Acceptable Use Policy (AUP)

1. Purpose and Enforceability

This Acceptable Use Policy ("AUP") defines the prohibited or regulated uses of the Arkane Cloud services. It forms an integral part of the Agreement entered into with the Customer and is binding on the Customer, on its Authorized Users and, where the Customer allows third parties to access the Services, on such third parties under the Customer's responsibility.

The Customer remains responsible for the acts and omissions of its Authorized Users and of the third parties to which it grants access to the Services, to the extent provided for in the Agreement.

The AUP does not create any general obligation to monitor the Customer's content or activities and does not deprive the Customer of its rights under the GTS, the SLA, the DPA or applicable mandatory provisions.

Capitalized terms have the meaning defined in the GTS.

2. General Principle

The Customer uses the services lawfully, fairly and in accordance with their intended purpose, without infringing the rights of third parties or undermining the security or integrity of the Arkane Cloud platforms, of other customers or of any third-party network.

It implements reasonable measures to control access, to secure its credentials and to monitor the uses made by means of its Account. The absence of a prior response from Arkane Cloud to a question from the Customer constitutes neither approval of the contemplated use nor a transfer of responsibility. In the event of serious doubt as to the lawfulness or security of a use, the Customer seeks the opinion of Arkane Cloud before implementing it.

The Customer limits access to the Services to Authorized Users, protects its credentials, API Keys, tokens and secrets, activates the available security mechanisms and immediately informs Arkane Cloud of any compromise or unauthorized use. The Customer does not share an individual credential and does not circumvent authentication or access control mechanisms.

The Customer verifies that its use of the Services complies with the laws applicable to its sector, in particular the rules relating to data protection, intellectual property, export control, economic sanctions, product safety and regulated activities. It does not present the Services as suitable for medical, financial, critical industrial, public safety or other high-risk use without having put in place the appropriate controls, human validations and continuity measures.

3. Prohibited Content

It is prohibited to store, publish, transmit or disseminate by means of the services any content:

• that constitutes child sexual abuse material or involves the sexual exploitation of minors, in any form whatsoever, including where it is generated, transformed or amplified by an artificial intelligence system;
• that incites the commission of acts of terrorism or glorifies them, or that incites hatred, violence or discrimination;
• that infringes the intellectual property rights or trade secrets of third parties, in particular by making available software, works, trademarks, databases or models without holding the necessary rights;
• that constitutes unlawfully obtained data, in particular stolen databases, compromised credentials or personal data collected without a legal basis, or information subject to a confidentiality obligation that the Customer is not legally entitled to use;
• that infringes the privacy, image rights or reputation of a third party, in particular through the dissemination of non-consensual intimate content or through the impersonation of a person;
• more generally, any content the storage, dissemination or exploitation of which is manifestly unlawful or contractually prohibited under the AUP or the applicable contractual documents.

4. Security Violations

The following are prohibited, unless prior written authorization has been given by Arkane Cloud and, where applicable, by the third party concerned:

• any unauthorized access or attempted unauthorized access to systems, accounts, networks or data;
• vulnerability scanning, port scanning, penetration testing and load testing targeting systems that the Customer does not own or for which it does not hold express authorization;
• the development, hosting or distribution of malicious code (in particular viruses, ransomware, Trojan horses), of command-and-control infrastructures, of botnets or of fraud tools;
• denial of service attacks, unauthorized load testing or participation in such attacks;
• phishing, identity theft, typosquatting, fraud and any fraudulent scheme intended to unlawfully obtain credentials, funds, data or advantages;
• the circumvention or neutralization of the authentication, quota, consumption metering, rate limiting or security mechanisms of the Services, as well as the use of credentials, API Keys or access tokens obtained or used without authorization.

Penetration tests, scans and load tests carried out by the Customer on its own resources hosted with Arkane Cloud may be authorized subject to prior notification, the definition of the scope, of the IP addresses or resources concerned and of the time slots, and of the measures intended to avoid any impact on other customers or on the shared infrastructure. In the absence of validation or in the event of a risk to the platform, Arkane Cloud may request the suspension or adjustment of the test.

