Acceptable Use Policy

This policy sets out how you may and may not use Vault42. Vault42 is operated by Marijn Wijbenga, trading as Vault42, a sole trader (OSVČ), registered in the Czech Republic. IČO: 24378534. Business address: Revoluční 2137/8b, 110 00, Praha 1 - Nové Město, Czech Republic. The policy forms part of our Terms of Use. By using the service you agree to it.

Scope

This policy applies to the Vault42 hosted git service as a whole, and to every feature that is part of it now or in the future. That includes git repositories, wikis, issues, pull requests and comments, releases and their attachments, the package registry, Git LFS storage, Forgejo Actions and the runners that execute it, repository mirroring, user and organisation profiles, and our support channels on Matrix and email.

In this policy, "content" means anything you store on the service, publish through it, or send through it. That includes code, files, commit messages, wiki pages, issue and comment text, profile text, avatars, usernames and organisation names, release attachments, packages, and CI logs and artefacts. The rules apply to all content, whether public or private.

This policy applies to everyone who uses the service. That includes account holders, organisation owners and members, collaborators, anyone who acts through an access token or an automated workflow, and visitors to public repositories.

Vault42 is in beta. This policy applies in full during the beta.

Permitted use

You may use Vault42 to develop, store and collaborate on software. That includes version control, code review, issue tracking, continuous integration and delivery, and the hosting of documentation and release artefacts. Personal, open-source and commercial projects are all welcome.

Prohibited use

You must not use any part of Vault42 to store, publish, distribute or carry out any of the following:

• Child sexual abuse material, in any form.
• Sexually explicit content, whether photographic, drawn, rendered or generated. Non-sexual nudity is allowed where it is part of a software project, such as artwork in a game or illustrations in medical software.
• Terrorist content, or content that incites violence.
• Content that infringes copyright, trademarks, trade secrets or other intellectual property rights.
• Malware intended for deployment, phishing kits, command-and-control infrastructure, or credential lists intended for attacks.
• Code that harms the computer of a person who clones, installs, builds or runs the project in the normal way.
• Attacks on any system, including denial of service, unauthorised scanning, and attempts to break into systems of third parties or of Vault42.
• Spam, fake accounts, automated mass account creation, or artificial inflation of stars, followers or other metrics. This includes accounts or repositories created mainly to advertise or to manipulate search engines.
• Fraud, scams, impersonation, or content designed to deceive.
• Usernames, organisation names, avatars or profiles that impersonate another person or organisation, or that are obscene or insult a person or group.
• Harassment, threats, hate speech, or the publication of another person's personal data without a legal basis (doxxing).
• Leaked credentials, or personal data that you have no right to process.
• Cryptocurrency mining, in CI runners or anywhere else on the service.
• File hosting, content delivery or backup storage that has no relation to software development.

Restricted and high-risk activities

The following activities are allowed within limits. We may ask you about them, and we may restrict them if they cause harm or put the service at risk.

• Security research. You may host exploit code, proofs of concept, malware samples and CTF material for legitimate research, defensive or educational purposes. Label such material clearly in the repository, for example in the README. It must not run during a normal clone, install, build or CI run, for example through git hooks, install scripts or CI workflows. You must not use it against systems you have no permission to test. You must not distribute malware in a form ready for deployment.
• Resource use. CI minutes, storage and bandwidth must stay within the limits of your plan. Use that degrades the service for other customers is not allowed, even within those limits.
• Automated access. Access through the API must stay within the published rate limits.
• Large files. Store large binary files through Git LFS, within your quota.

Compliance with laws and sanctions

You must comply with all laws that apply to you and to your content. This includes the law of the European Union and of the Czech Republic, data protection law such as the GDPR, and export control law.

You must not use Vault42 if EU restrictive measures prohibit us from providing the service to you or to the organisation you act for. You must not use the service to evade sanctions or export restrictions.

Vault42 handles notices about illegal content under the EU Digital Services Act (Regulation (EU) 2022/2065).

Account and security rules

• A personal account belongs to one person. Do not share login credentials.
• Keep your registration details accurate.
• Keep your passwords, keys and access tokens secure. We strongly recommend two-factor authentication.
• Do not try to bypass usage limits, access controls or other technical measures.
• If you find a security vulnerability in Vault42, report it to us as described on our security page. Do not exploit it.

Responsibility for third parties and sub-users

The owner of an account or organisation is responsible for all activity in it. That includes activity by members, collaborators and seat holders, and activity through bots, access tokens and CI workflows.

The repository owner is responsible for third-party code and dependencies in a repository. If you give your own customers or users access to Vault42 through your account, you must ensure that they also follow this policy.

Reporting abuse

To report illegal content or abuse of the service, email abuse@vault42.eu. Include the URL of the content, the reason you consider it illegal or abusive, and your contact details. We confirm receipt and handle the report without undue delay.

Monitoring and enforcement

Vault42 may monitor the service to enforce this policy and to keep the service secure. We monitor resource use and rate limits to keep the service stable for all customers.

Vault42 will run automated checks on all content stored on the service, including private repositories, to detect malware and known child sexual abuse material, and to report known vulnerabilities in dependencies. Images in public repositories will also be checked for sexually explicit content. These checks will run on Vault42's own infrastructure in the EU, and no files will be sent to third parties.

Vault42 staff do not read the contents of private repositories as a matter of routine. A person reviews specific content only when an automated check flags it, when we receive a report about it, or when the law requires it, and only to the extent needed to assess that case.

If you breach this policy, we may take one or more of these actions, in proportion to the breach:

• give a warning;
• remove content or disable access to it;
• restrict features, such as CI;
• suspend the account;
• terminate the account.

For excessive traffic, resource use or storage, we normally give a warning first and allow time to reduce the use. We act without a warning when the use is clearly malicious or puts the service at risk for other customers.

A malware detection in a private repository leads to a review, without automatic action. We act when malware is public, is distributed through releases or packages, is executed in CI, or can run during a normal clone, install or build. When sexually explicit content is found in a public repository, we make the repository private or disable access to it, and then review the case. A match against known child sexual abuse material leads to the immediate suspension of the account, and we report it to the competent authorities as the law requires.

We may act without prior notice in cases of illegal content, active security threats, or sanctions matches. We report to the authorities where the law requires it.

When we restrict or remove content or an account, we tell you the reason, unless the law prevents that. You can appeal the decision by email to abuse@vault42.eu. A person reviews every appeal, and we tell you the outcome. You may also take the matter to a court. Termination for a breach of this policy gives no right to a refund, unless the law requires one.

Changes

We may update this policy. The "last updated" date above shows the current version. We tell customers about material changes in advance by email.

Contact

For questions about this policy, email info@vault42.eu. For abuse reports, email abuse@vault42.eu.