Acceptable use

This policy is part of the terms of service.

Your machine, your responsibility

The machine is yours: we do not watch it and we cannot read what is on it. This policy says what you undertake not to do with our tools, and what we do the day we learn about it through a report, through your host, or through an authority.

Prohibited uses

Nothing that is illegal where you are and where the machine is hosted. No intrusion, scanning or flooding of a system that is not yours. No malware, no collection of stolen data, no fraud, no harassment, no child sexual abuse material, no content that exploits or endangers a person, and nothing that infringes the rights of others — works, trademarks, personal data.

Looking for vulnerabilities in Pupitre itself — the app, the agent, the console, the API — is not an intrusion as long as you follow the security policy.

Model providers

A coding agent you run stays subject to the terms of the provider whose model it calls. You do not use Pupitre to work around their limits, to share an account beyond what they allow, or to automate a use they forbid.

Resource abuse

Cryptocurrency mining, account farms, unsolicited mail and anonymous traffic relaying are not allowed on a machine Pupitre manages: they get your machine suspended by your host, and our name with it.

Reports

Report abuse to support@pupitre.studio, with the address of the machine and what you observed. We acknowledge the report and we answer the person who sent it.

Infringement of your rights

Pupitre hosts nothing that its customers’ machines serve: a page, a file or a service published from a machine lives with that machine’s host, which we do not replace. If content served from a machine Pupitre manages infringes your copyright, your trademark or your privacy, write to legal@pupitre.studio: who you are, the right at stake, the exact address of the content, and a statement that you act in good faith and that what you say is accurate. We pass the notice on to the owner of the organisation, and we act as described below when the infringement is manifest or a court decision establishes it. Write to the machine’s host as well: only the host can take the content down.

What we can see

What the platform knows of a machine is what the terms list: its name and address, its resources, the names of its installed modules and of its tmux sessions, and, if you turn them on, the reference of its backups. Nothing of what those sessions do, serve or store, nor of what those backups hold. We therefore judge a report on what it contains and on what we can verify from the outside — a public address, a public page — never by looking inside your machine, which we cannot do.

What we can do

Depending on severity: write to you, suspend the right of use of the machine concerned, or close the organisation. A suspension makes the agent refuse the app and removes the keys of your Pupitre devices from the block it manages in authorized_keys; it stops nothing on your machine, deletes no data and cuts off nothing that runs. A suspension based on a mistake is lifted as soon as the mistake is established.