Acceptable Use Policy

Policy at a Glance

1.Purpose and Scope

This Acceptable Use Policy ("AUP") defines the rules for safe, lawful and responsible use of PIEDAP and its connected services. It is intended to protect the security, availability, integrity and trustworthiness of the ecosystem while enabling customers, users, developers and partners to use PIEDAP for legitimate enterprise purposes.

This AUP applies to the PIEDAP website, platform applications, customer environments, APIs, webhooks, connectors, developer and partner interfaces, sandboxes, trial and proof-of-concept environments, AI-assisted capabilities, documentation and other services where this AUP is referenced or incorporated into an agreement.

2.Permitted Use

You may use PIEDAP only for lawful and authorized enterprise purposes within the scope of your account, role, subscription, license, trial, partner authorization or written agreement.

• Use only accounts, environments, APIs, modules, features and data sets that you are authorized to access.
• Follow documented security, authentication, rate-limit, integration and technical requirements.
• Use Customer Data, personal data and confidential information only where you have a lawful basis, authority and appropriate organizational approval.
• Maintain appropriate human review for AI-assisted recommendations, assessments, risk outputs, compliance conclusions, talent insights and other material decisions.
• Comply with applicable laws, regulations, contracts, professional obligations and your organization's internal policies.
• Cooperate with reasonable security, abuse-prevention, incident-response and compliance measures.

3.General Prohibited Conduct

You must not use PIEDAP, directly or indirectly, for conduct that is unlawful, harmful, fraudulent, abusive, deceptive, disruptive or inconsistent with the intended enterprise use of the Services.

• Violate applicable law, regulation, court order, contractual restriction or third-party right.
• Facilitate fraud, theft, deception, harassment, extortion, abuse, unlawful surveillance or other harmful conduct.
• Circumvent regulatory, audit, security, privacy, governance or organizational controls.
• Knowingly submit materially false, fabricated or misleading information where accuracy is important to an assessment, audit, consent record, risk decision, project report or talent evaluation.
• Use PIEDAP to facilitate activities that Pion Global reasonably determines present a material threat to the security, integrity, availability or lawful operation of the Services.

4.Security and System Abuse

You must not interfere with, compromise, bypass or attempt to defeat PIEDAP security or the security of any customer, user, partner, integration or connected system.

• Attempt unauthorized access to accounts, tenants, data, APIs, infrastructure, secrets, keys, tokens, administrative functions or connected systems.
• Bypass authentication, authorization, tenant isolation, role-based access, license controls, rate limits, security controls or usage restrictions.
• Introduce malware, ransomware, spyware, destructive code, credential-stealing content or other harmful components.
• Conduct denial-of-service activity, traffic flooding, resource exhaustion, credential stuffing or other disruptive activity.
• Probe, scan, exploit or perform vulnerability assessment, penetration testing, red-team activity or security research without prior written authorization.
• Attempt to obtain source code, secrets, model configuration, system prompts, security rules or internal architecture through exploitation, prompt injection, jailbreak techniques or other unauthorized methods.
• Interfere with logs, audit trails, security alerts, evidence records or monitoring intended to protect the Services or customers.

5.Data, Privacy and Confidentiality

You are responsible for ensuring that data submitted to PIEDAP is lawfully obtained, appropriately classified and authorized for the intended processing.

• Do not upload or process personal, confidential, regulated, proprietary or sensitive information unless you are authorized to do so and appropriate contractual and security controls are in place.
• Do not access, export, disclose, scrape, infer, re-identify or attempt to obtain data belonging to another customer, user or organization.
• Do not use PIEDAP to violate privacy rights, confidentiality duties, data localization requirements, consent requirements or data-subject rights.
• Do not submit passwords, private keys, authentication secrets or unnecessary highly sensitive data into free-text, prompt or AI fields unless the feature and agreement explicitly support that use.
• Do not use anonymization, aggregation or de-identification features to intentionally re-identify individuals or circumvent privacy protections.
• Do not retain, download or redistribute data beyond the permissions, retention period or business need authorized by your organization and applicable agreement.

6.AI, Agentic Automation and Automated Decision-Making

PIEDAP may provide AI-assisted features, agents, copilots, recommendations, summaries, classifications, predictions and generated content. These capabilities are intended to support, not replace, accountable enterprise judgment.

