Acceptable Use Policy

Entity

SEVEN KG LLC, a Kansas domestic limited liability company

Kansas Business ID

10090770

Address of record

4601 E. Douglas STE 150, Wichita, Kansas 67218, United States

Abuse reports

security@svnkg.com

Version

Version 1.0

Effective date

September 20, 2026

1. Scope

This Acceptable Use Policy (the “Policy”) governs all use of the SEVEN KG LLC attestation and job placement service (the “Service”), by Customers, who submit jobs with attestation policies and receive results and signed evidence bundles; and by Operators, who supply hardware capacity on which jobs are placed.

This Policy is incorporated by reference into the Customer Terms of Service and the Operator Agreement. Where those documents and this Policy conflict, the more restrictive provision applies.

2. What we can and cannot see

We state this plainly, and more conservatively than is common, because it determines how this Policy can honestly be enforced.

SEVEN KG does not inspect the contents of a workload. That is a matter of design and practice, and it is a commitment. It is not, today, a claim of technical impossibility.

The Service verifies that hardware is what it claims to be. It does not currently place work inside a trusted execution environment that hides a running workload from the owner of the machine it runs on. An Operator with physical control of a device may, in principle, observe work running on it. Customers must assume this is possible and must not send us anything whose exposure to an Operator would be unacceptable.

We will state otherwise only when the Service technically enforces otherwise, and this Policy will be amended on that date rather than before it.

Accordingly, this Policy is enforced through:

• Account controls — who is permitted to submit jobs at all;
• Contractual representation — Customers warrant their compliance and bear responsibility for breach;
• Metadata and pattern signals — job volume, duration, resource shape, billing behaviour, and jurisdiction;
• Third-party and law enforcement reports; and
• Post-hoc consequences — suspension, termination, and evidence preservation.

We do not represent that we can detect a prohibited workload while it is running. Any Customer relying on our not inspecting a workload as a means of concealing prohibited activity is in breach of this Policy and of the Terms of Service, and remains fully liable.

3. Prohibited uses

Customers must not submit, and Operators must not knowingly host, any job that falls within the following.

3.1 Illegal content and conduct

• Produces, processes, stores, or distributes child sexual abuse material, or any material that sexually exploits a minor. There is no research, testing, red-teaming, or academic exception to this clause.
• Facilitates human trafficking, forced labour, or sexual exploitation.
• Constitutes or facilitates fraud, identity theft, money laundering, or the evasion of financial sanctions.
• Violates the intellectual property rights of any third party.

3.2 Weapons and mass-harm capability

• Designs, models, simulates, or optimises chemical, biological, radiological, or nuclear weapons, or their delivery or dispersal systems.
• Designs or optimises conventional weapons systems, targeting systems, or munitions, other than under an express written agreement with the Company.
• Models or plans attacks on critical infrastructure, including power, water, transport, medical, or financial systems.

3.3 Offensive security and malicious code

• Develops, trains, compiles, obfuscates, packs, or distributes malware, ransomware, botnet infrastructure, or exploit kits.
• Conducts unauthorised penetration testing, vulnerability scanning, credential stuffing, or brute-force activity against systems the Customer does not own or have documented written authorisation to test.
• Cracks, brute-forces, or performs rainbow-table or dictionary attacks against password hashes, encryption keys, or authentication tokens the Customer does not own.
• Operates command-and-control, phishing, or malware distribution infrastructure.

3.4 Surveillance and targeting of individuals

• Performs biometric identification, facial recognition, gait analysis, or voice identification against individuals who have not consented, other than as expressly permitted by applicable law and disclosed to us in advance.
• Aggregates personal data for the purpose of tracking, profiling, harassing, doxxing, or suppressing individuals, journalists, activists, or minority groups.
• Supports mass surveillance programs incompatible with international human rights norms.

3.5 Platform integrity

• Attempts to defeat, forge, replay, or misrepresent attestation evidence, including any attempt to cause the Service to issue an evidence bundle that does not accurately reflect the hardware on which a job executed.
• Attempts to obtain access to another Customer’s job, data, results, or evidence bundles.
• Attempts to identify, deanonymise, or directly contact an Operator for the purpose of circumventing the Service.
• Misrepresents the Customer’s identity, jurisdiction, or the nature of the workload in order to obtain placement.

3.6 Abuse of the evidence bundle

An evidence bundle is a factual record of a verification result at a point in time. Customers must not present an evidence bundle as certifying anything other than what it states; represent it as a security certification, accreditation, audit opinion, or regulatory approval; or alter, excerpt, or reproduce it in a way that changes its meaning.

4. Sanctions, export control and where we operate

The Service is open worldwide, with the exclusions set out below: two that every United States company operates under, and one of our own. We do not restrict participation by nationality, region, or hardware vendor beyond what follows.

