Acceptable Use Policy

1. Purpose and Scope

This Acceptable Use Policy ("Policy") governs the use of the software, platforms, applications, APIs, and related services (collectively, the "Services") provided by Sigma Automate, Inc. ("Sigma").

This Policy applies to all customers and their employees, contractors, agents, and other authorized users (collectively, "Users") who access or use the Services.

This Policy supplements Sigma's Terms of Service and any applicable written agreement between Sigma and the customer (collectively, the "Agreement"). Capitalized terms not defined herein have the meanings assigned in the Agreement. In the event of a conflict, the applicable negotiated written agreement will control.

Customers are responsible for ensuring their Users comply with this Policy.

2. Permitted Use

Customers may use the Services for legitimate business purposes in accordance with the Agreement, applicable documentation, and applicable laws and regulations.

Customers are responsible for ensuring that they have the necessary rights and authorizations to connect the Services to their systems, infrastructure, applications, and data.

3. Prohibited Activities

Customers and Users must not use the Services to:

3.1. Unlawful Activities

Engage in activities that violate applicable laws, regulations, or the rights of third parties.

3.2. Unauthorized Access

Access, attempt to access, or facilitate access to systems, networks, accounts, data, or infrastructure without appropriate authorization.

3.3. Security Threats

Introduce malware, ransomware, viruses, or other malicious code; conduct unauthorized security attacks; or attempt to compromise the security or integrity of the Services or other systems.

3.4. Service Disruption

Interfere with, disrupt, degrade, or impair the performance, availability, or operation of the Services or systems supporting them.

3.5. Circumvention of Controls

Bypass or attempt to circumvent authentication, authorization, licensing, usage restrictions, security controls, or other technical safeguards implemented by Sigma.

3.6. Unauthorized Testing

Conduct penetration testing, vulnerability scanning, load testing, or other security assessments against Sigma-managed infrastructure without prior written authorization from Sigma.

This restriction does not prohibit authorized security activities conducted against customer-owned or customer-controlled environments, provided those activities do not adversely affect the Services or Sigma-managed infrastructure.

3.7. Intellectual Property Violations

Copy, modify, distribute, reverse engineer, or otherwise misuse the Services or related intellectual property except as expressly permitted by the Agreement or applicable law.

3.8. Misuse of Resources

Use the Services in a manner that imposes unreasonable or excessive demands on Sigma infrastructure, materially interferes with other customers, or exceeds applicable contractual usage limits.

4. Infrastructure Automation and Authorized Operations

The Services may enable customers to execute automated workflows, scripts, configuration changes, infrastructure operations, and other actions across connected systems.

Customers are responsible for:

• Ensuring that automated operations are performed only against systems and resources they own, manage, or are otherwise authorized to access.

• Establishing appropriate authorization, access controls, and operational safeguards for workflows and automated actions.

• Reviewing, testing, and validating workflows and scripts as appropriate before execution in production environments.

• Maintaining appropriate backups, recovery procedures, and change management practices.

• Ensuring that Users have the permissions and authority necessary to perform actions initiated through the Services.

Customers must not knowingly use the Services to perform unauthorized, malicious, or destructive operations against any system or infrastructure.

5. Account Security and Credentials

Customers are responsible for managing access to their accounts and protecting credentials, API keys, authentication tokens, and other sensitive access information used with the Services.

Customers must:

• Take reasonable measures to prevent unauthorized account access.

• Assign access permissions appropriate to Users' responsibilities.

• Promptly revoke access when no longer authorized.

• Notify Sigma promptly upon becoming aware of unauthorized access to the Services or compromised credentials affecting the Services.

Customers must not knowingly provide unauthorized third parties with access to the Services.

6. Data and Information Security

Customers are responsible for ensuring that data submitted to or processed through the Services is collected, used, and disclosed in accordance with applicable laws and contractual obligations.

Customers must not knowingly use the Services to store, transmit, process, or distribute:

• Data obtained through unlawful or unauthorized means.

• Malicious code or content intended to compromise other systems.

• Information that infringes the intellectual property, privacy, or other legal rights of third parties.

The handling and protection of customer data by Sigma remain subject to the applicable Agreement, including any confidentiality, privacy, security, or data processing obligations.

7. Artificial Intelligence and Automated Capabilities

Certain Services may include artificial intelligence, machine learning, or AI-assisted automation capabilities.

Customers are responsible for evaluating AI-generated recommendations, scripts, configurations, and operational actions before relying on or executing them, as appropriate to the intended use and associated risk.

Customers must not use AI-assisted capabilities to perform unauthorized activities or intentionally bypass security controls, approval processes, or other applicable restrictions.

Use of AI-assisted features remains subject to the Agreement and applicable documentation.

8. Monitoring and Enforcement

Sigma reserves the right to investigate suspected violations of this Policy and take reasonable measures to protect the security, integrity, and availability of the Services.

Where Sigma reasonably determines that a violation has occurred or that continued use presents a material security, legal, or operational risk, Sigma may take appropriate action, including:

• Requesting that the customer discontinue or remediate the prohibited activity.

• Temporarily restricting affected accounts, features, or access.

• Suspending affected Services where reasonably necessary to prevent or mitigate harm.

• Taking other actions permitted under the applicable Agreement or required by law.

Where reasonably practicable, Sigma will provide notice and an opportunity to remedy violations before restricting or suspending Services. Immediate action may be taken where necessary to address an imminent security threat, unlawful activity, or material risk to the Services or third parties.

Sigma will make commercially reasonable efforts to limit restrictions to the affected accounts, functionality, or activities.

9. Changes to This Policy

Sigma may update this Policy periodically to reflect changes in the Services, security practices, legal requirements, or operational needs.

Material changes will be communicated in accordance with the applicable Agreement. Unless immediate changes are reasonably necessary to address security, legal, or operational risks, updates will become effective upon the date specified in the revised Policy.

10. Contact Information

Questions regarding this Policy or reports of suspected misuse of the Services may be directed to Sigma through its published contact channels.