• Do not use AI features to create malware, phishing, social-engineering content, credential theft, unlawful surveillance, deception or other harmful activity.
• Do not intentionally manipulate prompts, context, documents, connectors or agent workflows to bypass policy, access controls or safety restrictions.
• Do not represent AI-generated content, recommendations or predictions as independently verified facts where verification is reasonably required.
• Do not use PIEDAP AI as the sole basis for a legally prohibited or otherwise inappropriate high-impact decision, including employment, disciplinary, eligibility, financial, regulatory or similar decisions, without required human review and safeguards.
• Do not use AI functionality to discriminate unlawfully or to infer sensitive characteristics in a manner prohibited by law or contract.
• Do not use customer data, platform outputs or AI features to train or improve an external model where doing so would violate confidentiality, intellectual property, privacy or contractual obligations.
• You remain responsible for reviewing outputs, validating material conclusions and ensuring that downstream actions are appropriate for the relevant context.

7.APIs, Developer Portal, Bots and Automated Access

Automated access is permitted only through approved interfaces and within documented or contractually authorized limits.

• Use only issued API keys, OAuth credentials, service accounts and tokens, and protect them against unauthorized disclosure.
• Do not exceed documented or contracted rate limits, concurrency limits, quotas, storage limits or other technical controls.
• Do not scrape webpages or user interfaces, automate browser interactions or harvest information where an authorized API or export mechanism is required or where such activity is prohibited.
• Do not attempt to discover undocumented endpoints, hidden parameters, internal APIs or privileged functions for unauthorized purposes.
• Do not use APIs to create competing data sets, replicate substantial platform functionality, or systematically extract platform content except where expressly permitted.
• Validate webhook origins, secure integration secrets and follow published integration-security requirements.
• Bots, agents and integrations must identify and operate under an authorized customer or service account and remain attributable to the responsible organization.

8.Excessive Use and Shared-Service Protection

PIEDAP may apply technical safeguards to protect service quality and fair access across shared infrastructure. You must not intentionally consume resources in a way that materially degrades the Services or other customers' use.

• Do not generate excessive requests, workloads, data transfers, background jobs or automation that unreasonably burden shared systems.
• Do not circumvent storage, user, transaction, API, AI-token, compute, environment or other subscription limits.
• Do not run stress tests, load tests or high-volume synthetic workloads against production systems without prior written authorization.
• Do not create multiple accounts, tenants or credentials to evade limits, restrictions, suspension or billing controls.
• Pion Global may throttle, queue, restrict or temporarily disable abusive workloads where reasonably necessary to protect service stability.

9.Intellectual Property, Reverse Engineering and Competitive Misuse

• Do not reverse engineer, decompile, disassemble or attempt to derive non-public source code, models, algorithms, prompts, schemas or proprietary design except where applicable law expressly prohibits such restriction.
• Do not copy, modify, distribute, sublicense, sell or create unauthorized derivative works of PIEDAP software, documentation, templates, assessment content or proprietary materials.
• Do not remove, obscure or alter copyright, trademark, confidentiality or other proprietary notices.
• Do not use PIEDAP content, documentation, outputs or interfaces to benchmark, train or build a competing service where prohibited by contract or applicable law.
• Respect third-party intellectual property rights when uploading code, documents, assessments, evidence, media or other content.

10.Communications, Content and Collaboration Misuse

Where PIEDAP enables notifications, surveys, messages, collaboration, invitations, comments or external communications, you must use those functions responsibly.

• Do not send spam, phishing, deceptive invitations, unsolicited bulk communications or communications that violate applicable marketing or privacy laws.
• Do not upload or distribute unlawful, malicious, defamatory, infringing, threatening or abusive content.
• Do not impersonate another individual, organization, regulator, auditor, customer, partner or Pion Global representative.
• Do not falsify authorship, timestamps, evidence provenance, approvals, acknowledgements, consent records or audit history.
• Do not use collaboration or survey functionality to harass, retaliate against or improperly pressure employees, respondents, Data Principals or other individuals.

11.Platform-Specific Responsible Use

12.External Integrations and Third-Party Services

PIEDAP may connect with customer systems and third-party services. You are responsible for having authority to connect those services and for configuring scopes, credentials, data flows and permissions appropriately.

• Do not connect a third-party account, repository, cloud environment, CRM, HR system, ITSM tool or other service without authorization.
• Do not use integrations to copy or move data in violation of third-party terms, data-protection obligations, confidentiality requirements or licensing restrictions.
• You are responsible for external-service credentials, permission scopes and configuration under your control.
• Third-party services remain subject to their own terms, availability, security and privacy practices.

