Acceptable Use Policy

Last updated: 7 October 2026

This Acceptable Use Policy ("AUP") governs your use of Test My WAF, a platform operated by Layerd AI Ltd (company no. 16625788). It forms part of, and should be read with, our Terms of Service and Privacy Policy. Because the Platform sends attack-shaped traffic, misuse can be unlawful — please read this.

1. Only scan what you control 2. Prohibited uses 3. Rate limits & non-destructive testing 4. Data & results 5. Enforcement 6. Reporting abuse

1. Only scan domains you own or are authorised to test

You may initiate a scan only against a domain (and its apex/www) for which you have verified control through our DNS-verification step and for which you are authorised to conduct security testing. By starting a scan you warrant that it is authorised. The Platform verifies DNS ownership before a scan runs and re-checks it at run time; this is a safeguard, not a substitute for your own lawful authority to test the target. Running a scan against a system you do not control or are not authorised to test may breach the Computer Misuse Act 1990 and other laws.

2. Prohibited uses

You must not use the Platform to:

test, probe, scan, attack or disrupt any system you do not own or are not authorised to test;
cause or attempt to cause damage, outages, degradation, data loss or data exfiltration;
deliver or attempt to deliver working exploits, malware, or payloads intended to compromise rather than to be detected;
use the Platform as a denial-of-service, stress-testing, load-generation or traffic-laundering tool, or to relay attack traffic at a third party;
circumvent, disable or interfere with DNS verification, rate limits, quotas, session controls or any other security or access control;
scrape, harvest, resell, or systematically extract the Platform or its outputs, or use them to build or train a competing product, dataset or model;
misrepresent results, or present a report as an independent certification or as a general verdict on any vendor (see the Terms, section 5);
infringe any third party's rights, or use the Platform in violation of any applicable law or regulation.

3. Rate limits and non-destructive testing

Payloads are deliberately detection-oriented ("attack-shaped" but non-destructive) and are rate-limited. You must not attempt to weaponise them, remove the rate limits, or run volumes that could harm a target. We apply per-session, per-source and global limits and may throttle, queue or refuse requests to protect targets, third parties and the service.

4. Data and results

Reports describe a specific deployment's configured behaviour at a point in time and are provided for your own internal security use. You are responsible for how you store, share and act on them. Our handling of personal data is described in the Privacy Policy.

5. Enforcement

We may investigate suspected breaches and may, without notice, rate-limit, suspend or terminate your access, remove content, and preserve and disclose information to the extent required to comply with the law or to protect the service, our users or third parties. Breach of this AUP is a breach of the Terms of Service, and you indemnify Layerd AI against claims arising from unauthorised scans or misuse.

6. Reporting abuse or security issues

If you believe the Platform is being misused against you, or you have found a security issue, contact security@layerd.com. If your domain was scanned and you have questions about your data, contact dpo@layerd.com.