Acceptable Use Policy

1. Overview

This Acceptable Use Policy ("AUP") defines the boundaries of permitted use for the IronFist AI platform at https://www.ironfistai.com. All subscribers must comply with this AUP. Violation results in immediate suspension of your agent and may result in account termination.

2. Prohibited Uses

You may not use the Platform or your agent for: illegal activity of any kind, harassment, threats, or intimidation, spam or unsolicited bulk messaging beyond platform-enforced email limits, weapons, drugs, or controlled substances trade, financial fraud, money laundering, or deceptive practices, impersonation of individuals or organizations, generating or distributing child sexual abuse material, credential stuffing, unauthorized access, or hacking attempts, scraping or data collection that violates target site terms of service, circumventing or disabling Platform safety mechanisms (circuit breakers, approval gates, rate limits), or any activity that could damage StableState's infrastructure, reputation, or other subscribers' services.

3. Email Volume Limits

All tenant agents are subject to a platform-enforced email sending limit of 50 emails per day. This limit is enforced by the tenant agent runtime and cannot be bypassed by agent configuration. The counter resets daily at midnight UTC.

If your use case requires higher volume, contact [email protected] to request an increase. Requests are reviewed against your account history and use case. Increased limits do not exempt you from CAN-SPAM compliance.

All outbound emails must include a valid physical mailing address and a functioning unsubscribe mechanism, in compliance with CAN-SPAM. The Platform enforces these requirements automatically.

4. Browser Automation Limits

Browser automation is available at Professional tier and above with a BYO Browserbase key. The following abuse detection thresholds are enforced:

• Professional: 20 same-domain requests per hour, 10 distinct form-fill domains per day
• Business: 50 same-domain requests per hour, 25 distinct form-fill domains per day
• Enterprise: 100 same-domain requests per hour, 50 distinct form-fill domains per day

Exceeding these thresholds generates an admin review notification. StableState reserves the right to suspend browser automation for accounts exhibiting patterns consistent with credential stuffing, automated scraping at scale, or CAPTCHA bypass attempts.

A financial domain blocklist is enforced on all tenant agents. Write operations (form filling, clicking, session capture) are blocked on banking, investment, and financial services domains.

5. Enforcement

Violations are handled as follows: First violation: Agent suspended, subscriber notified with details of the violation, opportunity to remediate. Repeated or severe violation: Account terminated, infrastructure deleted, no refund for the current billing period. Illegal activity: Immediate termination, cooperation with law enforcement as required.

6. Reporting Violations

If you believe a StableState subscriber is violating this AUP, report it to [email protected] with details of the suspected violation.