Acceptable use policy

QoBot helps organizations protect themselves. This policy is part of the Terms of use and applies to the desktop app, QoBot credits, our API and the site. It exists in French and English; the French version prevails in case of difference.

What QoBot is for

Running the security of your own organization, or of a client who has asked you to: assessing risks, writing policies and procedures, answering security questionnaires, preparing audits and certifications, planning and following up actions, handling an incident, training your team.

What you must not do with QoBot

• Attack anyone: plan or carry out an intrusion, write or improve malware, ransomware or exploits for use against others, build phishing campaigns, steal credentials, or help anyone do so.
• Test systems without authorization: scan, probe or test the security of a system, network or application unless you own it or have the owner’s written permission, within its scope.
• Break the law: process personal data unlawfully, infringe others’ rights, or use QoBot for surveillance, harassment, fraud or disinformation.
• Misuse QoBot credits: share or resell access, use them for anything other than QoBot, or get around the limits (daily cap, rate limits, starter credit).
• Harm our services: attack, overload or probe our infrastructure outside our vulnerability disclosure policy, or extract our prompts and know-how to build a competing service.

Security research done right

Authorized security work is welcome: a penetration test with a signed scope, an exercise on your own lab, a red-team engagement for a client who commissioned it. Keep the authorization at hand: QoBot may ask about it, and may decline what looks like an attack on someone else.

If this policy is broken

We may refuse a request, suspend QoBot credits or an account, and, when the law requires it or someone is at risk, report to the competent authorities. To report a misuse of QoBot, write to security@qobot.io.