Skip to content

Acceptable Use Policy

xRazor attacks systems for a living. This is where it may point — and where it never may.

Last updated

Why this exists

xRazor performs real attacks: it discovers, exploits and verifies weaknesses. That is only legitimate against systems you are authorised to test. This policy applies to every customer, user, partner and pilot participant, and forms part of each customer agreement.

Authorisation comes first

You may point xRazor only at systems that you own, or that you have written permission from the owner to test. Before any run you must:

  • define the scope — hosts, ranges, applications and accounts — in the platform;
  • confirm that you hold the authority to approve testing of everything in that scope;
  • tell anyone who needs to know (hosting providers, managed-service partners, your security operations team) where their terms require it.

Cloud and hosting providers have their own testing rules. Following them is your responsibility.

Never

  • Test systems you do not own or have no written permission to test.
  • Use xRazor to gain unauthorised access, steal data, or cause harm to anyone.
  • Deliberately degrade availability (denial of service), destroy data, or deploy ransomware or other malware outside an agreed, controlled exercise.
  • Use findings, credentials or data discovered during a test for anything beyond securing the systems in scope.
  • Target critical infrastructure, healthcare or safety systems without a specific, written rules-of-engagement document agreed with their operator.
  • Resell, sublicense or offer xRazor as a service to third parties without a written agreement with us.
  • Reverse-engineer, tamper with, or disable the platform's scope controls or audit ledger.
  • Use xRazor in breach of export-control or sanctions law.

Scope enforcement and the audit ledger

The platform keeps every action inside the scope you set and records it in a tamper-evident ledger. The ledger exists to protect you: it is your evidence of what was tested, when, and by whom. It stays in your environment.

If something goes wrong

If you believe xRazor has touched something outside your authorised scope, stop the run and contact us at security@xrazor.io straight away. We will help you investigate.

Enforcement

If we have good reason to believe this policy has been broken, we may suspend support, licences or engagements under the terms of the customer agreement, and we will co-operate with lawful requests from authorities.

Reporting misuse

To report suspected misuse of xRazor, email security@xrazor.io with the subject "Misuse report".