This Acceptable Use Policy (the "Policy") sets out how Guard.ch may and may not be used. It forms part of the Terms of Service, and capitalised terms have the meanings given there. It applies to Customer, its Users, and every person or application that uses a Session through Customer's account, including AI agents with agent control and guests with a share link.

Guard.ch is made for professional work in cloud browsers, including opening unknown or suspicious links away from Users' own devices. Opening a dangerous website to understand it, report it or protect others is legitimate use; using the Service to cause harm is not.

Customer and its Users must not use the Service, and must not allow anyone else to use it, to:

1. Stalk, harass, intimidate, or monitor an identified or identifiable natural person, or build profiles or dossiers on private individuals without a lawful basis.
2. Conduct penetration testing, vulnerability scanning, exploitation, or any other security testing of a system that Customer does not own and is not authorised in writing to test. The Service is a cloud browser, not a launchpad for unauthorised access, intrusion, or denial-of-service activity.
3. Circumvent authentication, paywalls, rate limits, anti-fraud or anti-bot measures of a third party, or use a server location or residential connection to evade a restriction that a third party is legally required or entitled to apply to the User, such as a block based on sanctions law.
4. Scrape, mirror, or systematically harvest third-party sites or personal data, including by automating Sessions through agent control or the API. Automating Sessions for legitimate testing, monitoring or research is permitted; continuous, large-scale extraction of third-party content or personal data is not.
5. Knowingly open, or use the Service to obtain or distribute, content that is illegal under Swiss law or under the law of the jurisdiction in which the User operates, including child sexual abuse material, content inciting violence, or content otherwise prohibited by criminal statute. If a Session started in good faith shows such content, the User must end the Session, must not save, copy or share the content, and Customer must report it to legal@guard.ch.
6. Commit or support fraud, phishing, scams or impersonation, including testing stolen credentials or payment cards, creating fake accounts at scale, or click and advertising fraud.
7. Host, distribute or control malware, mine cryptocurrency, or use a Session or its network exit as a proxy or relay for other devices or for third parties.
8. Use the Service for any other unlawful purpose, or in a way that infringes the rights of a third party that Customer is bound to honour.
9. Reverse engineer, decompile, or attempt to derive the source code of the Service, except to the extent such a restriction is prohibited by applicable law.
10. Resell, sublicense, or expose the Service to third parties as a paid product, including white-label resale, without our prior written consent. Internal use by Customer's subsidiaries and affiliates is permitted, and so is consulting work in which a User opens a client's website or links inside a Customer workspace.
11. Interfere with the integrity or performance of the Service, including by tampering with the isolation layer, attempting to escape a container, interfering with the Security Extensions, or probing other customers' workspaces or Sessions.
12. Misuse our IP space, our mail domain or our rDNS to send unsolicited communications, conduct credential phishing against third parties, or otherwise damage the reputation of our network.

1. Use no more Sessions, resources or traffic than the plan provides, and do not work around the plan's limits, the session time limits or the limits of the free start, for example with several accounts.
2. An own proxy or WireGuard VPN must be one that the User or the Workspace is entitled to use. It must not route traffic through devices or networks of third parties without their consent.
3. Residential connections run through a third-party provider's network. They must not be used for spam, mass account creation, credential stuffing, attacks or anything else that harms that network's participants or the reputation of its addresses.
4. Files uploaded to or downloaded from a Session are the User's responsibility. The Service must not be used to store or distribute files that infringe rights or are unlawful, or to move malware onto devices or networks where it can cause harm.

Anonymous mail gives each User a receive-only mailbox for sign-ups and messages that should not reach a personal or company address. Users must not use it to:

1. deceive others about who they are in a way that is unlawful, or commit fraud;
2. receive content that is unlawful to possess, or collect mail addressed to someone else;
3. create accounts with third-party services in bulk or by automation, or evade a ban that a third-party service has lawfully imposed;
4. reserve aliases to keep them from others, or trade aliases.

Mail can contain dangerous links and attachments. Open them in a Session rather than on your own device.

1. An application with agent control acts with the permissions of the account that connected it. The User remains responsible for what it does and must supervise it as far as its actions could harm third parties.
2. Agent control, CDP and the API must not be used for attacks, credential stuffing, mass account creation, buying up tickets or limited goods with bots, click or advertising fraud, or other automated abuse.
3. API keys must be kept secret and sent only in request headers. A key that may have leaked must be revoked at once.
4. Rate limits apply, and the API must not be used in ways that are not documented or authorised.

1. Share a Session only with people who may see what it shows. Anyone holding a share link can watch or use the Session until it ends.
2. Accounts are personal. Credentials must not be shared, accounts must not be sold or transferred, and accounts must not be created by automated means.
3. Do not create several accounts to use the free start more than once or to evade a suspension or termination.

Opening suspicious links, phishing pages and malware sites to understand them, protect people or report them is a purpose Guard.ch is built for, as long as Users observe and do not take part in an attack. In particular:

1. Do not enter real credentials, payment data or other personal data of third parties into a page suspected of phishing.
2. Downloaded files stay in the Session unless a User saves them to a device. Treat a file a Session marks as dangerous as malware.
3. Findings of the Security Extensions are opinions (section 7 of the Terms) and must not be published as a determination by Guard.ch.

We do not routinely inspect the content of Sessions or mailboxes. We monitor resource use, traffic patterns and abuse signals, and review metadata where we receive a complaint or detect suspicious activity, as described in the Privacy Policy. If we find a violation of this Policy, we may, depending on its severity:

1. warn Customer and ask it to stop the activity;
2. end Sessions, switch off Extensions, or block a mail alias or address;
3. throttle or suspend a User, a Workspace or the account (section 13 of the Terms);
4. terminate access under section 14 of the Terms;
5. report the conduct to the competent authority where the law requires or permits it.

Where possible we inform Customer and give it the opportunity to respond first; for severe violations, such as attacks or illegal content, we may act immediately. If Customer believes we acted in error, it may object in writing to legal@guard.ch within 14 days, and a person will review the decision.

Report abuse involving Guard.ch, including traffic from our addresses or mail sent to an address on our mail domain, to legal@guard.ch with the time, the addresses involved and a description. We review every report and protect the identity of the person reporting to the extent the law allows.

We may update this Policy, for example when we add Extensions or the law changes. Material changes are announced at least 30 days before they take effect, by email or in the dashboard, as described in section 22 of the Terms of Service.

Send questions about this Policy to legal@guard.ch. Our postal address is in the Legal notice.