Acceptable Use Policy
Schedule A to the General Conditions — the purposes and content that are off limits on Cigno.
Version 1.0 · in force from
This policy is Schedule A to the General Terms and Conditions and is reproduced here for reference. It is read as part of that agreement — see Schedule A in context.
This Schedule states the restrictions on use of the Services. The Client is responsible for its own compliance and, under Clause 7.7, for ensuring that each Authorised User complies. A breach of it is a material breach of the Agreement and may result in suspension under Clause 22.2 or termination under Clause 23.2(a).
A1Prohibited purposes
The Services may not be used to:
(a) break the law, facilitate a breach of the law, or evade a legal, regulatory or professional obligation; (b) infringe a third party's Intellectual Property Rights, confidentiality, privacy, publicity or other rights, including by uploading material the Client has no right to provide; (c) generate or disseminate material that is defamatory, harassing, threatening, hateful, or that incites violence or discrimination against a person or group; (d) generate or disseminate sexual content involving minors, or any material that sexualises a minor, in any form and for any stated purpose; (e) generate content designed to deceive as to its origin or authenticity, including material impersonating a real person or organisation, fabricated records, receipts, confirmations, reviews, testimonials or endorsements presented as genuine, or a page or document designed to be mistaken for one issued by a real organisation; (f) develop, refine or operate malware, exploit code, phishing infrastructure, spoofed sites or any other tool intended to compromise a system or to obtain credentials or data without authorisation; (g) develop or contribute to the design, production or deployment of weapons, including chemical, biological, radiological, nuclear or high-yield explosive weapons, or to circumvent export control or sanctions law; (h) conduct surveillance of individuals without a lawful basis, including scraping or aggregating personal data to profile, track, score or identify individuals in ways the individuals concerned have not been informed of; (i) provide regulated professional advice directly to an individual without a qualified professional's involvement, including legal, medical, psychological or financial advice; (j) take, or materially inform, a decision about an individual's employment, credit, housing, insurance, education, immigration status, access to essential services, or their treatment in the criminal justice system, without the human review required by Clause 11.3 and without the Client having met its own obligations under applicable law and Clause 7.6; (k) generate political advertising, electoral communication or coordinated influence content, or content misrepresenting an electoral process; (l) circumvent, disable or interfere with a security feature, access control, rate limit, content filter or tenant-isolation measure, or attempt to access another client's data, workspace or environment; (m) probe, scan or test the vulnerability of the Platform, or breach or attempt to breach its authentication or security, except as permitted by Clause 7.5(e); (n) transmit unsolicited bulk communications, or use the Services to send communications in breach of applicable marketing or telecommunications law; (o) benchmark, reverse engineer, extract model weights or system prompts, or otherwise use the Services to build a competing product, or to train or improve another AI model on the Platform's outputs; or (p) impose a load on the Platform that is disproportionate to the Client's Usage Entitlements or that degrades the Services for other clients.
A2Content restrictions
The Client will not upload malicious code, and will not upload special category, criminal-offence or sensitive personal data except as permitted by Clause 7.4 and Annex I §C of the DPA.
The Client will not upload any category Clause 7.4 prohibits absolutely — cardholder data, protected health information, and data whose processing requires a certification or security standard Cigno does not hold — and no notification under Clause 7.4 permits them.
The Client will not use the Services as the sole repository of any material it is required to retain, and will not rely on the Platform as a system of record or an archive (Clause 10.5).
A3Reporting and enforcement
The Client will report any suspected breach of this Schedule, compromise of an account, and security vulnerability to support@cignoai.com without undue delay.
Cigno may investigate a suspected breach. Cigno does not monitor the substance of Client Content in the ordinary course, and its ability to detect a breach is limited by design — the security measures in Annex II to the DPA are built so that Cigno personnel cannot see Client Content by default. Primary responsibility for use of the Services therefore rests with the Client.
Where Cigno reasonably suspects a breach that creates an immediate risk to the Platform, to another client, or to Cigno's legal position, it may suspend access under Clause 22.2 while it investigates, and will restore access as soon as the risk is addressed.