Acceptable Use Policy

1. Purpose

Kongen Labs is committed to providing a reliable, secure, and fair API platform for all users. This AUP defines the boundaries of acceptable use to protect the Service, our infrastructure, and the experience of all users. We expect all users to act responsibly and in good faith.

2. Permitted Uses

You may use the Service for any lawful purpose consistent with these guidelines, including but not limited to:

• Application development: Integrating the Logic SDK, Pattern Transfer API, or MCP Server into your own applications, products, or services.
• Research and analysis: Using the Service for academic research, data analysis, and exploratory investigations in pattern recognition and multi-domain analysis.
• LLM optimisation: Using the Logic SDK to detect reasoning regimes, identify optimal complexity zones, and optimise prompt engineering in your LLM applications.
• Signal analysis: Using the Pattern Transfer API to evaluate signals against cross-domain reference patterns for confidence adjustment and structural similarity scoring.
• AI tool integration: Using the MCP Server to provide AI assistants and tools with access to Kongen Labs scoring capabilities.
• Internal business operations: Using the Service for internal analytical and decision-support purposes within your organisation.
• Education: Using the Service for teaching, training, or demonstrating concepts related to pattern analysis and cross-domain transfer.

3. Prohibited Activities

The following activities are strictly prohibited. Violation of these prohibitions may result in immediate suspension or termination of your account without prior notice.

3.1 Illegal and Harmful Activities

• Using the Service for any purpose that violates applicable laws or regulations, including but not limited to those of Norway, the European Union, and the jurisdiction in which you operate.
• Using the Service in connection with fraud, money laundering, terrorist financing, or any other financial crime.
• Processing data through the Service that you do not have the legal right to process, including personal data collected without proper consent or legal basis.
• Using the Service to facilitate harassment, stalking, threats, or discrimination against any individual or group.
• Using the Service to generate, distribute, or facilitate illegal content, including but not limited to child sexual abuse material, non-consensual intimate imagery, or materials that incite violence.

3.2 Service Abuse

• Rate limit circumvention: Creating multiple accounts, using multiple API keys, rotating IP addresses, or employing any other technique to circumvent rate limits or token quotas.
• Denial of service: Sending requests designed to overload, degrade, or disrupt the Service or its underlying infrastructure.
• Authentication abuse: Sharing API keys between separate organisations or individuals not authorised under your account, or attempting to use another user's API keys.
• Metering evasion: Attempting to bypass, manipulate, or reduce token consumption through technical exploitation of the metering system.
• Automated abuse: Running automated scripts or bots that make API requests without legitimate processing of the responses, or that generate requests at a rate or volume inconsistent with genuine use.

3.3 Competitive Misuse

• Reverse engineering: Systematically probing the Service to extract, reconstruct, or approximate our scoring algorithms, pattern libraries, reference corpora, or proprietary methodologies.
• Competitive benchmarking: Using the Service primarily to benchmark, compare, or evaluate a competing product or service, unless expressly authorised in writing by Kongen Labs.
• Data extraction: Systematically collecting, aggregating, or harvesting Output for the purpose of building an alternative dataset, training a competing model, or replicating the Service's functionality.
• Unauthorised resale: Reselling, sublicensing, or providing access to the Service or its Output to third parties without a written resale agreement with Kongen Labs.

3.4 Security Violations

• Attempting to gain unauthorised access to the Service, other users' accounts, or our internal systems.
• Scanning for vulnerabilities without prior written authorisation from Kongen Labs. If you wish to perform security testing, contact [email protected] to discuss our responsible disclosure programme.
• Introducing malicious code, viruses, worms, trojans, or other harmful material through API requests.
• Intercepting, monitoring, or modifying communications between other users and the Service.
• Publishing or exposing API keys, authentication tokens, or internal API endpoints that are not publicly documented.

3.5 Integrity Violations

• Removing, altering, or obscuring response watermarks (kw_ identifiers) from API Output.
• Misrepresenting the source or origin of Output, including claiming that scores or analyses generated by the Service were produced by your own systems.
• Providing false or misleading information during account registration or in communications with Kongen Labs.
• Impersonating another person, organisation, or Kongen Labs employee.

