Acceptable Use Policy
Last Updated: 12 October 2026
This Acceptable Use Policy governs use of the Helios Core AI services and is incorporated into the Customer Agreement at https://helios-core.com/legal/customer-agreement. Capitalized terms have the meaning given there. Customer is responsible for its Users' compliance with this Policy.
1. PROHIBITED CONTENT AND CONDUCT
Customer will not use the Services to:
(a) violate any law, or facilitate a violation by another;
(b) infringe or misappropriate any intellectual property or privacy right;
(c) transmit malicious code, or any material that is unlawful, defamatory, harassing, or obscene;
(d) send unsolicited commercial communications, or communications that violate telemarketing, text messaging or email marketing law;
(e) impersonate any person or entity, or misrepresent an affiliation;
(f) interfere with or disrupt the Services, or any other customer's use of them; or
(g) gain or attempt to gain unauthorized access to the Services, to another customer's data, or to any system or network.
2. PROTECTION OF THE SERVICES AND THEIR INTELLECTUAL PROPERTY
Because the Services are an AI platform, the following are expressly prohibited in addition to the restrictions in Agreement §3.5:
(a) Prompt and instruction extraction — attempting to cause the Services to disclose their system prompts, model instructions, reasoning scaffolds, guardrail logic or safety instructions, whether by direct request, prompt injection, or any other technique.
(b) Tool and schema harvesting — systematically enumerating, extracting or reconstructing the tool definitions, function schemas, parameter structures, routing logic, classification taxonomies or retrieval configuration of the Services.
(c) Model extraction and training — using outputs of the Services to train, fine-tune, distill or evaluate any machine learning model, other than for Customer's own internal assessment of the Services.
(d) Competitive use — using the Services to build or improve a competing product or service, or conducting competitive benchmarking, model extraction or comparative analysis for the purpose of developing one.
(e) Automated scraping — accessing the Services by automated means outside the documented programmatic interfaces, or exceeding published rate limits.
(f) Security testing without authorization — probing, scanning or testing the vulnerability of the Services, or circumventing any authentication, authorization, verification or rate-limiting control, without Helios's prior written consent.
3. SAFE OPERATION OF THE AGENT
Where the Services perform Agent Actions, Customer will not:
(a) configure the Services to perform an operation Customer is not authorized to perform in the target system;
(b) supply credentials whose privileges materially exceed what the enabled capabilities require;
(c) activate a runbook or workflow that performs Agent Actions against a Connected System without having assessed its effect and blast radius in Customer's environment;
(d) deliberately manipulate the Services — through crafted content in a ticket, email, alert or conversation — to cause them to take an action outside Customer Configuration or on behalf of a person other than the requester; or
(e) use the Services to perform an operation against a system Customer does not own or is not authorized to administer.
4. SENSITIVE DATA
4.1 What Customer will not design the Services to collect
Customer will not configure the Services to request, collect, verify against, or store as a data element, and will not knowingly submit as a data element:
(a) data Customer lacks the right to submit;
(b) protected health information, unless a Business Associate Addendum is in force;
(c) government-issued identification numbers, financial account numbers, or biometric identifiers; or
(d) data of a child under 13, or of a person from whom a required consent has not been obtained.
4.2 Incidental content
The Services accept unstructured content — free text, email and speech — from Users and Callers, and do not filter it by category. Incidental inclusion of information described in Section 4.1 by a User or Caller in free text or speech is not a breach of this Policy by Customer. Helios processes such content as Customer Content under the Agreement. Customer is responsible for instructing its workforce on what to submit, for the consequences of what they submit, and for using the Services' retention controls appropriately.
Helios does not provide identity verification by government identifier, and the Services are not designed to ask for one.
4A. PAYMENT CARD DATA
The Services must not be used to request, capture, process, transmit or store payment card information under any configuration. Customer will not configure the Services to ask any person for a card number, expiry, security code or similar. The Services are not designed or validated for cardholder data, and Helios is not a PCI DSS service provider in respect of them.
Where a Caller volunteers card information in speech or text despite this, Section 4.2 applies and Customer will use the Services' retention controls and, where practical, redaction to limit its retention.
5. ENFORCEMENT
Helios may investigate a suspected violation and may suspend access under Agreement §3.6. Helios will give notice and an opportunity to cure where practicable, and will limit any suspension in scope and duration to what is reasonably necessary. A material or repeated violation is a material breach of the Agreement.
Report suspected abuse to legal@helios-core.com.
Helios Core AI LLC · legal@helios-core.com