Acceptable use policy

This policy says what you may not do with Porticol. It applies to Porticol Cloud, to the web client, to a Team Server we operate, and to the desktop application while it is signed in. A Team Server you operate yourself is covered by your own policy; we still require our customers to meet this one for installations we host for them.

Using Porticol means accepting this policy. It takes effect on 21 Oct 2026.

1. You must be old enough

You must be at least 16 years old to create an account. If you are below that age, do not create one, and tell us if one has been created for you.

2. Use the service lawfully

You must comply with the law that applies to you, including the law of the place you are in, the law on privacy and data protection, and any export or sanctions law that reaches you. You must have the authority to bind the organisation you sign up for.

You must not use Porticol to store or transmit content that is unlawful, that infringes someone else's rights, or that you have no right to use. You must not put special-category or criminal-offence data into a collection, an environment or a variable.

You must accept the terms of the APIs you call. Porticol is a tool; it does not make an unauthorised request authorised.

3. What you must not do

You must not:

• attack, probe, scan or attempt to gain unauthorised access to any system, or use Porticol to exploit a vulnerability you found beyond what the system's owner has authorised in writing;
• send malware, ransomware, or anything designed to damage, disable or overload a system or a person;
• send bulk unsolicited email, phishing, or spam through a monitor or a run;
• impersonate anyone, forge authorship, or misrepresent who a request comes from;
• interfere with the service, including by circumventing rate limits, plan limits, entitlement checks, the egress guard or any other technical control;
• probe or test the service's own limits, availability or security beyond what the safe harbour in our vulnerability disclosure policy allows, or publish findings about the service before that policy lets you;
• reverse engineer, decompile or disassemble the desktop application or the Team Server, except where that is permitted by law and cannot be waived, or where you have our written permission;
• copy, sublicense, sublet or resell the service or a licence;
• hold an account on behalf of anyone else, or share one set of credentials between people;
• use the service to build or train a competing product from our code or our non-public information.

4. Requests our servers send

Requests you send from the desktop application leave from your machine. Porticol's servers do not proxy them.

Two features are different, and both are yours to use lawfully:

• Scheduled monitors. A monitor runs from one of our servers on a schedule, so that it keeps running while your machine is off. The request runs behind an egress guard that refuses loopback, private and link-local addresses and cloud metadata addresses, and inside a per-organisation script sandbox that cannot reach the file system or the network beyond what the monitor itself sends.
• Server-side sending on a Team Server. An administrator of a self-hosted server can enable sending from the server itself, where a browser would be blocked by CORS. It is subject to the same guard and to the server's own allowlist and rate limits.

In both cases you must have the right to send the request to its destination, you must keep the frequency within what the destination tolerates, and you must not use the feature to reach a system you are not authorised to reach. Monitors also run within your plan's monthly monitor runs and the alert limits the monitor settings show; we set no other condition on them.

5. Reporting abuse or infringement

Tell us about abuse of the service, about content that infringes a right, or about a system you think our servers could be used to attack, at abuse@porticol.app. Enforcement requests, including a rights-holder notice, go to legal@porticol.app with enough detail to identify the material.

We have no registered copyright agent; a notice of infringement goes to legal@porticol.app. Security research on Porticol itself is covered by the safe harbour in our vulnerability disclosure policy, not by this section.

We may restrict or remove material that breaches this policy, and we may act on a complaint from a rights holder.

6. What we do about a breach

We may warn you and ask you to stop. We may suspend the parts of the account involved without a warning where the law or an emergency requires it, including where the account appears to be attacking another system, distributing malware, or sending bulk unwanted traffic. We will tell you as soon as it is safe to.

Where the breach can be fixed, we give you 30 days to fix it after we tell you about it. We may terminate an account that breaches this policy and does not fix it in that time, or that repeats the breach after a warning, by written notice.

Where we suspend or terminate, you can export your data for 30 days where we can allow it, and we do not delete your data earlier than the schedule in the privacy policy requires.

Suspending an account does not remove a person's right to personal data they asked for, and does not excuse us from obligations that do not depend on the account.

7. No limit on liability

Nothing in this policy limits your responsibility for what you do with Porticol, or ours for what we do about it, under the terms of service.