every risky change. Catch migration failures before they reach customers.