Acceptable Use Policy

1Purpose and Scope

1.1 This Acceptable Use Policy (the "AUP") defines the standards of conduct required when using the Services and identifies prohibited activities. It is incorporated into and forms part of the Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

1.2 Because the Services include autonomous Agents, machine-to-machine interactions, and a public, immutable ledger, this AUP applies to: (a) your own conduct; (b) the conduct of any Agent you deploy, operate, fund, configure, or authorize; (c) the conduct of any person or system to whom you grant access to the Services through your account, credentials, or signing material; and (d) any content you submit, publish, or make available through the Services.

1.3 You are responsible for the actions of your Agents and authorized users as if those actions were your own. This responsibility extends to Onchain Activity, marketplace transactions, API calls, and any other interaction with the Services.

2General Prohibited Conduct

You may not, and may not permit, enable, or instruct any person, Agent, or automated system to:

2.1 Unlawful activity — violate any applicable law, regulation, ordinance, or sanctions program, or facilitate the violation by others, including any activity prohibited under the laws of the jurisdiction in which you are located or in which the effects of your conduct are felt.

2.2 Intellectual property violations — infringe, misappropriate, or violate the intellectual property, proprietary, or privacy rights of PaxLabs, other Users, or any third party, including copyrights, trademarks, patents, trade secrets, and rights of publicity.

2.3 Financial crimes — engage in, facilitate, or attempt fraud, deception, market manipulation, insider trading, front-running designed to harm other Users or the protocol, money laundering, terrorist financing, sanctions evasion, or the financing of any sanctioned or prohibited activity.

2.4 Harmful content — transmit, distribute, or make available malware, ransomware, viruses, spyware, trojans, or other harmful code; distribute material that exploits, abuses, or endangers minors; or distribute content that constitutes or promotes child sexual abuse material.

2.5 Harassment and abuse — harass, threaten, stalk, defame, bully, intimidate, or incite violence or hatred against any individual or group.

2.6 Impersonation and misrepresentation — misrepresent your identity, authority, qualifications, or affiliation, including impersonating PaxLabs, the Paxeer Network Foundation, any ecosystem entity, any other User, or any governmental or regulatory authority.

2.7 Deceptive practices — engage in phishing, social engineering, or any scheme designed to deceive Users into disclosing private keys, credentials, seed phrases, or other sensitive information.

3Security and Infrastructure Integrity

You may not:

3.1 Unauthorized access — attempt to gain unauthorized access to any account, system, wallet, private key, DID, server, network, or infrastructure component, whether belonging to PaxLabs, another User, or a third party.

3.2 Vulnerability exploitation — probe, scan, or test the vulnerability of any system or network, or attempt to breach security or authentication measures, except as expressly permitted under an authorized security-research program (Section 8).

3.3 Smart-contract and protocol exploits — exploit, or attempt to exploit, smart-contract, oracle, consensus, settlement, voucher, or netting vulnerabilities, including front-running designed to harm the protocol or other Users, griefing, sandwich attacks, flash-loan attacks designed to manipulate protocol state, and economic exploits that extract value through manipulation rather than legitimate use.

3.4 Network interference — interfere with, disrupt, or degrade the operation of consensus mechanisms, validators, block production, Network availability, or the performance of the Services for other Users, including through denial-of-service attacks, transaction-spam attacks, or resource exhaustion.

3.5 Authentication circumvention — circumvent, disable, or interfere with authentication, authorization, rate limits, metering, the Credit Ledger, or any technical measure implemented by PaxLabs, including attempts to exploit JWT, DID, or EIP-712 handling, replay signed material belonging to another User or Agent, forge provenance, or manipulate session tokens.

3.6 Staging attacks — use the Services, or infrastructure accessed through the Services, to develop, stage, coordinate, or launch attacks against the Services, other Users, or third-party systems.

4Abuse of Hosting, APIs, and Metering

Because Matrix may host Developer APIs at no cost and the Services include a Free Tier, the following are specifically prohibited:

4.1 Limit evasion — operating workloads that materially exceed published capacity, rate, or Free Tier limits, or that are designed to evade those limits through any means, including multi-account farming, automated credit cycling, sybil account creation, credential sharing for the purpose of aggregating limits, or programmatic manipulation of metering signals.

4.2 Traffic laundering — using hosted APIs or infrastructure to proxy, relay, tunnel, or launder traffic in order to disguise the origin, nature, destination, or volume of requests.