5. Network and Messaging Abuse

• sending unsolicited bulk email (spam) or email in breach of the applicable rules on business prospecting;
• falsification of headers, sender addresses or routing announcements (spoofing, BGP hijacking);
• exploitation of open relays (open relay, open proxy, unsecured open DNS resolvers);
• collection of addresses or contact data without consent for the purpose of unlawful prospecting.

6. Use of Shared Resources

On shared platforms, the Customer refrains from any use likely to abnormally degrade performance or availability for other customers, to abusively exhaust shared resources or to circumvent the fair allocation mechanisms described in the Documentation.

Crypto-asset mining, transaction validation or any similar activity using GPU or CPU resources as its primary purpose are prohibited, unless Arkane Cloud has given prior written consent specifying the Services, volumes, periods and pricing conditions concerned.

GPU Compute and Computing Environments

The Customer uses GPU and CPU resources in compliance with the capacity, duration and throughput limits applicable to the Service. It does not launch concealed, persistent or unauthorized workloads intended to circumvent a reservation, a quota, a consumption limit or a security measure. It does not leave a workload running after the end of the subscribed period or after a suspension request from Arkane Cloud.

Inference API and Serverless

The Customer protects its API Keys, complies with rate limits, quotas and authentication mechanisms, and does not make an API or an Arkane Cloud access available on an unsecured public endpoint. It does not engage in systematic scraping, automated generation of artificial traffic, tests intended to saturate the Service, or the unauthorized extraction, reconstruction or making available of a model or its parameters.

Storage and Public Exposure

The Customer configures access controls, sharing policies and storage permissions so as to avoid any unnecessary public exposure or anonymous access. It does not turn an Arkane Cloud storage space into a public content-sharing service, file repository or distribution relay without prior written consent. Ephemeral storage or temporary volumes must not be used as the sole copy of archives or of data whose retention is critical.

Backups and Retention

Unless expressly provided otherwise in the SLA or the applicable Documentation, the Services constitute neither a backup service, nor an archiving service, nor a disaster recovery solution for the Customer Content, the Outputs, the configurations or the other digital assets of the Customer.

Any replication, redundancy or backup mechanisms that Arkane Cloud may implement for the purposes of the provision, security or continuity of the Services do not constitute a commitment to retain or restore the Customer's items beyond the obligations expressly provided for in the Agreement.

The Customer remains responsible for putting in place and maintaining its own backups, for regularly verifying their integrity and for ensuring that they can be restored.

7. Specific Rules for Artificial Intelligence Services

In addition to the general prohibitions above, it is prohibited to use the Arkane Cloud inference services or computing capacity to:

• implement practices prohibited by Article 5 of Regulation (EU) 2024/1689 (the "AI Act"), to the extent that this regulation applies to the use case concerned, in particular subliminal or deceptive manipulation practices causing significant harm, the exploitation of the vulnerabilities of persons, generalized social scoring, or real-time remote biometric identification in public spaces outside the exceptions provided for by law;
• generate, transform or disseminate, or facilitate the dissemination of, child sexual abuse material, non-consensual sexual deepfakes, or identity impersonation content intended to deceive;
• conduct coordinated manipulation, disinformation or interference operations;
• design, develop or improve chemical, biological, radiological or nuclear weapons, or offensive cyberweapons primarily intended to compromise third-party systems;
• circumvent, disable or abusively test the safety features, filters or guardrails of the models made available, or help third parties to do so;
• remove, falsify or circumvent the origin, provenance or identification information of generated content where its preservation or disclosure is required by applicable law or by the Documentation of the Service.

The Customer remains responsible for the regulatory classification of its own AI systems, its use cases, its instructions and its Outputs, as well as for compliance with the obligations incumbent upon it, in particular with regard to transparency, information, documentation, risk assessment, human oversight and the rights of individuals. Arkane Cloud does not warrant that a Service, a model or an Output is lawful or suitable for a specific use case.

The Customer complies with the terms of use, restrictions and licenses applicable to the third-party models, software, datasets and components used with the Services. It must not use a model, an API, a weight, a dataset or an Output in a manner that would breach its license, an applicable security measure or the rights of third parties.

8. Resale and Use on Behalf of Third Parties

The Customer may integrate the services into its own offerings, provided that it: (i) remains Arkane Cloud's sole point of contact and the party responsible for the use made of the services by means of its Account; (ii) contractually imposes on its end users obligations at least equivalent to this AUP and holds the necessary rights over the content, data, models and requests; (iii) does not present Arkane Cloud as a provider of its offering, nor as a guarantor of the lawfulness, accuracy or compliance of the Outputs; and (iv) cooperates with Arkane Cloud to prevent, handle and bring to an end any prohibited use.

