Acceptable Use Policy

1. SCOPE

This Policy governs all use of the VirtMCU hosted simulation service — the SaaS backend served at api.virtmcu.com (the “Service”), including the MCP/HTTP API, session execution, and the cloud-compile endpoint. It applies to every customer, account, API token, and request. VirtMCU is delivered as a hosted service and is not distributed: customers receive authenticated access to the hosted API, not the software itself. This Policy supplements and is incorporated into the Terms of Service; if a conflict exists, the Terms of Service control. By using the Service you agree to this Policy. If you do not agree, do not use the Service.

2. PERMITTED USE

The Service is provided to simulate microcontroller firmware and related embedded systems: upload firmware ELFs (or compile source via the compile endpoint), run them in a deterministic emulated topology, and observe/debug the simulation over MCP. You may use the Service for any lawful firmware development, testing, education, CI, and research purpose, subject to this Policy. You are responsible for all activity under your account and API token(s), and for keeping your token(s) confidential.

3. PROHIBITED USE

You must not use the Service to, or attempt to:

3.1 Abuse the execution and compile sandboxes

• Circumvent the network isolation of the cloud-compile sandbox, or probe for or exploit a sandbox escape, container escape, or host access.
• Use uploaded firmware or compile source to break out of the emulated guest, attack the coordinator/broker/host, or interfere with another customer's session or the multi-tenant infrastructure.
• Submit firmware or source intended to crash, hang, or degrade the Service beyond your own session (resource exhaustion as an attack).

3.2 Abuse resources / capacity

• Run non-simulation workloads — e.g. cryptocurrency mining, general-purpose compute farming, password cracking, or using guest CPU time for work unrelated to firmware simulation.
• Deliberately defeat the session lifecycle controls (TTL, idle reaping, vCPU caps) or the per-service capacity ceiling — e.g. by automated session-churn intended to monopolize capacity.
• Exceed the usage and concurrency limits described on the Pricing page and in your dashboard, or evade them via multiple tokens or accounts.

3.3 Unlawful or infringing content

• Process, embed in firmware/source, or transmit content that is illegal, that infringes others' intellectual-property or privacy rights, or that you lack the rights to use.
• Embed special-category / sensitive personal data in firmware or source (the Service is not designed to process it).

3.4 Attack the Service or others

• Conduct security testing, penetration testing, vulnerability scanning, load/DoS testing, or fuzzing against the Service without prior written authorization, except for good-faith research conducted within the scope of our Security & Responsible-Disclosure Policy, which provides a safe harbor. Report suspected vulnerabilities to security@virtmcu.com.
• Use the Service to attack, scan, or send unsolicited/abusive traffic to any third-party system.
• Probe, scan, or test the vulnerability of the Service, or breach or circumvent any authentication, rate-limiting, or access control.

3.5 Misuse access / reverse engineering

• Share, sell, or sublicense your API token(s) or access to the Service.
• Reverse engineer, decompile, or attempt to extract the first-party software through the Service, or scrape the Service to build a competing or substitute product.
• Misrepresent your identity, or use another customer's credentials.

4. CUSTOMER CONTENT AND RESPONSIBILITY

Your firmware and source are your intellectual property. The Service processes them solely to run the requested simulation or produce the requested build, and does not train on them, sell them, or retain them beyond the session/compile.

You warrant that you have the rights to all firmware, source, and content you submit, and that your use complies with all applicable laws, export controls, and economic sanctions. In particular, you represent that you are not located in, or a national or resident of, a comprehensively sanctioned jurisdiction and are not on any applicable sanctions list, and that you will not use the Service in violation of U.S. EAR/OFAC or other applicable export/sanctions law (Terms of Service §14). You are responsible for configuring and supervising any autonomous agent you authorize; an agent's actions are your actions.

5. ENFORCEMENT

The operator may, with or without notice depending on severity, take any of the following actions for a violation (or suspected violation) of this Policy:

• terminate or throttle offending session(s);
• suspend or revoke the offending API token(s) — token revocation takes effect on the engine within the token-hash reload interval;
• suspend or terminate the account; and/or
• preserve and disclose information where required by law or to protect the Service, its users, or third parties.

The operator may prioritize immediate suspension for active attacks, sandbox-escape attempts, resource-exhaustion attacks, or activity that threatens other customers or the infrastructure. Abuse-tracing identifiers (token hash, source hash) are recorded for this purpose and are not the content of your firmware/source.

6. RESERVATION OF RIGHTS AND CHANGES

The operator reserves all rights not expressly granted. The operator may update this Policy from time to time; material changes will be communicated by email to your account address or by a prominent notice on the Site, and take effect 30 days after notice. Continued use of the Service after changes take effect constitutes acceptance.

7. CONTACT

Questions about this Policy: email support@virtmcu.com. Security and responsible-disclosure reports: security@virtmcu.com.