# Acceptable Use Policy

Source page: https://excessionlabs.ai/aup/

Version v1 · effective 29 October 2026

Incursion and the Excession API are built for legitimate security work. By using Incursion or the Excession API you confirm that you follow this policy. Breaking it ends your access without refund.

## 1. Authorization

- Test only systems, applications, networks and devices that you own, or that you have **written permission** to test (a statement of work, rules of engagement, or an in-scope bug bounty program).
- Stay inside the scope and the time window of that permission.
- Keep proof of authorization for every engagement. We may ask for it.

## 2. Allowed work

With authorization, Incursion and the Excession API support offensive and defensive security work, including: reconnaissance, vulnerability research, web, API, cloud and network testing, code audit, exploit and proof-of-concept development, reverse engineering, malware analysis, detection engineering, red team operations, CTFs and training.

## 3. Prohibited use

- Attacking, scanning or accessing any system without authorization.
- Deploying malware, ransomware or wipers against systems you are not authorized to test, or building them for that purpose.
- Fraud, theft of credentials, money or data, extortion, and harassment, stalking or doxxing of any person.
- Attacks on critical infrastructure, election systems, or medical devices in use, unless inside an authorized engagement with the operator.
- Denial-of-service attacks against third parties.
- Anything outside cyber security that causes serious harm, including weapons, chemical, biological, radiological or nuclear harm. Child sexual abuse material is forbidden and is reported to the authorities.
- Reselling or sharing access, or helping another person avoid this policy.

## 4. Safeguards

Requests are screened automatically for the non-cyber categories in section 3. We keep account, payment and usage metadata so that we can enforce this policy. We cooperate with lawful requests from authorities.

## 5. Enforcement

We may suspend or close an account, revoke keys, and refuse service when we believe this policy was broken. To report misuse, email [abuse@excessionlabs.ai](mailto:abuse@excessionlabs.ai).

## 6. Changes

When this policy changes, the version number changes. Using the service after a change means you accept the new version.