Acceptable use
Acceptable Use Policy
Effective date 2026-09-06Last updated 2026-09-06
This policy is part of the Terms of Use. It applies to everyone who touches an exercise — facilitators, participants, and anyone acting under an account or a join link. It is short because the rules that matter are short.
The one rule everything else follows from: TTX Commander is for simulated content. Text you enter during an exercise is recorded in the exercise record and transmitted to a third-party AI provider outside your environment. Write as if the room, the record, and an outside service will all see it — because they will.
Do not put real secrets or real personal data into an exercise
Never type, paste, upload, or dictate into an exercise:
- real credentials — passwords, API keys, tokens, private keys, certificates, session cookies, recovery codes, or anything else that would grant access to something;
- live production secrets — connection strings, internal hostnames or addresses you would not publish, configuration that reveals how to reach a real system;
- real customer personal data — names, contact details, account numbers, identifiers, or any other data about actual people;
- regulated data — protected health information, cardholder data, financial account data, biometric data, government identifiers, classified or export-controlled material, or anything else carrying a specific legal handling obligation;
- anyone else’s confidential material that you are not free to disclose.
Three things make this rule non-negotiable rather than cautious. One: exercise text is transmitted to Anthropic so the game master can respond, so it leaves your environment the moment you send it. Two: the exercise record is append-only and is kept until you ask us to delete it — there is no way to quietly take a line back. Three: the after-action report is built from that record and is meant to be handed to auditors and customers. A real secret typed into a turn becomes a real secret in a filed report.
Use invented values instead. A fictional hostname, a fictional customer, a made-up account number — the exercise works exactly as well, because the point is the decision, not the data.
If something real does get typed in, tell us at [email protected] and treat the underlying secret as exposed: rotate it. Do not wait for us to reply first.
Do not use the service to prepare a real attack
TTX Commander exists to rehearse defence. You must not use it to plan, rehearse, script, or refine an attack against systems, networks, accounts, or people you do not own and are not explicitly authorised in writing to test. Running an exercise is not authorisation to test anything, and an exercise is not a penetration test.
Do not try to make the game master produce attack instructions
The game master is instructed to narrate the effects of an incident — what people observe, what stakeholders do, what the consequences are — and not attacker technique, tooling, commands, or credential handling. You must not attempt to work around that: no prompting, role-play framing, scenario authoring, or repeated rephrasing intended to extract operational instructions for compromising a system, building or deploying malware, or evading detection. Attempts to do so are logged in the exercise record and are grounds for immediate suspension.
General conduct
You must not:
- use the service for anything unlawful, or to harass, threaten, defame, or impersonate anyone;
- upload or generate malware, or use the service to distribute, host, or stage it;
- share a join link outside the group of participants it was issued for, or use a link that was not issued to you;
- attempt to reach sessions, organisations, or data that are not yours, or probe, scan, or test the service’s own security without our written permission;
- interfere with the service — flooding it, circumventing rate or usage limits, scraping it, or reverse-engineering it;
- present a report or a score as a certification, an audit result, or an endorsement by us or by any accreditation body;
- run an exercise for participants under 18, or for participants who have not been told the content is an AI-generated simulation.
Enforcement
We may investigate suspected breaches, and we may suspend or terminate an account or a session over one. Where the breach is serious — an attempt to use the service against a real target, or to extract operational attack instructions — we may act immediately and without notice, and we may report it where the law requires.
Reporting a problem
Something real was entered into an exercise, or a privacy concern: [email protected]
Abuse, or anything else about this policy: [email protected]