This policy is part of the Terms of Service. It applies to every org, every
User and every device that uses Tartan.
1. Don't break the law or hurt people
You may not use the Service to:
do anything illegal, or help someone else do something illegal;
infringe anyone's intellectual-property or privacy rights;
distribute malware, child sexual abuse material, or content that incites violence;
harass, threaten or defraud anyone;
monitor or intercept people's communications without the authority and consents the law requires.
2. Don't attack systems
You may not use the Service, or any device on it, to:
gain unauthorized access to any system or network, including other Tartan orgs;
scan, probe or test the vulnerability of systems you don't own or have no permission to test;
run denial-of-service attacks, send spam, or operate botnet command and control;
hide the source of an attack, or forge network addresses or identities.
3. Don't abuse Tartan
You may not:
probe, scan or test Tartan's own infrastructure. The exception is good-faith research under our
security policy;
get around rate limits, quotas, device limits, billing or security controls;
create orgs in bulk or by automation, or create orgs to avoid a suspension;
use org names that impersonate others or mislead people;
put load on lighthouses, relays or DNS far beyond normal use, for example by using a relay as a bulk-transfer or
streaming service;
resell the hosted Service, or run it as a public VPN, proxy or anonymity service for people outside your
organization, without a written agreement with us;
reverse engineer the closed-source Software, except where the law allows.
4. Your responsibility
You are responsible for your Users and devices.
Keep your devices patched and your passkeys secure.
If a device or account is compromised, revoke it promptly.
5. Enforcement
We investigate reports and may act without notice when we have to, to protect people or the Service.
Depending on how serious the issue is, we may:
warn you;
revoke or block devices;
suspend features or the whole org;
terminate the org;
report illegal activity to the authorities.
We can't read your encrypted traffic. Enforcement relies on reports, metadata (such as connection patterns and
load) and the law.