Acceptable use policy

1. Purpose and scope

Kandaro is a security platform. Its decoys, fake credentials and response actions are built to protect your organisation, and used in the wrong place they can harm others. This policy sets out what you may and may not do with Kandaro Deception, Kandaro SOC, Advisories, the Kandaro Console and the API (together, the Service).

This policy forms part of our Terms of service. Words defined there have the same meaning here. It applies to the organisation that holds the Kandaro account (“you”) and to everyone you allow to use the Service, including employees, contractors and managed service providers. You are responsible for their use as if it were your own.

2. Authorised deployment

• Only deploy Sensors, decoys and fake credentials, and only connect tools to Kandaro SOC, on networks, systems, cloud accounts, domains and identities that you own or that you are authorised in writing to monitor and protect.
• If you are a managed service provider, you must hold your client’s written authorisation before you deploy Kandaro in its environment or connect its tools, and it must cover the products and response actions you use. You must be able to show it to us on request.
• An internet-facing decoy is allowed only on an address, domain or cloud resource you control. It may record whoever connects to it, but you must not advertise it, link to it or otherwise draw people to it (see section 5).
• When your authorisation ends, for example when a client contract ends, you must remove the Sensors and decoys and disconnect the tools without delay.

3. Lawful monitoring

Decoys record the activity of whoever touches them, and Kandaro SOC reads alerts that can relate to identifiable people. You decide where and why that monitoring happens, so you are responsible for making it lawful. In particular, you must:

• have a valid legal basis under the GDPR for the monitoring and for sending the data to us;
• inform employees and other users of your systems about the monitoring, as the GDPR’s transparency rules require, for example in your privacy notice or IT policy;
• obtain the consent of your works council where the law requires it, such as under article 27 of the Dutch Works Councils Act (Wet op de ondernemingsraden) for systems that can monitor staff, or the equivalent rules in other countries;
• carry out a data protection impact assessment where one is required.

Decoys exist to detect intruders. You must not design or place them to trap a particular person, such as a specific employee, unless that is part of an investigation that you are lawfully entitled to carry out and that you have properly authorised and documented.

4. Response actions

Kandaro SOC can isolate a device, disable a user, block an address or take similar steps in your own tools. It does so only if you have signed the SOC Terms, and only after an Admin in your organisation approves the action, apart from the optional rule that blocks an outside address that touched a decoy, which runs only if an Admin switches it on.

• Only approve, or switch on, actions that you are entitled to take on the system concerned.
• We recommend that a second person checks each action before it is approved (“four-eyes” approval), especially for actions that affect many users or critical systems.
• You are responsible for the business impact of the actions you approve or automate, such as a user losing access or a device going offline.
• Response actions may only act on your own systems and accounts. You must not use them against systems that belong to third parties.

5. What is not allowed

You must not use the Service, or help anyone else use it, to:

• attack, scan, probe or test the systems of any third party;
• use decoys or fake data to entrap, defraud or mislead anyone, or to collect information for any purpose other than protecting your own environment;
• lure people into your network from outside it, or strike back at them (“hack back”), for example by publishing fake credentials or by attacking the source of an attack;
• place decoys or Sensors on infrastructure that belongs to a third party;
• host, store or distribute malware, other than samples captured by the Service itself;
• store or share content that is illegal, or that infringes the rights of others;
• use credentials of real people that a decoy captured for anything beyond what is necessary to investigate the incident and protect the accounts concerned; in particular, never use them to sign in to someone else’s account;
• resell, sublicense or provide the Service to others without our written agreement;
• reverse engineer, copy or analyse the Service to build or benchmark a competing product, or publish benchmarks for a competitor;
• overload the Service, or send traffic or data in volumes that go beyond normal use;
• bypass usage limits, access controls or any other security measure of the Service;
• test the security of Kandaro itself, other than under our vulnerability disclosure policy.

6. Data you send us

Send Kandaro only the data that is necessary to detect, investigate and respond to threats. Do not deliberately send special categories of personal data, such as health data, or data about criminal offences, as set out in the data processing agreement. Captured passwords are masked automatically when they are received. Where the Service lets you limit what else is collected, use those settings. How we handle personal data is set out in our Privacy policy.

7. AI features

Kandaro uses AI to explain incidents, triage alerts and suggest next steps. AI can be wrong. Do not rely on it as your only security control, and check its conclusions before you take decisions that matter. You must not try to manipulate Kandaro’s AI, for example with prompt injection or by feeding it crafted data, other than under our vulnerability disclosure policy.

8. Reporting abuse

If you believe someone is using Kandaro in breach of this policy, tell us through the contact form with what you saw, when and where. Report a vulnerability in Kandaro itself as a security report instead.

9. How we investigate

We look into every credible report and any signs of misuse we detect ourselves. We may ask you for information, such as proof of authorisation for a network you monitor, and you must cooperate within a reasonable time. We only look at your data where that is necessary for the investigation, and we keep what we learn confidential except where the law requires otherwise.

10. Consequences

If you breach this policy, we may, depending on how serious the breach is, take one or more of these steps:

• give you a warning and ask you to stop or correct the breach;
• switch off a specific decoy, Sensor, integration or response rule;
• suspend your account or the Users concerned, in whole or in part;
• end the Agreement under section 10 of the Terms of service;
• report the matter to the police or other competent authorities.

Where possible we warn you first and give you time to fix the problem. We may act immediately where there is a risk of harm to others, to the Service or to Kandaro, or where the law requires it. You remain responsible for any damage caused by the breach.

11. Changes to this policy

We may update this policy, for example when we add products or when the law changes. We will tell your Admins about material changes by email or in the Console at least 30 days before they take effect, unless a change is needed sooner for legal or security reasons. The date at the top of this page shows when the current version took effect.

12. Contact

Questions about this policy go through the contact form. For security issues in Kandaro, use the security report topic.