Acceptable Use Policy

Last updated: October 8, 2026

Scope and your agreement

This policy sets the rules for using Scannit's compute Services: the Servers we provide under an Order, their network connectivity and IP addresses, and our support. Our Terms of Service cover the scannit.io website.

"You" means our customer and "we" means Scannit Inc. Every rule applies to you and to anyone you make the Services available to, directly or through resellers ("your customers"). You are responsible for making sure your customers follow it.

This page is a plain-English summary. Your signed agreement and your Order bind you, and they control if they differ from this page. Sections 1 to 12 follow the numbering of the acceptable use exhibit in our standard customer agreement. An exception applies only if your Order states it or, where a rule allows, we consent in writing.

1. Lawful use

Use the Services only in compliance with applicable law.

2. Export controls, sanctions and weapons

Do not use the Services, or make them available:

• to or for anyone on a US or other applicable restricted party list, such as the OFAC SDN List, or anyone owned 50% or more by, controlled by or acting for such a person;
• in or from a comprehensively sanctioned country or region, or to or for its government or anyone located, ordinarily resident or organized there;
• for an end use or end user prohibited under Part 744 of the Export Administration Regulations, or against an end-use or end-user restriction in hardware supplier certifications we have given you in writing; or
• in any other way that needs an export, sanctions or trade authorization you do not have.

Screen your customers against those lists with commercially reasonable procedures, before they get access and regularly after that. Where a reseller contracts with your customer, you may have that reseller do the screening, but you stay responsible for it. For Tier 2 and Tier 3 customers, also run know-your-customer checks and keep the records.

Do not build, train, fine-tune or run a model or system meant to give anyone meaningful help with chemical, biological, radiological or nuclear weapons, or one you know will give that help, whether or not a license is needed.

3. Access tiers for your customers

Your Order sets how much access your customers get. If it names no tier, Tier 1 applies.

• Tier 1, managed services. Your customers use only your products, such as inference, APIs or hosting, with no operating system or hardware access.
• Tier 2, containers and virtual machines. Your customers may run containers or virtual machines on your platform, with no access to the host operating system or hypervisor.
• Tier 3, direct access. Customers of yours that we approve may get operating system access, including root, to a dedicated Server.

In every tier, your customers have no access to a Server's baseboard management controller (BMC), IPMI interface, firmware, BIOS, VBIOS, attestation functions or management network. Use only the BMC functions we enable for you, and do not share them. We may restrict the operating system's interfaces to the BMC and lock firmware settings.

4. Hardware and firmware

Without our prior written consent, do not:

• modify, flash or downgrade any firmware, BIOS, VBIOS or BMC firmware or configuration;
• physically alter the hardware;
• interfere with or get around our monitoring or attestation;
• install anything designed to survive reprovisioning, or interfere with our reprovisioning or wiping; or
• leave behind, when your access ends, any drive password, encryption lock, boot entry or other setting that blocks our reprovisioning or wiping.

Each Server has a baseline: the firmware versions and configuration recorded in the test logs we send you when the Server is ready for service, as later changed by us or with our written consent. We may check a Server against its baseline at any time and restore it. If that needs a reboot, we tell you first, except in an emergency. If we restore it because of a breach of this section, the downtime does not count against our service levels.

Changing GPU settings that your driver offers, such as GPU partitioning or ECC mode, and installing an operating system your Order lists or we approve, are not by themselves a breach and do not change the baseline. Any change made from your environment, including by your customers or by software running there, counts as your act.

5. Security and network abuse

Do not use, or try to use, the Services to:

• access, probe, scan or test the vulnerability of any system or network without authorization, or break any security or authentication measure;
• use someone else's account or credentials, or monitor or intercept data or traffic, without authorization;
• launch denial-of-service attacks or otherwise interfere with any network, service or user;
• forge packet, email or posting headers, routing information or MAC addresses, or send traffic beyond your Servers from IP addresses not assigned to you or allowed by your Order;
• run an open mail relay, open proxy, open DNS resolver or other service that others can misuse to send messages, amplify traffic or hide its origin;
• break another network's or forum's published rules, or flood or disrupt it;
• get around any way of measuring or billing for services; or
• carry out unlawful or abusive activity likely to get us, our providers or other users of the facility network attacked, blocklisted or cut off.

Your virtual machines' own MAC addresses, and private addresses for traffic between your Servers, are not forging. Being attacked, or using the bandwidth in your Order, does not by itself break the last rule.