4. Rate Limit Policies

4.1 Plan-Based Limits

Rate limits are enforced per API key and vary by Plan. Current limits are as follows:

4.2 Rate Limit Responses

When you exceed your rate limit, the API returns an HTTP 429 Too Many Requests response with the following headers:

• Retry-After — the number of seconds to wait before retrying.
• X-RateLimit-Limit — your Plan's RPM limit.
• X-RateLimit-Remaining — requests remaining in the current window.
• X-RateLimit-Reset — Unix timestamp when the rate limit window resets.

We expect clients to implement exponential backoff and respect Retry-After headers. Clients that repeatedly ignore rate limit responses and continue to send requests at full rate may be subject to temporary IP-level throttling.

4.3 Token Exhaustion

When your monthly token allocation is exhausted, API requests will be rejected with an HTTP 402 Payment Required response. You may upgrade your Plan at any time to receive additional tokens immediately. Token balances are visible in the dashboard and via the GET /v1/billing/usage endpoint.

5. Monitoring and Enforcement

5.1 Automated Monitoring

We use automated systems to monitor API usage for patterns indicative of abuse, including but not limited to: unusually high error rates, sustained maximum-rate requests, requests from known proxy or VPN services associated with abuse, and traffic patterns inconsistent with documented API usage.

5.2 Investigation

When potential violations are detected, we may investigate by reviewing usage metadata (timestamps, endpoints, status codes, request volumes). As stated in our Privacy Policy, we do not store or review the content of your API requests.

5.3 Enforcement Actions

Depending on the severity and nature of the violation, we may take one or more of the following actions:

5.4 Appeal Process

If you believe enforcement action was taken in error, you may appeal by contacting [email protected] within fourteen (14) days of the action. Your appeal should include your account identifier, a description of the circumstances, and any evidence supporting your case. We will review appeals within ten (10) business days and provide a written response.

6. Account Suspension Criteria

Your account may be suspended immediately and without prior warning if any of the following criteria are met:

• Security threat: Your account or API keys are being used in a way that poses an immediate risk to the security or integrity of the Service or other users.
• Legal requirement: We receive a binding legal order or law enforcement request requiring us to restrict your access.
• Illegal activity: We have reasonable grounds to believe your use of the Service involves illegal activity.
• Severe abuse: Your usage patterns constitute a denial-of-service attack or otherwise threaten the availability of the Service for other users.
• Account compromise: We have reason to believe your account or API keys have been compromised by a third party and are being used maliciously.
• Payment fraud: Your payment method is associated with fraudulent activity, chargebacks, or disputed charges.

In all other cases, we will endeavour to provide you with notice and an opportunity to remedy the violation before suspending your account.

7. Responsible Disclosure

We value the security research community. If you discover a vulnerability in the Service, we ask that you:

• Report it to [email protected] as soon as possible.
• Provide sufficient detail for us to reproduce and verify the vulnerability.
• Refrain from accessing, modifying, or deleting other users' data.
• Allow us a reasonable period (typically 90 days) to address the vulnerability before public disclosure.
• Do not exploit the vulnerability beyond what is necessary to demonstrate it.

Security researchers acting in good faith and in compliance with these guidelines will not be subject to enforcement action for activities directly related to their research.

8. Reporting Violations

If you become aware of any violation of this AUP by another user, or if you observe activity that you believe constitutes abuse of the Service, please report it to us:

• Abuse reports: [email protected]
• Security incidents: [email protected]

When reporting a violation, please include as much detail as possible: what you observed, when it occurred, any relevant identifiers (API endpoints, IP addresses, timestamps), and your contact information so we can follow up if needed. All reports are treated confidentially.

9. Changes to This Policy

We may update this AUP from time to time to address new types of abuse, changes in applicable law, or evolution of the Service. When we make material changes:

• We will update the version number and effective date at the top of this document.
• We will notify registered users via email at least fifteen (15) days before material changes take effect.
• A summary of changes will be posted on the dashboard.

Your continued use of the Service after the effective date of an updated AUP constitutes acceptance of the revised policy.

10. Relationship to Terms of Service

This AUP is incorporated into the Terms of Service by reference. In the event of any conflict between this AUP and the Terms of Service, the Terms of Service shall prevail. Violations of this AUP constitute a breach of the Terms of Service and may result in the remedies described therein, including termination and liability for damages.

Contact

If you have questions about this Acceptable Use Policy or need clarification on whether a specific use case is permitted, please contact us before proceeding:

• Policy questions: [email protected]
• Abuse reports: [email protected]
• Security: [email protected]
• Appeals: [email protected]
• General inquiries: [email protected]