Acceptable use

This policy applies to everything you do with Elpis: the console, the API, the MCP server, the SDKs, webhooks and the public registry. It is part of the Terms of Service. If anything here conflicts with the Terms, the stricter rule applies.

You are responsible for everything done with your account and your API keys, including by software agents you run or authorise. “My agent did it” is not an exception.

• Break any law that applies to you, or help anyone else to.
• Move funds that come from, or are meant for, fraud, theft, scams, extortion, terrorism financing, or money laundering.
• Pay, receive from, or deal with a person, entity, or place that is subject to sanctions that apply to you or to us, or evade those sanctions.
• Use it from, or for people in, a place where digital assets or self-custody tooling are restricted or unlawful.
• Pay for or sell illegal goods or services, or content that sexually exploits children.
• Mislead a counterparty: staging a payment against a condition you know is false, forging evidence, or posting a deliverable that is not what was agreed.
• Impersonate another person, organisation, agent, or Elpis itself.

• Probe, scan, or test the service for weaknesses without permission, other than under our vulnerability-reporting terms on the Support page.
• Try to read, change, or move another organisation’s data, keys, or funds.
• Guess, steal, share, sell, or leak API keys, sessions, or sign-in challenges.
• Go around a rate limit or a usage cap: rotating addresses, splitting traffic across many keys or accounts, or any other trick to exceed what a single account is allowed.
• Create accounts in bulk, or to collect free credits more than once.
• Overload the service, or send traffic whose only purpose is to consume capacity.
• Scrape the registry or any other endpoint faster than the published limits.
• Interfere with how the contracts, the attestor, or the keeper work.

Every API key has request limits, a tighter limit on requests that change state, and a daily cap on those. Signing in and creating accounts are limited by address. Hitting a limit returns HTTP 429 with a Retry-After header; back off for that long. If you need more room for a real integration, ask us through Supportand we will raise the limit on your key rather than have you work around it.

If we believe this policy is being broken, or a key or account puts others at risk, we may, with or without notice and as the situation calls for:

• lower a key’s limits, or revoke it;
• pause new payment proposals on an account or across the service;
• suspend an account, and keep records as the law requires;
• report conduct to the authorities, and respond to lawful requests.

We do not hold your funds, so we cannot freeze or seize them. A pause stops new proposals only: refunds, approvals of payments already staged, evidence, and exports keep working, so you can always recover money that is already in motion. We cannot reverse a confirmed blockchain transfer.

To report abuse or a vulnerability, use the Support page. Please include the x-request-id of the request if you have one.

We may update this policy as the service changes. The date at the top shows the latest version. Using Elpis after a change means you accept it.