Acceptable use policy

You may not use the Service, and may not let anyone use it through your account, to:

• Break the law — any use that is unlawful where you are or where we are, including fraud, money laundering, sanctions evasion, tax evasion or market manipulation.
• Infringe someone else’s rights — upload data you have no right to hold or process, or content that infringes copyright, trade secrets or privacy.
• Attack the platform — probe, scan or test its security without written permission; attempt to bypass authentication, a role, a period lock or a dimensional access rule; access an organisation, a model or a cell you were not granted.
• Overload it — deliberately exhaust compute, storage or rate limits, or run load tests without arranging them with us first.
• Reverse-engineer it — decompile, disassemble or otherwise try to derive the source or the internals of the engine, except to the extent that the law says you may despite this clause.
• Resell it — provide the Service to a third party as a service of your own, or use it to build or benchmark a competing product.
• Impersonate — use another person’s credentials, share your own, or misrepresent whose authority an action was taken under.
• Interfere with other customers — anything that degrades the service for someone else.

Superiora Planner is designed for planning data. It is not built, and must not be used, as a repository for:

• Payment card data in scope of PCI DSS.
• Health records or other data subject to a specific regulatory regime (HIPAA and its equivalents), unless we have agreed it in writing first.
• Government-classified material.
• Special-category personal data under LGPD art. 5, II or GDPR art. 9 — racial or ethnic origin, religion, political opinion, union membership, health, sex life, genetic or biometric data — unless we have agreed it in writing first.

A workforce plan naming employees, with roles and salaries, is ordinary planning data and is expected. A file of their medical records is not.

Superiora Planner exposes a model to AI agents over MCP and a command line. That interface is powerful on purpose: an agent can read the model’s structure, trace a formula’s dependencies, check a change and apply it. The rules are the ones a person would have:

• An agent signs in as a user and holds a role. It cannot do what that role cannot do, and the break-glass master token is refused on the agent paths.
• You are responsible for what your agents do with your data, exactly as you are for your people.
• An agent must not be used to circumvent a period lock, an access grant or an approval step that a person would have had to pass.
• An agent’s writes appear in the audit log under its own identity. Do not disguise one as a person.
• Do not use the interface to extract the platform’s own behaviour in bulk in order to reproduce it.

Found a vulnerability? Write to hello@superiora.ai with “security” in the subject. Give us enough detail to reproduce it, and please do not test against another customer’s data or take more of it than the proof needs. We will acknowledge, keep you posted, and credit you if you want it. There is no bug bounty programme today.

Seen abuse? Same address. Say what you saw and where.

Enforcement. Where use breaches this policy we will normally tell you and ask you to stop. Where the breach presents an immediate risk to the platform, to other customers or to data, we may suspend the account or the offending user first and explain afterwards. Repeated or serious breach is grounds for termination under the Terms.