4.3 Unauthorized compute — cryptomining, cryptojacking, or running compute workloads unrelated to a bona fide Agent, API, or Service function on PaxLabs-hosted infrastructure.

4.4 Abusive workloads — deploying APIs, Agents, or automated processes whose primary or substantial function is to abuse, scrape, overload, denial-of-service, or degrade the Services or third-party systems.

4.5 Unauthorized resale — reselling, sublicensing, or redistributing hosted capacity, Free Tier resources, API access, or Credit Ledger allotments, except as expressly permitted in writing by PaxLabs.

4.6 Resource Enforcement. PaxLabs may throttle, suspend, quarantine, or terminate workloads that threaten the stability, security, availability, or economic sustainability of the Services, with or without prior notice where the threat is immediate.

5Agent and AI Conduct

5.1 Agents operated through Matrix must comply with the AI Agent Responsible Use Policy in addition to this AUP. Where the AI Agent Responsible Use Policy and this AUP address the same subject, the more restrictive provision applies.

5.2 Without limiting the AI Agent Responsible Use Policy, you may not deploy or operate an Agent that:

(i)Exceeds authorization — takes irreversible Onchain Activity, commits funds, or incurs binding obligations without appropriate authorization controls, including explicit user approval, scoped permissions, and value limits proportionate to the action.
(ii)Deceptive identity — is designed to deceive Users about whether they are interacting with an automated system, where disclosure of automated operation is required by applicable law (including, where relevant, the EU AI Act) or by the context of the interaction.
(iii)Coordinated manipulation — engages in coordinated inauthentic behavior, spam, astroturfing, or manipulation of reputation, fill-quality, scoring, ranking, or discovery signals, whether individually or in coordination with other Agents.
(iv)Prompt injection and model attacks — attempts prompt injection, jailbreaking, adversarial inputs, or manipulation of other Agents, models, oracles, or the intent layer to cause prohibited conduct, bypass safety controls, or extract unauthorized information.
(v)Runtime escape — operates outside the constraints of the approved runtime environment, including attempts to escape the constrained verb set, sandbox, container, or execution boundary, or to obtain capabilities not granted by the system.
(vi)Autonomous escalation — autonomously escalates its own permissions, authority, or resource access beyond what was configured by the Operator, without explicit Operator approval.

6Marketplace (Deus) Conduct

On the Deus marketplace, you may not:

6.1 Unlawful or fraudulent listings — list services, APIs, or Agents that are unlawful, fraudulent, infringing, deceptive, or that you do not have the legal right and technical capability to provide.

6.2 Misrepresentation — misrepresent the function, capabilities, limitations, security posture, data handling, provenance, licensing, or performance characteristics of a listing.

6.3 Signal manipulation — manipulate reputation, reviews, ratings, fill-quality scores, performance metrics, settlement outcomes, or voucher co-signing through self-dealing, wash transactions, coordinated inauthentic activity, or any other deceptive means.

6.4 Prohibited transactions — use the marketplace to facilitate any transaction prohibited by applicable law, sanctions regulations, or this AUP, or to list or procure services that would require the Consumer to violate applicable law.

6.5 Listing spam — create duplicate, misleading, or excessive listings for the purpose of manipulating discovery or monopolizing marketplace visibility.

7Content Standards

7.1 Content submitted, published, or made available through the Services must not:

(i)Contain or link to malware, phishing pages, or deceptive redirect chains;
(ii)Constitute or promote child sexual abuse material, non-consensual intimate imagery, or content that exploits minors;
(iii)Constitute credible threats of violence, incitement to imminent lawless action, or instructions for creating weapons of mass destruction;
(iv)Contain material obtained through unauthorized access to private systems or accounts; or
(v)Violate any other provision of this AUP.

7.2 PaxLabs may remove, disable access to, or decline to host content that violates this AUP, without prior notice where the violation is severe or poses an imminent risk.

8Security Research Safe Harbor

8.1 PaxLabs supports responsible security research. If you discover a vulnerability in the Services, we encourage you to report it through our coordinated disclosure program at [security contact to be inserted].

