ACCEPTABLE USE POLICY (AUP)

1. Purpose and Scope

This Acceptable Use Policy (AUP) sets out the rules governing access to and use of software, platforms, digital services, application programming interfaces (APIs), Digital Coworkers, intelligent systems, connected services and related technology provided or operated by FIFTEEN NETWORK LTD trading as 15 Group (15 Group, we, us or our).

The AUP applies to customers, authorised users, administrators, contractors, partners, developers and any other person or organisation accessing a service supplied by 15 Group, including services delivered through NEXUSS, ZEYL AI, Bridge and other 15 Group technology where this AUP is incorporated by reference.

This AUP forms part of the contractual framework governing the relevant service. Where a customer permits other users to access a service, the customer is responsible for ensuring that those users comply with this AUP.

2. General Standard of Use

You must use the services lawfully, responsibly, securely and in accordance with applicable contractual terms, documentation, permissions, technical limits and reasonable instructions issued by 15 Group.

You must not use, or permit the use of, a service in a way that is unlawful, fraudulent, abusive, deceptive, harmful, disruptive or reasonably likely to damage the security, availability, integrity, reputation or operation of 15 Group, its customers, its suppliers or any third party.

3. Authorised Access and Account Security

Users may access only the accounts, information, functions, systems, workspaces, APIs and connected services for which they have been authorised.

You must not:

• attempt to gain unauthorised access to any account, tenant, workspace, system, network, dataset, model, API, administrative function or connected service;
• circumvent authentication, permissions, access controls, approval controls, usage restrictions or other technical or organisational safeguards;
• share credentials, authentication tokens, API keys or other access mechanisms with unauthorised persons;
• use another person’s credentials or impersonate another user without lawful authority;
• probe, scan or test vulnerabilities without prior written authorisation from 15 Group; or
• retain or use access after the relevant authority or permission has been withdrawn.

Customers and users must take reasonable steps to protect credentials and must notify 15 Group promptly if they know or reasonably suspect that credentials, API keys or accounts have been compromised.

4. Security and Service Integrity

You must not interfere with or compromise the security, integrity, resilience or availability of a 15 Group service.

Prohibited conduct includes:

• introducing malware, ransomware, viruses, worms, malicious scripts, destructive code or other harmful components;
• conducting denial-of-service, distributed denial-of-service or similar attacks;
• deliberately overloading, flooding or degrading systems, infrastructure, APIs or service resources;
• attempting to bypass security monitoring, logging, rate limits, quotas, usage controls or service protections;
• using a service to attack, compromise, disrupt or gain unauthorised access to another system;
• interfering with another customer’s tenant, data, workflows, users or services; or
• concealing malicious activity or attempting to defeat audit, governance or security controls.

5. Unlawful, Harmful or Abusive Activity

You must not use the services to create, facilitate, promote, transmit, store or support activity that is unlawful or that infringes the rights of another person or organisation.

This includes use involving:

• fraud, deception, theft, extortion, money laundering or other criminal activity;
• harassment, threats, intimidation, stalking or unlawful discrimination;
• material that unlawfully infringes intellectual property, confidentiality, privacy, data protection or other legal rights;
• the unlawful collection, disclosure, sale or misuse of personal or confidential information;
• the creation or distribution of malicious, deceptive or fraudulent communications;
• impersonation intended to mislead, defraud or cause harm; or
• activity prohibited by applicable sanctions, export controls or other applicable law.

6. AI, ZEYL AI and Digital Coworkers

Where a service provides artificial intelligence, ZEYL AI capabilities, Digital Coworkers, automated reasoning, planning, recommendations, content generation or action execution, users remain responsible for how those capabilities are configured, instructed, supervised and used.

You must not:

• deliberately instruct an intelligent service to bypass permissions, approval requirements, governance controls or contractual restrictions;
• use AI-generated output as a substitute for legally required professional judgement, human approval or regulatory oversight where such oversight is required;
• represent machine-generated output as independently verified fact where verification is reasonably required;
• use Digital Coworkers to obtain information or perform actions that the user would not otherwise be authorised to access or perform;
• attempt to extract confidential system prompts, security controls, protected model information, credentials or other restricted technical information; or
• use automated capabilities in a manner that creates an unreasonable or foreseeable risk of material harm.

Human oversight, permissions and approval controls must not be intentionally disabled or circumvented where they form part of the authorised service configuration.

7. High-Risk and Regulated Use

Unless expressly agreed in writing by 15 Group and subject to appropriate controls, the services must not be used as the sole or final decision-making mechanism for decisions that could materially affect a person’s legal rights, physical safety, access to essential services or other similarly significant interests.

Where a customer uses a service within a regulated or high-risk environment, the customer is responsible for determining the legal and regulatory requirements applicable to that use and for implementing appropriate human oversight, validation, governance and controls.