9. Abuse Reporting

Any suspected abuse involving the Arkane Cloud services may be reported to the following address: [email protected]

The report must, to the extent possible, identify the notifying party, precisely describe the content or use concerned, indicate its location or the available technical identifiers, specify the grounds for the report and provide any information useful for its review. Reports may be made in French or in English.

Arkane Cloud acknowledges receipt of reports where it has the necessary contact details, examines them diligently and, where appropriate, takes measures that are proportionate having regard to the seriousness, the urgency, the quality of the information available and the risk to the Services and to third parties.

The procedures applicable to manifestly unlawful content are implemented in accordance with the French Law on Confidence in the Digital Economy (LCEN) (Law No. 2004-575 of June 21, 2004) and with Regulation (EU) 2022/2065 (the Digital Services Act), to the extent that they apply to it in its capacity as a hosting provider.

Where Arkane Cloud takes a measure affecting the Customer, the Customer may request a reasoned review by providing any useful information. Arkane Cloud reviews the measure within a reasonable period, without such request automatically suspending the measure where a serious risk, a legal obligation or an order from an authority so justifies. Measures taken as a result of an error by Arkane Cloud are lifted or corrected without undue delay.

Arkane Cloud does not carry out general monitoring of the Customer's content, uses or activities. It may, however, implement proportionate technical controls, in particular for security, billing, abuse prevention, quota enforcement and compliance with a legal obligation.

Where Arkane Cloud takes a measure affecting content, an Account or a Service on the basis of a report or of an alleged violation of the AUP, it provides the Customer, where possible and lawful, with the essential grounds for the measure, its scope, its foreseeable duration and the procedures for challenging it or requesting a review. This obligation does not apply where a competent authority, a legal obligation or a security imperative prohibits disclosure or requires immediate action.

10. Measures in the Event of a Violation

In the event of an established or reasonably suspected violation of this AUP, Arkane Cloud may, in a manner proportionate to the seriousness and urgency, take in particular the following measures:

• issue a warning, request additional information or serve formal notice on the Customer to cease the breach within a specified period;
• suspend, restrict or isolate access solely to the resources, accounts, API Keys, projects or content concerned;
• suspend all or part of the Account or of the Services in the event of a serious, repeated or uncorrected breach, after formal notice where circumstances permit;
• terminate the Agreement under the conditions of the General Terms of Service;
• remove, disable or make inaccessible any content or resource where the law, an order from a competent authority, a violation of the AUP or a serious security risk so justifies;
• retain evidence for the period necessary for security, for the defense of its rights and for compliance with its legal obligations, and cooperate with the competent authorities in compliance with applicable law, including by communicating information whose disclosure is legally required.

Emergency measures justified by an imminent risk (security, manifestly unlawful content, order from an authority) may be taken without prior notice; the Customer is informed thereof without delay, unless prohibited by law. Periods of suspension resulting from a violation of the AUP give rise neither to a Service Credit nor to a refund.

11. Changes to the Policy

Arkane Cloud may amend this AUP, in particular to take into account legal, regulatory and technical developments, new threats or changes to the Services. Amendments that substantially restrict the authorized uses or increase the Customer's obligations are subject to thirty (30) days' prior notice, unless a security emergency or a legal obligation requires them to take effect more quickly. In the event of a substantial unfavorable amendment, the Customer may terminate the Services concerned without penalty before its effective date, in accordance with the GTS; sums paid in advance for periods after termination are refunded.

12. Cooperation and Investigation

The Customer cooperates in good faith with Arkane Cloud where information is reasonably necessary to analyze an abuse, a security incident, an alleged violation of the AUP or a request from an authority. It retains the information useful for the analysis and does not knowingly destroy relevant traces after notification of an incident or an investigation.

Arkane Cloud may request from the Customer the information strictly necessary to assess the compliance of a use and may temporarily limit access to the resource concerned during such verification where a serious risk so justifies. It limits the collection, use and retention of investigation information to what is necessary and informs the Customer to the extent permitted by law.