13.Partner, Marketplace and Ecosystem Conduct

Partners, integrators, resellers, solution providers and developers participating in the PIEDAP ecosystem must comply with this AUP and any applicable partner or developer terms.

• Do not claim partnership status, certification, authorization, endorsement or technical compatibility beyond what Pion Global has expressly approved.
• Do not misuse PIEDAP names, trademarks, logos, documentation or customer references.
• Do not use partner access to obtain customer data, platform information or competitive intelligence beyond the authorized engagement.
• Maintain appropriate confidentiality, security and data-protection controls for customers and Pion Global information.
• Do not introduce integrations, extensions or services that materially compromise platform security, availability, integrity or customer trust.

14.Security Research and Vulnerability Reporting

PIEDAP welcomes responsible reporting of suspected security vulnerabilities. However, this AUP does not grant permission to conduct security testing. Security research, scanning, exploitation, penetration testing or similar activity requires prior written authorization unless expressly permitted under Pion Global's published Responsible Vulnerability Disclosure Policy.

• If you discover a suspected vulnerability, stop any activity that could access, alter, destroy or expose data beyond what is reasonably necessary to confirm the issue.
• Do not exfiltrate data, pivot to other systems, establish persistence, conduct denial-of-service testing or publicly disclose an unresolved vulnerability without coordination.
• Report vulnerabilities through the published vulnerability-reporting channel or to [email protected] until a dedicated security mailbox is published.
• A vulnerability report does not create an entitlement to payment or a bug bounty unless Pion Global has separately announced a reward program.

15.Customer and Administrator Responsibilities

Customers and account administrators are responsible for reasonable governance of their users, integrations, credentials and data within their control.

• Provision access according to least privilege and remove or update access promptly when roles change.
• Configure authentication, SSO, MFA, API credentials, integration scopes and security settings appropriately for the customer environment.
• Educate authorized users regarding this AUP and applicable customer policies.
• Investigate suspected misuse by users under the customer account and cooperate with reasonable Pion Global security inquiries.
• Maintain appropriate backup, retention, classification and export practices for Customer Data where those controls are the customer's responsibility.
• Ensure contractors, partners and service accounts using customer credentials comply with this AUP.

16.Monitoring, Detection and Investigation

Pion Global may use service telemetry, security logs, authentication information, API and usage metadata, abuse-detection mechanisms and other proportionate controls to operate, secure and protect PIEDAP and to investigate suspected violations. Monitoring will be conducted in accordance with applicable law, the PIEDAP Privacy Policy and contractual obligations.

Pion Global does not rely on this AUP as a general right to inspect Customer Content without limit. Where review of specific content is reasonably necessary to investigate security, abuse, legal or contractual issues, Pion Global will seek to limit access to what is reasonably necessary and will apply applicable confidentiality and privacy obligations.

17.Enforcement and Consequences

Pion Global may take proportionate action where it reasonably believes a violation has occurred or an immediate risk exists. Depending on severity, urgency, recurrence and contractual terms, actions may include:

• Warning the customer, administrator or user and requesting corrective action.
• Throttling or restricting a workload, integration, API key, feature, account or environment.
• Removing or isolating malicious or prohibited content where reasonably necessary.
• Temporarily suspending access while a security, abuse or legal issue is investigated.
• Terminating access or Services for material or repeated violations, subject to applicable contract terms.
• Preserving relevant records, notifying affected customers or third parties, or reporting matters to authorities where required or permitted by law.
• Seeking legal or equitable remedies where necessary to protect Pion Global, customers or third parties.

18.Reporting Suspected Misuse

If you become aware of suspected misuse, unauthorized access, data exposure, abusive automation or another violation of this AUP, please report it promptly. Include sufficient information to identify the affected account, environment, activity and timing without sending unnecessary sensitive data.

19.Exceptions and Written Authorization

An activity otherwise restricted by this AUP is permitted only if Pion Global has provided specific prior written authorization or the activity is expressly allowed by an applicable signed agreement, documented feature or published policy. Authorization may be subject to scope, timing, environment, testing, rate, confidentiality, security and reporting conditions.

20.Changes to this AUP

Pion Global may update this AUP to reflect changes in the PIEDAP ecosystem, law, security practices, platform functionality, APIs, AI capabilities or abuse patterns. The updated version will be published with a revised "Last Updated" date. Where required by an applicable agreement or law, Pion Global will provide additional notice of material changes.

21.Contact

Questions about this Acceptable Use Policy may be directed to: