DevQuaySign inStart a private trial
Draft
This text is under review and is not in force. Bracketed details are still to be completed.

DevQuay Acceptable Use Policy

Version 0.2 (paid beta) · Effective date: [EFFECTIVE DATE] · Last updated: 2026-10-30

This policy is part of the [Terms of Service](terms-of-service.md). It applies to every Organization, User and Agent (any coding agent, MCP host, CLI, CI job or script connected with an OAuth grant or service credential). Capitalised terms have the meaning given in the Terms.

1. Content you must not submit, import, capture or publish

  • Content that is unlawful, or that infringes someone else's intellectual property, privacy or confidentiality rights, including source code, documents or designs you are not authorised to use.
  • Malware, exploit payloads intended for use against others, or files designed to attack the Service (for example archive bombs or path-traversal archives).
  • Secrets and credentials: passwords, API keys, private keys, kubeconfigs, decrypted secret manifests or tokens. The Service tries to strip them, but you remain responsible for not submitting them.
  • Special categories of personal data (health, biometric, political opinions and similar), criminal-offence data, payment card data or government identifiers. DevQuay is built for engineering standards and catalog data, not for these categories.
  • Personal data of children.
  • Content that harasses, threatens or incites violence or discrimination against people, or sexual content involving minors.

2. Things you must not do with the Service

  • Try to access another organization's data, a collection you are not granted, or any part of the Service you are not authorised to use, including by changing identifiers in URLs, headers or request bodies.
  • Probe, scan or test the security of the Service without our written permission. Report suspected vulnerabilities to security@devquay.com; we will not take action against good-faith reports that follow this policy and avoid harm to data and other customers.
  • Interfere with or overload the Service: bypass rate limits, budgets or usage caps, run automated traffic beyond the published limits in `/v1/capabilities`, or create accounts or organizations to avoid limits.
  • Register fictitious services or split monorepos artificially to evade plan service bands.
  • Use reference capture to fetch pages you are not entitled to access, pages behind authentication, internal network addresses, or to scrape sites in breach of their terms. Reference capture is for public pages you may lawfully use as design or technical references.
  • Use the Service to send spam or unsolicited messages, including through invitations or notifications.
  • Resell, sublicense or provide the Service to third parties as a hosted service, except to your own affiliates and contractors working for you.
  • Copy the Service or build a competing product using non-public parts of it, or reverse engineer it except where the law allows this despite a contractual restriction.
  • Remove or misrepresent provenance, status or capability labels (for example presenting AI Output or unverified evidence as reviewed or verified) in a way intended to deceive.
  • Use the Service in breach of export control or sanctions laws.

3. Hosted AI features

When your Organization enables a hosted AI provider, you must also comply with that provider's usage policy:

  • OpenAI usage policies: <https://openai.com/policies/usage-policies>
  • Anthropic usage policy: <https://www.anthropic.com/legal/aup>

In particular, do not use AI features to generate malware, to deceive people about whether content is AI-generated where that matters, or to make decisions with legal or similarly significant effects on individuals without human review.

4. Agents and credentials

You are responsible for every action taken with your Organization's OAuth grants and service credentials. Give Agents only the scopes and resources they need, store service credentials securely, never commit them to repositories, and revoke them when no longer needed.

5. Public portals

Only publish content you are entitled to make public. Do not publish other people's personal data beyond names and roles needed to identify content owners. Public portals must not be used for content unrelated to your engineering standards and documentation.

6. Enforcement

If we reasonably believe this policy has been breached, we may remove or disable the content concerned, revoke credentials, or suspend Users, Agents or the Organization under section 10.2 of the Terms. We will tell the Organization owner what happened and why, unless the law or a security reason prevents it, and restore access once the issue is resolved. Report abuse to abuse@devquay.com.