ACCEPTABLE USE POLICY
What Brutus may not be pointed at, and what happens if it is.
Last updated November 5, 2026
Brutus does real work inside real systems. This policy is the short list of what it may not be pointed at. It applies to everyone in your workspace, and to anything your people ask Brutus to do on their behalf.
Do not use Brutus to
- Break the law, or help someone else break it.
- Access a system you are not authorised to access, or hand Brutus credentials that are not yours to give.
- Build or improve malware, ransomware, exploits, phishing pages, or tooling whose purpose is to breach someone else’s systems.
- Generate or distribute content that sexualises children, incites violence, or harasses, defames or threatens a real person.
- Impersonate a real person or organization, or produce fabricated records, receipts, reviews or credentials meant to pass as genuine.
- Send bulk unsolicited email, or run outbound campaigns that ignore the recipient’s right to unsubscribe.
- Make automated decisions about people with legal or similarly significant effects, such as hiring, firing, credit, housing, insurance or benefits, without a person reviewing the decision.
- Process special-category data, such as health records, biometric identifiers or government ID numbers, unless we have agreed to it in writing and the controls are in place for it.
- Probe, load-test or reverse-engineer the service, or resell access to it, without our written agreement.
Keep a person in the loop
Brutus is built so that this is the default rather than a discipline: anything outbound waits for a person to release it, anything past your organization’s autonomy setting waits under Needs you, and every action lands on a record someone can read. Do not engineer around those controls, and do not raise the setting to Critical on an account that touches customer-facing systems because it is faster. The machinery is described here.
Model providers have their own rules
Work is routed to the model providers listed in Subprocessors, and their usage policies apply to what passes through them. Where their rules are stricter than ours, theirs govern that step of the work.
If this is broken
Tell us at hello@tengerways.com if you see it happening, including from our side. Where we find a breach, our first step is to contact your administrator and give you a chance to fix it. We will suspend a workspace without that step only where the use is causing immediate harm, is plainly criminal, or puts other customers at risk. Suspension is narrow and temporary wherever it can be: we would rather close one channel than lock out a team.
Questions
Write to hello@tengerways.com and a person will answer. If a term here conflicts with a signed agreement between us, the signed agreement wins.
READ THE NO CREEPY PROMISE.
The same commitments, written the way we actually talk about them.