Testing. You may test the systems you control, and test from your Servers any system you own or have written permission to test, keeping malware samples for that work as long as you never distribute them. Get our written consent before testing our systems or any Server's BMC or firmware, and before any large-scale scan or high-volume traffic test against systems other than your Servers. Never test the facility network, our providers' systems or other users' systems without their operator's written authorization and our consent.

Patching. Keep the operating systems and software that you or your customers control secure and up to date, with commercially reasonable efforts. If we or the data center provider tell you that a patch, update or configuration change is critical, apply it within 30 days after our notice. Our notice may set an earlier date where the data center provider requires it or a security risk makes it necessary, and then that date applies.

Compromises and earlier data. Tell us within 24 hours after you learn that a Server is compromised or is being used to attack others. Do not try to recover data that a previous user left on a Server. If you find any, stop and tell us.

6. Content

Do not use the Services to store, process, generate or distribute any of the following, including as model output:

• child sexual abuse material, in any form, including material made or altered with AI;
• non-consensual intimate imagery of a real person, including sexual deepfakes;
• other sexually explicit material, including obscene and pornographic material, even where it is legal;
• malware, except samples kept for testing under Section 5;
• spam, meaning unsolicited commercial or bulk email or other messages; or
• content that infringes intellectual property rights or otherwise breaks the law.

Generating child sexual abuse material or non-consensual intimate imagery is a breach even if it is never stored or delivered. Detecting, blocking, removing and reporting such material that others send to your service, and keeping it where the law requires, is not. Do not use another provider to send spam that promotes anything hosted on the Services.

Generative models. Do not offer or run a model or service that is designed, fine-tuned, configured or marketed to produce any of the material in the first three items above. If you offer a generative service to others, keep reasonable safeguards against that material in place, such as usage terms that forbid it, output filtering and action on reports. Explicit prompts or uploads that your service refuses, filters or promptly removes are not a breach, and neither is other sexually explicit output that your safeguards block before anyone receives it. That output exception never covers child sexual abuse material or non-consensual intimate imagery.

Fraud, harassment and violence. Do not commit or help commit fraud, including phishing and scams. Do not publish or distribute deceptive, defamatory, threatening, harassing or abusive material, or material that incites violence or promotes terrorism or violent extremism. A model's output is not by itself a breach of this rule, unless the model was designed, fine-tuned, configured or marketed to produce such material. You may keep unpublished samples to detect, filter or moderate it, or for research.

7. Abuse handling

We may forward abuse complaints about the Services to the security and abuse contact in your Order. Handle each one within 24 hours, or within 2 hours for an active attack, by investigating it, stopping any abuse and telling us what you did. If you do not, we may block the affected IP address or port until the abuse stops.

We may comply with lawful process, such as subpoenas and court orders, and make any report the law requires. We tell you about such process where the law allows.

We treat copyright infringement notices as abuse complaints. Adopt and apply a policy of ending, in appropriate circumstances, the access of your customers who repeatedly infringe copyright. Tell your customers about it, and act on our notices as your agreement requires. Our own repeat infringer policy: in appropriate circumstances, we suspend the Services used by anyone who repeatedly infringes copyright.

8. IP addresses

IP addresses we provide are held by us or by the third party that supplies them, and you may use them only under your Order.

• Do not announce, route, transfer or use them outside the facility network, including through a third-party DDoS mitigation or DNS service, without our written consent. Pointing your DNS records at them is fine.
• We may change them when we move your Services or replace a Server, and otherwise on 30 days' notice, or less if their supplier requires it.
• Stop using them when your Order ends, or when any later period for retrieving your data ends.
• Use other IP space only where your Order allows it, with the authorizations your agreement requires. You are responsible for all use of it.

9. Blockchain rewards and Server control

Unless your Order expressly allows it, do not use the Services to earn cryptocurrency, tokens or other blockchain-based rewards that a protocol or network issues or pays for supplying computation, storage, bandwidth or validation. This covers proof-of-work mining, proof-of-space or proof-of-time plotting and farming, running a validator, and acting as a miner or validator on a decentralized compute or AI network. It does not restrict:

• developing, testing or researching blockchain software;
• running read-only, archive or RPC nodes that earn no rewards;
• AI training or inference, including decentralized training, that earns no token rewards; or
• accepting payment from your customers in any currency or digital asset.

An Order that allows token rewards relaxes no other rule, and an Order that allows marketplace listing does not by itself allow token rewards.

Without our prior written consent, do not install anything that replaces the operating system we provide or approve, or that takes control of a Server, its boot process or its attestation.

