SOCPilot is licensed for security operations: triaging alerts, investigating incidents, recommending response actions, and producing audit-ready records for systems and accounts the customer is authorized to monitor.

• Investigating, monitoring or attacking systems the customer does not own or have written authorization to monitor.
• Bypassing access controls, scraping the product, or attempting to extract another tenant's data.
• Uploading content that is unlawful, infringing, defamatory, or that contains malware intended to harm third parties.
• Using SOCPilot to surveil individuals outside the scope of an authorized security program.
• Reverse engineering, model extraction, or training competing models on SOCPilot output.

Integrations must be configured with the minimum scopes needed for the connected use case. Granting standing write access to systems that do not require it is discouraged and may be restricted by workspace policy.

SOCPilot does not execute containment or identity actions without a named human approval. Customers may not bypass the human-approval gate by automating approvals through external systems in a way that defeats the intent of the control.

Suspected misuse? Email security@socpilot.co with the workspace, time window and a description of the activity.

Violations may result in workspace suspension, integration revocation, or contract termination. We coordinate with law enforcement where required by valid legal process.

legal@socpilot.co · SOCPilot, INC · 2075 Kenmore Ave, Buffalo, NY 14207