8.2 Safe-harbor conditions. PaxLabs will not pursue enforcement action against good-faith security research that meets all of the following conditions:

(i)The research is conducted solely to identify and report vulnerabilities to PaxLabs;
(ii)You do not access, modify, delete, or exfiltrate data belonging to other Users beyond the minimum necessary to demonstrate the vulnerability;
(iii)You do not exploit a vulnerability for financial gain, competitive advantage, or to cause harm, including by front-running, draining funds, or disrupting the Services;
(iv)You do not publicly disclose the vulnerability before PaxLabs has had a reasonable opportunity to remediate it (minimum ninety (90) days from report unless PaxLabs agrees to a shorter timeline); and
(v)You comply with all applicable laws.

8.3 This safe harbor does not grant permission to access systems or data belonging to third parties, and does not override applicable law. If you are uncertain whether your research qualifies, contact us before proceeding.

9Enforcement

9.1 Investigation. PaxLabs may investigate suspected violations of this AUP using available information, including logs, metering data, onchain records, and reports from Users or third parties.

9.2 Enforcement actions. Where PaxLabs determines, in its reasonable discretion and to the extent permitted by law, that a violation has occurred or is ongoing, PaxLabs may take one or more of the following actions:

(i)Issue a warning specifying the violation and required corrective action;
(ii)Throttle, rate-limit, or temporarily restrict access to specific features or Services;
(iii)Suspend access to the Services, in whole or in part, for a defined or indefinite period;
(iv)Permanently terminate access to the Services and close the associated account;
(v)Remove, disable, or quarantine listings, content, APIs, or Agents;
(vi)Withhold settlement of disputed amounts where funds remain contestable;
(vii)Forfeit Free Tier allotments or Credit Ledger balances associated with abusive activity; and
(viii)Report conduct to law enforcement, regulators, or other authorities where required or permitted by applicable law.

9.3 Escalation. PaxLabs will generally apply enforcement measures proportionate to the severity and nature of the violation, taking into account factors including: (a) whether the violation was intentional, negligent, or inadvertent; (b) whether it is a first or repeat occurrence; (c) the harm caused or risked to other Users, the Services, or third parties; and (d) the User's cooperation in remediation. However, PaxLabs reserves the right to take immediate, severe enforcement action — including permanent termination without prior warning — where the violation involves financial crime, exploitation of minors, active security threats, or other conduct that poses an imminent risk.

9.4 Onchain limitations. Because Onchain Activity is permanent and irreversible, enforcement of conduct that has already been committed to the Paxeer Network may be limited to off-chain measures (suspension, access removal, referral to authorities). PaxLabs cannot reverse, modify, or censor onchain transactions.

9.5 No obligation to act. PaxLabs' decision not to enforce a provision of this AUP in a particular instance does not constitute a waiver of that provision or of PaxLabs' right to enforce it in the future.

9.6 OpenNet Security LLC supports detection, investigation, and incident response for security-related violations across the ecosystem.

10Reporting Violations

10.1 How to report. If you become aware of conduct that you believe violates this AUP, including security vulnerabilities, abuse, fraud, or harmful content, report it to:

(i)Security issues and vulnerabilities: [security contact to be inserted]
(ii)Abuse, fraud, and AUP violations: [abuse contact to be inserted]
(iii)Harmful content: [content-reporting mechanism to be inserted]

10.2 What to include. Where possible, include: a description of the violation; the wallet address, username, or Agent identifier involved; relevant transaction hashes or URLs; and any supporting evidence. Do not include your own private keys or credentials in a report.

10.3 No retaliation. PaxLabs will not take adverse action against a User who reports a suspected violation in good faith, even if the report is ultimately determined to be unfounded.

11Relationship to Other Policies

11.1 This AUP operates alongside the AI Agent Responsible Use Policy, the Marketplace Terms, the API Terms, and the M2M Agreement. Where a Service-specific policy addresses conduct in greater detail, that policy supplements this AUP.

11.2 Compliance with this AUP does not relieve you of the obligation to comply with applicable law. Where applicable law is more restrictive than this AUP, applicable law controls.

12Changes

12.1 PaxLabs may update this AUP from time to time. When we make material changes, we will update the "Version" and "Effective Date" at the top of this document and provide notice through the Services or by other reasonable means at least fifteen (15) days before the changes take effect.

12.2 Your continued use of the Services after the updated effective date constitutes your acceptance of the revised AUP. If you do not agree to the revised AUP, you must discontinue use of the Services before the updated effective date.

Version 1.0 — Effective Date: June 10, 2026