Acceptable Use Policy (AUP).

1. Acceptable use principles

Alvo is designed for electricity-market analysis and trading decision support in compliance with Ukrainian and applicable European law. You agree to use it for lawful purposes, with respect for other users, and without harming infrastructure stability.

2. Prohibited — market manipulation

Alvo provides decision-support tools; any action on the electricity market is governed by Ukrainian and European antitrust law. The following are prohibited:

• using the Service to coordinate bids between participants to influence prices (REMIT, Ukrainian Law on the Electricity Market);
• generating fake demand / supply signals on trading venues;
• using Alvo AI briefs as a front-running tool against other traders;
• any activity bearing signs of insider trading or wash trading.

Suspected market manipulation → we are legally required to notify NEURC / AMCU / ACER as applicable.

3. Prohibited — technical integrity

• Scraping or automated copying of data outside the public API (which has documented rate limits in /developers);
• Reverse-engineering, decompilation, or bypassing security mechanisms;
• Attempts at unauthorized access to other users' accounts (credential stuffing, brute force);
• DoS / DDoS attacks, intentional rate-limit overflow (120 req/min per route and client fingerprint);
• Distributing malware, phishing via the Alvo domain or email-template impersonation.

4. API key responsibility

API keys (format `alvo_live_<32-chars>`) are issued exactly once and cannot be recovered. You are fully responsible for safekeeping:

• Do NOT commit keys to public git repos, gists, chat logs, screenshots. Use a secret manager (1Password, Vault, AWS Secrets, Doppler).
• Do not share keys with third parties without Alvo's written consent (violation → contract termination).
• On compromise — immediately revoke in /account and generate a new key. Notify security@alvo.energy for audit.
• Do not use API keys to act on behalf of users who did not give explicit consent (e.g. white-label integration — separate contract).

5. Content responsibility

You are responsible for data you upload to the Service (CSV imports, strategy profiles, audit notes, AI prompts). Alvo does not analyze or moderate content — but reserves the right to suspend processing if content clearly violates law or third-party rights.

6. Rate limits + fair use

Base limit: 120 requests per minute per route + client fingerprint (IP + API key). Exceeding → HTTP 429 with a Retry-After header.

7. Security and your responsibilities

• Enable 2FA in /account → MFA (TOTP-based) — required for tenant owners.
• Rotate API keys regularly (recommended every 90 days).
• Do not use the production account for development — create a separate tenant for CI/testing once staging API is available.
• Report suspicious activity to security@alvo.energy.

8. Enforcement

On a confirmed AUP violation we apply a graduated response:

• **First low-severity violation**: email warning + 24h cooling-off (rate limit halved).
• **Repeat or serious violation**: temporary account suspension (24-72 hours) requiring written acknowledgment of compliance.
• **Egregious violation** (market manipulation, attempts to compromise other tenants, illegal content): immediate termination without refund + regulator notification.
• **Client-side security breach**: joint investigation with our security team; outcomes may include Alvo damages reimbursement.

9. Reporting + appeals

Noticed abuse by another user? Email security@alvo.energy with details (timestamp, IP, key identifiers — NOT full dumps). Anonymous reports accepted, but no follow-up.

Disagree with an enforcement decision? Appeal via legal@alvo.energy within 14 days.