8. Data, Content and Connected Systems

You must have all necessary rights, permissions and lawful authority to submit, connect, process, transmit or otherwise use data and content through the services.

You must not knowingly upload, connect or process data in breach of applicable law, contractual obligations, confidentiality duties or third-party rights.

Where a service connects to customer systems, databases, applications or third-party services, users must remain within the permissions granted for those systems and must not use the connection to extend access beyond the authorised scope.

9. APIs and Bridge

Use of APIs, including access delivered through Bridge, must comply with the applicable documentation, credentials, permissions, rate limits, Usage Credits, technical restrictions and contractual terms.

You must not:

• use APIs to bypass normal access controls or obtain capabilities not included in the authorised service;
• circumvent or manipulate Usage Credits, metering, billing, quotas, rate limits or other consumption controls;
• make excessive, abusive or deliberately inefficient requests intended to impair service performance or avoid commercial restrictions;
• provide API credentials to unauthorised third parties;
• use API access to create an unauthorised competing or substitute service where prohibited by the applicable agreement; or
• misrepresent the source, status or authority of information obtained through an API.

10. Automated Access, Scraping and Resource Consumption

Automated access must be authorised and must operate within documented technical and commercial limits.

Unless expressly permitted, you must not use bots, crawlers, scrapers, scripts or other automated methods to extract data, replicate services, harvest content, enumerate users or resources, or place unreasonable load on the services.

15 Group may apply reasonable rate limits, throttling, quotas, Usage Credits or other controls to protect service availability, security and fair use.

11. Intellectual Property and Technical Restrictions

Except where expressly permitted by applicable law or the relevant agreement, you must not:

• copy, reproduce, modify or create derivative works from protected components of the services;
• reverse engineer, decompile, disassemble or otherwise attempt to derive source code, protected architecture, models or proprietary technical information;
• remove or alter proprietary notices, security markings or rights-management controls;
• use 15 Group intellectual property in a way that falsely suggests ownership, endorsement or authority; or
• use the services to infringe the intellectual property rights of 15 Group or any third party.

12. Communications and Messaging

Where a service enables communications, messaging, outreach or automated interaction, users must comply with applicable privacy, marketing, communications and anti-spam laws.

Services must not be used for unsolicited bulk messaging, deceptive communications, unlawful direct marketing, phishing, credential harvesting or other abusive communications.

13. Monitoring and Investigation

15 Group may monitor service operation, usage patterns, security events, logs and technical activity to the extent reasonably necessary to operate, secure, support and protect the services, enforce contractual terms, investigate suspected misuse and comply with legal obligations.

Where 15 Group reasonably suspects a breach of this AUP, it may investigate the relevant activity and may require the customer or user to provide reasonable cooperation.

14. Enforcement

Where 15 Group reasonably determines that this AUP has been breached, or that activity presents a material security, legal or operational risk, 15 Group may take proportionate action. Depending on the circumstances, this may include:

• issuing a warning or requiring corrective action;
• restricting particular functions, integrations, credentials or API access;
• applying or adjusting technical safeguards, rate limits or usage restrictions;
• temporarily suspending an account, user, workspace, tenant or service;
• preserving relevant logs or evidence;
• terminating access where permitted by the applicable agreement; or
• reporting activity to, or cooperating with, competent authorities where required or permitted by law.

Where reasonably practicable and appropriate, 15 Group will seek to notify the relevant customer of enforcement action. Immediate action may be taken without prior notice where necessary to protect security, prevent harm, comply with law or preserve service integrity.

15. Customer Responsibility

Customers are responsible for the conduct of users they authorise to access the services and for configuring permissions, roles, integrations, workflows and approval controls appropriately for their organisation.

Customers should maintain appropriate internal policies, access controls, user training, governance and oversight for their use of the services.

16. Reporting Suspected Misuse or Security Issues

Suspected misuse, security vulnerabilities, compromised credentials or breaches of this AUP should be reported promptly to 15 Group.

Contact: info@15.group

Security research, vulnerability testing or penetration testing must not be carried out against 15 Group services without prior written authorisation.

17. Changes to this AUP

15 Group may update this AUP from time to time to reflect changes to its services, security requirements, legal obligations, technology or operational practices.

The current version will be made available through the relevant 15 Group website or service. Material changes will be communicated where required by the applicable agreement or law.

18. Relationship with Other Terms

This AUP should be read together with the agreement governing the relevant service, including any applicable Software / SaaS Terms & Conditions, order form, service schedule, Data Processing Agreement, privacy terms and other incorporated policies.

If there is a conflict between this AUP and a separately executed agreement, the executed agreement will prevail to the extent of the conflict unless that agreement expressly provides otherwise.

19. Contact

FIFTEEN NETWORK LTD trading as 15 Group

Registered in England and Wales. Company No. 16147355.

Registered office: Victoria House, 12 Hatherley Road, Sidcup, Kent, DA14 4DT.

Email: info@15.group

ICO Registration: ZC148205