Ekaya Cloud Acceptable Use Policy

Version 1.2, effective 2026-10-17.

This Ekaya Cloud Acceptable Use Policy (the "AUP") sets out what customers, their users and their agents may not do with Ekaya Cloud, the hosted service operated by Ekaya Inc, a Delaware corporation ("Ekaya"), whose address is 1112 Montana Ave #414, Santa Monica, CA 90403. It forms part of the Ekaya Cloud Terms of Service. This AUP covers Ekaya Cloud only. It does not apply to Ekaya Enterprise or to any Ekaya software that a customer runs in its own environment.

1. Regulated data that Ekaya Cloud does not accept

1.1 Customers must not store in Ekaya Cloud, connect Ekaya Cloud to, or process through Ekaya Cloud any of the following:

protected health information under HIPAA;
cardholder data or sensitive authentication data under PCI DSS;
criminal justice information under the FBI CJIS Security Policy;
technical data controlled under ITAR or the EAR;
data inside a FedRAMP or other federal authorization (ATO) boundary;
special categories of personal data under Article 9 of the GDPR (for example health, biometric, genetic, racial or ethnic origin, religious beliefs, sexual orientation or political opinions).

1.2 Ekaya does not inspect Customer Content to find such data. The customer is responsible for keeping it out.

1.3 Customers that need to process such data can ask about Ekaya Enterprise, which is offered under separate terms and is not part of Ekaya Cloud.

2. The customer's confirmation

2.1 By accepting the Terms, which incorporate this AUP, a customer confirms: "I will not put protected health information, payment card data, criminal justice information, export-controlled technical data, data inside a federal authorization boundary, or special-category personal data into Ekaya Cloud. I understand that Ekaya does not check, and that Ekaya Enterprise is the option for that data."

3. Prohibited uses

Customers, their users, their agents and their applications must not use Ekaya Cloud to:

3.1 break the law, or help anyone else break it, including laws on privacy, data protection, consumer protection, export control and sanctions;

3.2 infringe or misappropriate intellectual property or other rights;

3.3 store, send or run malware, or code designed to disrupt, damage or gain unauthorized access to any system;

3.4 access, probe or test any system, account or data without authorization, including other customers' Projects and Ekaya's own infrastructure beyond the customer's own Project;

3.5 work around the Service's authentication, access controls, approval gates, usage limits or metering, or hide the identity of the person or process acting;

3.6 connect a datasource or third-party service that the customer has no right to connect, or use a connected service in breach of its provider's terms;

3.7 send spam or phishing, or publish an application that deceives the people who use it about who operates it;

3.8 harass, threaten or harm anyone, or publish content that sexually exploits children;

3.9 place an unreasonable load on the Service, including cryptocurrency mining, denial-of-service activity, or automated use designed to exceed published limits; or

3.10 make decisions that produce legal or similarly significant effects on individuals solely by automated means, without human review where the law requires it.

4. Agents

4.1 An agent or process connected to a Project acts for the person or Data Access Point whose identity it uses, and the customer is responsible for what it does under this AUP. Instructions that an agent receives from content it reads do not authorize it to break this AUP.

5. Security research

5.1 A customer may test the security of its own Project, within its own Role's permissions and the published limits, but must not test other customers' Projects, Ekaya's shared infrastructure, or Ekaya's providers. Report suspected vulnerabilities to security@ekaya.ai. Ekaya acknowledges security reports within 2 business days. Security research done in good faith and within this Section is authorized, and Ekaya will not bring or support legal action against the customer for it.

6. Reporting abuse

6.1 Report a suspected violation of this AUP to support@ekaya.ai.

7. Enforcement

7.1 If Ekaya reasonably believes that this AUP has been violated, it may investigate; require the customer to remove content or stop an activity; suspend or limit a Project, User Account, Data Access Point, application or connection; terminate the customer's account under the Terms; and report the matter to law enforcement where the law requires or permits. Ekaya acts in proportion to the risk, gives notice before acting when it reasonably can, and otherwise promptly afterwards.

7.2 Ekaya investigates without accessing Customer Content wherever it can, and otherwise only as Terms Section 5.6 allows.

8. Changes

8.1 Ekaya may update this AUP by publishing a new version with a new effective date, with notice as the Terms Section 14 provides.