These rules apply to every user of the DeRISK™ Intelligence Platform, on every tier. That includes users at customers whose organization has signed an MSA: each user accepts this Schedule at first Start. "You" means the user and the organization they act for. Capitalized terms have the meanings in the EULA.
1. Prohibited conduct
1.1 No Competitors. Competitors may not access or use the platform on any tier without DeNexus's prior written consent. No one may use the platform for a Competitor. A "Competitor" is any organization that develops, sells or offers products or services competing with the platform, including cyber risk quantification, cyber threat intelligence, OT risk analytics or underwriting analytics. It includes that organization's affiliates and anyone acting for it.
1.2 Never allowed. You must not, and must not let anyone:
- analyze, benchmark or copy the platform, or use it to build or improve a competing product;
- use Outputs or the platform to train, calibrate, validate or distil any AI Model;
- extract DeNexus content in bulk, including questionnaire libraries, frameworks and threat intelligence;
- probe prompts or agent logic, attempt prompt injection or jailbreaks, or reverse engineer, decompile or disassemble any part of the platform;
- scrape the platform or access it by automated means, except through interfaces DeNexus provides;
- open multiple or false accounts, including to exceed Free Tier limits, or share credentials;
- perform security or penetration testing, except under DeNexus's published vulnerability disclosure policy;
- use threat intelligence to target or harm any third party;
- upload malicious code, or content you have no right to submit, such as licensed standards;
- submit special categories of personal data, criminal-offence data or data about children;
- publish benchmark or performance results about the platform;
- use the platform from, or for anyone in, a jurisdiction under comprehensive sanctions, or if you are a sanctioned or restricted party;
- use the platform unlawfully or to infringe anyone's rights.
2. Using AI Outputs responsibly
2.1 Outputs are estimates. Outputs come from AI Models. They are probabilistic, depend on your inputs and stated assumptions, and may be incomplete or inaccurate. They are not insurance, actuarial, underwriting, financial, investment, credit, engineering, safety or legal advice.
2.2 Human review. A qualified person in your organization must review Outputs before you rely on them.
2.3 Underwriting decisions. In DeRISK™ UWA, a qualified underwriter must make every decision to bind, price, decline or set conditions. Automated ("Auto-Pilot") features may only rank, route or prioritize submissions.
2.4 Prohibited high-risk uses. Do not use the platform:
- to assess risk or set prices for natural persons in life or health insurance;
- to evaluate the creditworthiness of, or credit-score, natural persons;
- as a safety component of, or to control, critical infrastructure or industrial control systems.
2.5 Sharing Outputs. You may share Outputs as EULA 6.6 allows. Keep DeNexus attribution and the disclaimers intact; on white-labelled reports, keep the substance of the disclaimers. Tell recipients that Outputs were produced with AI where the law requires.
3. AI regulation: who does what
3.1 Intended purpose. The platform supports decisions about the cyber risk of organizations: risk quantification for operators and underwriting support for insurers. DeNexus does not offer it for any use classed as high-risk under the EU AI Act. You must tell DeNexus before any use that could be high-risk, and DeNexus may decline it.
3.2 Allocation of duties.
| Duty | DeNexus | You |
|---|---|---|
| Transparency | Labels AI-generated Outputs and conversational features in the product | Tell people affected by your decisions that AI was used, where the law requires |
| Information | Provides, on request, a description of the platform's intended purpose, capabilities and limitations | Use the platform within that intended purpose |
| Human oversight | Designs the platform for qualified human review | Assign qualified people to review Outputs and take decisions |
| AI literacy | Provides training materials on request | Ensure your staff using the platform are sufficiently trained |
| Records | Keeps Run Records for 12 months (EULA 8.4) | Keep your own records of inputs, Outputs and decisions |
| Incidents | Tells you promptly of a malfunction that may have affected your Outputs | Tell DeNexus promptly of any serious incident or suspected malfunction |
4. Monitoring and enforcement
4.1 Monitoring. DeNexus monitors use of the platform to detect and stop abuse, as described in its privacy notice.
4.2 Consequences. If you breach this Schedule, DeNexus may use the remedies in EULA 5.5, or in your organization's MSA. These include immediate suspension or termination, revocation of your licence to Outputs, a licence fee at list price for unauthorized use, injunctive relief and recovery of legal costs.
4.3 Reporting. Report suspected misuse or security issues to security@denexus.ai.