Acceptable use policy

This policy is part of the Terms of Service. It applies to everything sent through the gateway on your keys, whether you sent it or one of your users did.

Two rules sit above the list. First, the provider behind each model has its own usage policy, and it applies to your request as well as ours — routing through Webway does not exempt anything. Second, the law where you are, where we are, and where the model is served all apply; see Legal and export restrictions.

Prohibited content and conduct

Do not use the gateway to generate, solicit, store or distribute:

• Child sexual abuse material, or any sexual content involving minors. We report this to the relevant authorities and close the account, without notice.
• Content that sexualises a real person without their consent, including intimate imagery and synthetic likenesses.
• Material that incites or facilitates violence, terrorism, or serious harm to people or animals.
• Instructions for weapons capable of mass casualties — chemical, biological, radiological, nuclear or high-yield explosive.
• Malware, exploits or intrusion tooling aimed at systems you are not authorised to test, and anything designed to evade security controls.
• Fraud and deception at scale: phishing, scam scripts, fake reviews, impersonation of a real person or organisation, forged documents or records, academic or credential fraud.
• Unsolicited bulk messaging, and content generated to manipulate a search index, a recommendation system or a vote.
• Targeted harassment, hate speech directed at people for who they are, or content whose purpose is to degrade a person or group.
• Unlawful surveillance or profiling — including facial recognition or biometric inference on people who have not consented, and social scoring.
• Advice that a licensed professional owes a duty of care for — medical, legal or financial — presented to an end user as if a professional gave it, without a human in the loop and without saying it is generated.

High-risk uses

Some uses are not forbidden but require you to keep a person accountable in the loop, because a wrong answer costs someone something they cannot get back: medical, legal or financial decisions; employment, housing, credit or insurance decisions; criminal justice; safety-critical control systems. If you are building one of these, say so when you write to us and we will tell you plainly whether the gateway is a sensible part of it.

Technical conduct

• Do not abuse the endpoint. No attempts to exhaust capacity, to circumvent rate limits or spend limits, or to probe other tenants' data.
• Do not resell raw gateway access as your own gateway. Building a product on top of it is exactly what it is for; reselling the endpoint itself is not.
• Do not misrepresent your identity to a provider, or route through us to get around a suspension a provider applied to you.
• Keep your keys secret, and revoke a key you no longer trust. A key you publish is a key someone else will spend.
• Do not attempt to identify or extract other customers' prompts, responses or keys, or to interfere with the isolation between workspaces.

Your own users

If you put the gateway behind a product of your own, you are responsible for what your users do with it. Have terms with them at least as strict as these, and a way to cut off a user who breaks them.

How we enforce this

We do not read prompts looking for violations. What we act on is what reaches us: a report, a provider's complaint, a legal demand, or an abuse signal from our own metering — a spend pattern that looks like a compromised key, for example.

Depending on what we find, we may ask you about it, throttle or block a particular kind of request, suspend a key, or close the account under the Terms. Serious cases — the first bullet above especially — are actioned immediately and reported.

Reporting abuse

Write to [email protected] with what you saw, where you saw it, and any request id you have. Reports about content involving minors are looked at first, ahead of everything else in the queue.