Acceptable Use Policy

Purpose & Universal Scope

This Acceptable Use Policy ("AUP") defines mandatory behavioral and operational standards governing every business, workspace member, developer, partner, and API consumer using Spike Console and related Cyber Ultimax Limited ecosystems (including NattyPad). This policy forms an integral part of our Terms of Service. We enforce zero tolerance for actions that imperil platform integrity, tenant isolation, or regulatory compliance.

Prohibited Activities & Statutory Offenses

You shall NOT under any circumstances use the Services to:

• Violate Criminal & Cyber Laws: Violate the Cybercrimes (Prohibition, Prevention, etc.) Act 2015/2024, the Criminal Code, or international criminal statutes, including computer fraud, identity theft, unauthorized access, denial-of-service attacks, malware distribution, or cyber extortion.
• Financial Fraud & Unlicensed Schemes: Operate fraudulent Ponzi schemes, multi-level marketing (MLM) pyramids, unlicensed financial operations, unauthorized collective investment schemes, advance-fee scams, money laundering, or sanctions evasion under the Money Laundering (Prevention and Prohibition) Act 2022.
• Infringe Privacy & Data Rights: Ingest, store, or process personal data of third parties (employees, customers, or prospects) without a lawful basis under the Nigeria Data Protection Act 2023 or GDPR, or maintain deceptive biometric surveillance databases.
• Tenant Boundary Breach & Vulnerability Exploitation: Attempt to circumvent PostgreSQL Row-Level Security (RLS), probe, scan, or exploit multi-tenant workspace isolation boundaries, or intercept cryptographic tokens belonging to other businesses.
• Deceptive Impersonation & Domain Squatting: Impersonate another legal entity, financial institution, brand, or government agency using custom storefront subdomains (e.g. *.spikeconsole.app) or authenticated Custom Domains.

Autonomous AI & Agent Governance Guardrails

As Spike Console executes autonomous workflows, agents, and generative model completions, users are strictly bound by the following safety principles:

• No Adversarial Prompt Injection: You must not craft, inject, or deliver malicious prompts, jailbreaks, or adversarial inputs intended to override system safety instructions, bypass authorization gates, or leak underlying model directives.
• Mandatory Human Oversight for High-Risk Actions: Autonomous agents must not be configured to disburse non-recoverable funds, execute payroll transfers, or finalize statutory tax filings without explicit human-in-the-loop validation.
• No Weaponized Automation: Automated workflows must not be weaponized to generate spam, automated nuisance calling/messaging, bulk harassment, or distributed denial-of-service floods.

API Fair Use, Rate Limiting & Credential Hygiene

Developer API keys grant authenticated machine-level access to your business records. Developers must:

• Never commit raw API keys or webhook signing secrets to public version control repositories (e.g. GitHub).
• Adhere strictly to enforced per-minute and per-hour API rate limits. Any intentional effort to evade rate limiters through distributed proxies is an immediate violation.
• Handle webhooks with signature verification to prevent spoofed request injection.