---
title: "Acceptable use policy: authorized security testing only"
canonical: https://pentestllm.ai/acceptable-use
generated: 2026-11-11T18:45:18.517Z
source: https://pentestllm.ai/acceptable-use
base_url: https://api.pentestllm.ai/v1
---

![Rows of server cabinets in a data centre](https://pentestllm.ai/img/datacenter.webp)

Last updated 2026-11-11

PentestLLM is for lawful, authorized security work. You may use it against systems, networks, applications and accounts that you own, or that the owner has given you written permission to test, and only within the scope of that permission. A signed statement of work, rules of engagement, a bug bounty program’s published scope or a CTF’s rules are examples of permission.

Keep proof of your authorization. Uplink Switch LLC may ask for it, and may suspend a key until it is shown.

- You must be 18 or older.
- This policy is part of the [terms](https://pentestllm.ai/terms). It covers every account, key and request, including requests your own users or agents send through something built on PentestLLM. You are responsible for their use as if it were yours.

Penetration testing, red team exercises, bug bounty research inside a program’s scope, CTF challenges, malware analysis, vulnerability research, code review, detection engineering and security training. The models here decline fewer security questions than stock assistants. Refusals are reduced, not removed, and a model answering a request does not make the request allowed.

- Unauthorized access: accessing, attacking, scanning or testing any system, network, device or account you do not own or do not have written permission to test, or going outside the scope you were given.
- Malware deployment against third parties: building, adapting or spreading malicious code, ransomware or command-and-control tooling for use on systems you are not authorized to test.
- Fraud: scams, phishing or social engineering aimed at real people outside an authorized exercise, impersonation, payment or identity fraud.
- Credential theft: stealing, cracking, buying, selling or using credentials, tokens or personal data you have no right to hold.
- Harassment: threats, stalking, doxxing, or targeting a person or group.
- Denial of service or destructive actions against systems outside an authorized, agreed test window.
- Attacks on critical infrastructure, or anything meant to cause physical harm.
- Help making biological, chemical, nuclear or radiological weapons, or planning violence.
- Any sexual content involving minors, in any form.
- Anything illegal where you are or where the output is used, including breaches of export and sanctions law.

- No getting around rate limits, billing or key restrictions, and no probing, overloading or disrupting the gateway. To report a vulnerability in the service, follow the [disclosure policy](https://pentestllm.ai/security).
- No stolen or unauthorized payment methods, and no disputing charges for usage you made.
- No reselling or sharing keys, as the [terms](https://pentestllm.ai/terms) say.

A key without its own settings takes up to 600 requests a minute. In an account’s first 24 hours, every key is held to 60 requests a minute. Past a limit the API answers 429 with `rate_limited` and a `retry-after` header.

Uplink Switch LLC may refuse requests, suspend or revoke keys, or close accounts that break this policy, without notice or refund. Apparent child sexual abuse material and credible threats are reported to the authorities, and Uplink Switch LLC answers valid legal process.

In the API, requests from a suspended account answer 403 with `account_frozen`. The unused balance of an account closed for a breach is not refunded, as the [terms](https://pentestllm.ai/terms) say.

If you believe this service was used against you or your systems, write to [abuse@pentestllm.ai](mailto:abuse@pentestllm.ai). You do not need an account. Send what you have: the time in UTC, the addresses or domains involved, and any text or artifacts you think came from here. Every answer the API gives carries a request id in the `x-uplink-request-id` header; include it if you have one.

The operator is Uplink Switch LLC, 1309 Coffeen Ave STE 20866, Sheridan, WY 82801.