4.1 Excluded jurisdictions and persons

• The Service may not be used in, or for the benefit of any person or entity in, any country or region subject to comprehensive United States sanctions. As at the effective date these are Cuba, Iran, North Korea and Syria, together with the Crimea, Donetsk and Luhansk regions of Ukraine. This list is maintained by the United States government and changes; the current list governs, not this sentence.
• The Service may not be used by, or on behalf of, any person on the United States Specially Designated Nationals list, the Bureau of Industry and Security Entity List, or an equivalent restricted party list in an applicable jurisdiction.

Apart from these, and from the jurisdiction named in 4.5 below, nothing else is excluded. Operators and Customers in every other jurisdiction are welcome, and hardware from any manufacturer is eligible for attestation. Studying, testing and publishing findings about a device obtained through ordinary retail channels is not a transaction with its manufacturer, and this Policy does not treat it as one.

4.2 Circumvention

Customers must not use the Service to circumvent export controls on computing hardware, including by obtaining remote access to controlled hardware they could not lawfully import.

4.3 Operator disclosure

Operators must disclose the physical jurisdiction of each host offered to the Service, and must not relocate hardware across borders without notifying us. We record that jurisdiction and reserve the right to restrict placement of any job to specific jurisdictions, or to refuse placement entirely, in order to comply with applicable law or with a Customer’s stated placement policy.

4.4 Export-controlled accelerators

The Service does not presently broker access to export-controlled computing accelerators, and the supported hardware consists of mobile devices and general-purpose machines with hardware security modules. If that changes, this section will be revised, and reviewed by counsel with export control experience, before any such hardware is accepted into the network. Remote brokering of controlled accelerators across borders is a materially different regulatory undertaking and we will not begin one by accident.

4.5 Jurisdictions we do not currently serve

Separately from the sanctions above, and for reasons unconnected to them, we do not currently offer the Service in mainland China. This is a business decision about where we are presently able to meet local data protection obligations. Mainland China is not subject to comprehensive United States sanctions, and nothing in this section should be read as suggesting otherwise. Hong Kong and Macau are separate jurisdictions and are not affected. We expect to revisit this.

5. Operator obligations

• Operate hardware you lawfully control, and do not offer capacity you are not entitled to offer.
• Disclose the physical jurisdiction of each host and notify us before moving it.
• Do not attempt to read, copy, interfere with, or extract a workload placed on your hardware, or its inputs or results.
• Do not misrepresent the hardware, its security state, or its attestation evidence.
• Report a suspected compromise of a host promptly.

An Operator who attests a device but accepts no work is subject to this section only insofar as it concerns honest representation of that device.

6. Reporting abuse

Report suspected misuse of the Service to security@svnkg.com. Include enough detail to identify the activity. We acknowledge reports and investigate; we do not commit to disclosing the outcome to the reporter, because doing so can itself expose an uninvolved party.

We will not pursue anyone who reports a genuine problem in good faith.

7. Enforcement

Where we conclude that this Policy has been breached, we may warn, suspend, terminate, restrict placement, preserve evidence, or report the matter to law enforcement. We act proportionately, and we act immediately where the conduct falls within section 3.1 or 3.2.

7.1 Refunds on enforcement

Where an account is terminated for conduct within section 3.1 or 3.2, any unused prepaid balance is forfeited. Where an account is terminated for any other breach of this Policy, unused prepaid balance is refunded pro rata. This provision matches section 7.4 of the Terms of Service; if the two ever differ, the Terms of Service govern.

7.2 Evidence preservation

Where we suspend or terminate for a breach of section 3.1, 3.2 or 3.3, we may preserve the associated records beyond our ordinary retention periods for as long as necessary to respond to a lawful request. Our Privacy Policy describes those ordinary periods; this is a stated exception to them.

8. Relationship to what attestation proves

Nothing in this Policy expands what the Service technically establishes. An evidence bundle states that particular hardware presented valid evidence of particular properties at a particular moment. It does not establish that a job completed correctly, that a result is accurate, that data was concealed from the Operator, or that this Policy was complied with.

Compliance with this Policy is a contractual obligation of the Customer, evidenced by nothing technical. We would rather say that than imply a guarantee the machinery does not provide.

9. Changes

We will update the version and effective date above when this Policy changes, and keep previous versions available. Where a change materially expands what is prohibited, we will give notice to affected Customers and Operators before it takes effect, except where an immediate change is required by law.

10. Contact

Abuse and misuse reports

security@svnkg.com

Legal notices

legal@svnkg.com

Privacy

privacy@svnkg.com

General enquiries

contact@svnkg.com

Postal

SEVEN KG LLC, 4601 E. Douglas STE 150, Wichita, Kansas 67218, United States