Unless your Order says otherwise, listing Server capacity on a public compute marketplace or network counts as Tier 2 use, and anyone who rents it there is your customer under this policy.

10. Power and facility

Keep your workloads within the power limit in your Order, and do not remove or get around any GPU or Server power limit we set. If a limit can only be set from the operating system, reapply it after every reboot or reinstall.

Follow the rules of your facility's data center provider and of each network provider serving it, including their acceptable use policies. They are attached to your Order and can change (Section 16). They may ban things this policy does not, including legal material such as hateful, excessively violent or indecent content. Your Tier 2 and Tier 3 customers, and anyone entering the facility for you or them, must follow them too, and you must pass the rules on before they get access, as your agreement sets out. Use by your Tier 1 customers through your products counts as your own use. If we move your Services to another facility under your agreement, that facility's rules replace them for your Order once we tell you.

Unless your Order grants physical access, neither you nor your customers may enter the facility. Any visit we arrange is escorted.

11. Software, model and dataset licenses

You are responsible for licensing, and for following the license terms and use policies of, all software, models (including model weights) and datasets that you or your customers install, run or use on the Servers. This includes GPU driver and software licenses and operating system licenses.

12. Cooperation and suspension

Answer our reasonable requests for compliance information, including about your customers and their use cases, within the time your agreement sets. Tell us promptly about any breach of this policy, including by your customers. Send breach and compromise notices, and requests for our consent, to security@scannit.io.

If any use of the Services breaches this policy, we may suspend the affected Services until the breach is fixed. If one of your customers caused it, we suspend only the affected workload, Server or IP address where practicable, and you must remove or suspend that customer within 48 hours after our notice.

13. Reporting abuse and security issues

Anyone can report, customer or not. Send reports of abuse coming from Servers or IP addresses we provide, and of security vulnerabilities in our systems, to security@scannit.io.

Where you have them, include source and destination IP addresses, ports and protocol, times with time zone, logs and URLs, and full headers for email abuse.

Never attach child sexual abuse material. Send only URLs or IP addresses, and also report it to the National Center for Missing & Exploited Children through its CyberTipline.

We may forward your report to the customer responsible for the Server or IP address. If you ask us not to share your contact details, we will not, unless the law or a legal order requires it.

14. Copyright notices

Our designated agent for notices of claimed copyright infringement under the Digital Millennium Copyright Act (17 U.S.C. 512) is:
Copyright Agent, Scannit Inc.
220 26th St NW, Atlanta, GA 30309, USA
Phone: +1 404-585-0772
Email: security@scannit.io

Send notices of claimed copyright infringement involving the Services to security@scannit.io, with "Copyright notice" in the subject line. Include:

• your physical or electronic signature;
• the copyrighted work you say is infringed;
• the material you say infringes, and where we can find it;
• your address, phone number and email address;
• a statement that you believe in good faith that the use is not authorized by the copyright owner, its agent or the law; and
• a statement that the information in your notice is accurate and, under penalty of perjury, that you are the owner or are authorized to act for the owner.

We forward complete notices to the customer responsible and handle them as abuse complaints under Section 7.

15. What we can see and how we respond

We do not access the content on your Servers in the ordinary course, and we have no duty to monitor it. We keep out-of-band management (BMC) access, including remote console and power control, to operate, repair, test and reprovision the Servers. We may collect operational data, such as hardware health, power, usage and attestation data, which does not include your content. Depending on the Server, data center staff and others involved in supplying, operating or auditing it may have physical or management access to it. We preserve or disclose content where the law or a legal order requires it.

Besides suspending for a breach of this policy, your agreement lets us suspend Services whose use creates a security risk or threatens harm, or where the law, a government order or the data center provider requires it. Where practicable we tell you before we suspend, and otherwise promptly after. For ongoing harm or a serious threat, such as an active attack, a compromised Server, outbound spam or child sexual abuse material, we may act first.

Where practicable we use the narrowest step that works, such as blocking a port, null-routing one IP address or isolating one Server, and we restore service promptly once the cause is resolved. If a Server is attacked, we may null-route the targeted address. Our providers may act more broadly without notice to us, such as blocking address ranges, and we cannot reverse steps they take on their own.

16. Changes to this policy

We may update this policy and the acceptable use terms in our standard agreement. We give customers advance notice of material changes as their agreement sets out, and we post each version here with its date. An update will not materially reduce the Services, or materially increase your obligations, under an Order in effect, unless the law or the data center provider requires it or a security risk makes it necessary. Those updates may come with shorter notice.

Version history

October 8, 2026. First published version.