Acceptable Use Policy — Lanterna Tech

01Purpose

This Acceptable Use Policy (the "Policy") governs your use of Lanterna Tech and its websites, APIs and applications (the "Services"), provided by Lanterna Technologies Inc. ("Lanterna", "we", "us"). It supplements, and is incorporated by reference into, the SaaS Agreement / Terms of Service (/legal/terms) and the Privacy Policy (/legal/privacy). If there is a conflict, the SaaS Agreement governs, except where this Policy is expressly stated to control a specific matter.

Effective July 23, 2026. Version 1.0.

02Who this applies to

This Policy applies to every person and entity that accesses the Services: the subscribing organization (the "Customer"), its administrators and authorized users (the "Users"), and — where the Customer is a managed service provider ("MSP") — the MSP's client tenants and their users. The Customer is responsible for ensuring that all of its Users and client tenants comply with this Policy.

03General principle

The Services hold sensitive data: IT and OT asset registries, obsolescence roadmaps, and security-posture and compliance assessments. You may use the Services only for your own lawful internal business purposes, in accordance with the SaaS Agreement, this Policy and all applicable law (including, in Québec, Law 25 and applicable Canadian federal law). You must not use the Services in any way that harms Lanterna, other tenants, Users or third parties.

04Prohibited uses — unlawful or harmful activity

In connection with the Services, you must not, and must not permit any third party to:

use the Services in violation of any applicable law, regulation, sanctions regime or third-party right;
upload, store or transmit content that is unlawful, defamatory, infringing, or that you do not have the right to process;
use the Services to plan, facilitate or conceal any illegal act.

05Security and integrity of the platform

access, or attempt to access, any account, tenant, data or system component you are not expressly authorized to access, or circumvent tenant isolation, authentication, authorization or any other access control;
probe, scan, penetration-test, load-test or otherwise test the vulnerability of the Services or their infrastructure, except under the coordinated conditions in Section 11;
defeat, disable or interfere with rate limiting, IP allow-lists, 2FA, encryption, audit logging or other security features;
introduce or transmit malware, ransomware or any malicious code;
use the Services to attack, scan or compromise any other system or network.

06Availability and fair use

generate load that materially exceeds normal, documented use, or that degrades the Services for other tenants (denial-of-service, request flooding, or exceeding published API rate limits and plan quotas);
access the Services other than through the interfaces and APIs we provide, or bulk-extract data except through documented export features and API keys within their granted scope;
circumvent or manipulate plan limits (user, initiative, asset or tenant counts), billing or metering.

07Data you put into the Services

upload personal information without a valid legal basis and, where required, the necessary consents, notices and — under Law 25 — any privacy-impact assessment required for sensitive processing;
upload another organization's confidential security or OT/ICS information — vulnerabilities, network topology, third-party supplier data — without authorization to disclose it to a cloud service;
upload special-category or highly regulated data types the Services are not contracted to handle (e.g. payment card data, government-classified material, health records), unless expressly agreed in writing.

08Intellectual property and the software

reverse engineer, decompile or disassemble the Services, or attempt to derive source code, except to the extent this restriction is prohibited by applicable law;
copy, resell, sublicense, rent or provide the Services to third parties, except an MSP acting within the scope of its MSP subscription and white-label terms;
remove or alter any proprietary notices, or use Lanterna's or a tenant's marks without authorization.

09Misrepresentation and abuse of features

impersonate any person or entity, or misrepresent your affiliation, including in share links, lead-demo sessions, invitations, magic links, webhooks or outbound integrations;
use webhooks, integrations or any outbound-request feature to target internal, private or unauthorized network endpoints (SSRF), or to relay spam or unsolicited messages;
use free trials, demos or evaluation access other than for bona fide evaluation, or create accounts to evade suspension, quotas or fees.

10Customer and administrator responsibilities

The Customer and its tenant administrators are responsible for:

provisioning, managing and de-provisioning Users, and enforcing least-privilege roles, view/domain restrictions and 2FA where appropriate;
safeguarding credentials, API keys and share links, and rotating or revoking them promptly when compromised or no longer needed;
the lawfulness of all data they and their Users submit, and for responding to data-subject requests relating to that data;
monitoring their own tenant's activity and reporting suspected misuse or compromise without undue delay.

MSP Customers are additionally responsible for the compliance of each client tenant they create and for any action taken under a switch-context session.

11Security research and coordinated disclosure

We welcome good-faith security research. If you believe you have found a vulnerability, you may test only against your own tenant and only to the minimum extent necessary to confirm the issue, provided you:

do not access, modify or exfiltrate data belonging to any other tenant;
do not degrade, disrupt or overload the Services (no DoS or load testing against shared infrastructure);
do not publicly disclose the issue before we have had a reasonable opportunity to remediate;
report promptly to [email protected] with enough detail to reproduce the issue.

Good-faith research conducted in accordance with this Section is authorized use and will not be pursued by us as a violation. Anything outside these conditions is prohibited under Section 05.

12Monitoring, suspension and enforcement

We do not routinely monitor the content of Customer Data. We may, however, investigate suspected violations and access account metadata, logs and — where necessary and lawful — content, to protect the Services and other tenants.

If we reasonably believe a violation has occurred, or that continued use poses a security, legal or availability risk, we may, with notice where practicable (and immediately in an emergency): throttle or rate-limit access; suspend a User, tenant or account; remove or disable offending content or configuration; or terminate the affected subscription in accordance with the SaaS Agreement. We restore access once the issue is resolved to our reasonable satisfaction. Suspension for cause does not entitle the Customer to a refund of pre-paid fees for the suspended period.

13Reporting abuse

Report any abuse, security incident or violation of this Policy to [email protected]. Privacy matters: [email protected]. Legal notices: [email protected].

14Changes

We may update this Policy as the Services and the threat landscape evolve. Material changes will be communicated in accordance with the notice provisions of the SaaS Agreement, and the effective date above will be updated. Continued use after that date constitutes acceptance.

15Governing law

This Policy is governed by the laws of the Province of Québec and the federal laws of Canada applicable therein, consistent with the "Governing Law" provisions of the SaaS Agreement.

16Contact

Lanterna Technologies Inc., Otterburn Park, Quebec. Abuse: [email protected] · Security: [email protected] · Privacy: [email protected] · Legal: [email protected].