Policy
Acceptable use policy
This policy sets the limits on what you may send to, and generate with, the models on the Open LLMs API, and what happens when you cross them.
- Effective
- 20 August 2026
- Version
- 1.0
What this document says
Plain-English summaries, provided as a reading aid only. They are not part of the agreement — the numbered clauses below are the binding text.
Child sexual abuse material, non-consensual imagery, malware, fraud and eight more are barred outright.
Each model's own licence and use restrictions apply to you as an enforceable term of this policy.
Sharing, reselling, or evading limits with your API key is a breach, and the key gets blocked.
We do not screen or filter the content of requests or responses before they are served.
We rate-limit, block keys, suspend and terminate accounts for breach, without warning you first.
A report is acknowledged within 24 hours and decided within 15 days.
This policy is part of your agreement
In short — not binding
This policy covers every request made with an API key issued to your account, whoever sent it.
Binding text
This Acceptable Use Policy forms part of the Terms of Service. Words defined there carry the same meaning here, and “the Service” means the Open LLMs API, the models served through it, and the accompanying website and dashboard.
It applies to you, to anyone using your account or an API key issued to your account, and to any application, agent, or end user whose traffic you route through the Service. You are responsible for every request made with a key issued to your account, including requests made by your own customers and by automated systems you operate.
You must be at least 18 years old to use the Service. If you make the Service, or any model served through it, available to your own users, you must impose terms on those users that are at least as restrictive as this policy, and you must enforce those terms.
In short — not binding
Twelve categories of content and conduct are barred, and child sexual abuse material has no exception.
Binding text
You must not use the Service, and must not use anything the Service generates, for any of the following. The cards restate the categories in short form; the numbered list is the operative text.
Child sexual abuse material
Barred absolutely. No research, testing or red-teaming exception.
Non-consensual intimate imagery
No intimate depiction of a real person without that person's consent.
Harassment and threats
No abuse, doxxing, intimidation or incitement aimed at a person.
Malware and intrusion
No exploit code, ransomware, or support for unauthorised access.
Fraud and phishing
No scam scripts, forged documents, phishing or money laundering.
Impersonation
No output passed off as a real person, brand or authority.
Disinformation and elections
No coordinated inauthentic content and no election manipulation.
Spam and bulk messaging
No unsolicited bulk messages, fake reviews or search-engine filler.
Surveillance and biometrics
No covert monitoring and no biometric categorisation of people.
Regulated advice and decisions
No professional advice, and no automated decisions about a person.
Safety-system evasion
No jailbreaking and no defeating any model's safety behaviour.
Weapons and critical infrastructure
No weapons work, infrastructure attacks or sanctions breaches.
- Child sexual abuse material. You must not generate, request, solicit, upload, transmit, store, or attempt to obtain any material that depicts, describes, or sexualises a person under 18, including text, images, audio, and synthetic or age-regressed depictions of adults. This prohibition admits no exception, including for research, evaluation, classifier training, or red-teaming.
- Non-consensual intimate imagery. You must not generate or distribute intimate, nude, or sexual depictions of an identifiable person without that person's consent, including by editing, face-swapping, or voice-cloning an existing image, recording, or likeness.
- Harassment and threats. You must not target an identifiable person or group with abuse, threats, intimidation, sexual harassment, or the publication of private information, and you must not generate content that incites violence against a person or encourages self-harm.
- Malware and intrusion. You must not generate, refine, obfuscate, or debug malicious code, exploits, ransomware, keyloggers, botnet tooling, or intrusion payloads, and you must not use the Service to plan or support unauthorised access to any system, network, device, or account.
- Fraud and phishing. You must not generate phishing messages, fraudulent invoices, forged identity or financial documents, scam scripts, or any content designed to deceive a person into parting with money, credentials, or personal data. You must not use the Service to launder money or to finance terrorism.
- Impersonation. You must not present output as the words, voice, likeness, or endorsement of a real person, organisation, or public authority without their authorisation, and you must not generate content that falsely claims to originate from the operator.
- Disinformation and elections. You must not generate or operate coordinated inauthentic content at scale, including sock-puppet accounts, fabricated news reports, or fabricated evidence, and you must not generate material intended to suppress votes, misstate voting procedures, or manipulate an election or referendum in any country.
- Spam and bulk messaging. You must not generate or send unsolicited bulk email, messages, comments, reviews, or search-engine content, and you must not generate content that breaches the rules of the platform it is posted to or the anti-spam law of the recipient's country.
- Surveillance and biometrics. You must not use the Service for unlawful surveillance, for covert monitoring of individuals, for emotion inference in a workplace or an educational setting, or to categorise or infer a person's race, caste, religion, political opinion, trade-union membership, health, sexual orientation, or gender identity from biometric, facial, voice, or behavioural data.
- Regulated advice and decisions. You must not present output as legal, medical, financial, tax, or psychological advice given by a qualified professional, and you must not use output to make or to automate a decision about a person's credit, employment, housing, insurance, education, immigration status, or access to healthcare or public benefits without qualified human review and a lawful basis.
- Safety-system evasion. You must not attempt to bypass, disable, or manipulate the safety behaviour, refusal behaviour, system prompt, or usage restrictions of any model served through the Service, and you must not use the Service to develop or test material intended to defeat the safety systems of any other model or provider.
- Weapons and critical infrastructure. You must not use the Service in the design, development, or deployment of weapons, including chemical, biological, radiological, nuclear, or high-yield explosive weapons, to plan or support an attack on critical infrastructure, or in breach of applicable export-control or sanctions law, including the Foreign Trade (Development and Regulation) Act, 1992 and the SCOMET list made under it.
These prohibitions apply to the prompt you send, to any file, image, or audio you upload, and to the output you obtain, whether you publish that output or not.
In short — not binding
Your API key is yours alone: no sharing, no reselling, no dodging limits, no attacks on the platform.
Binding text
The Service is metered per request against a prepaid balance and is shared with other customers. You must not do any of the following.
Rate-limit evasion
No spreading traffic across keys or accounts to get around a limit.
Credential sharing
Keys belong to one account. You answer for every request on yours.
Resale and sublicensing
No reselling the API and no fronting it as your own infrastructure.
Extraction and scraping
No weight extraction and no unpermitted benchmark harnesses.
Denial of service
No traffic aimed at degrading the Service for other customers.
Metering circumvention
No tampering with metering, billing, or the prepaid wallet.
- Rate-limit evasion. You must not spread traffic across multiple accounts, API keys, IP addresses, or identities in order to exceed a limit applied to you, and you must not register a new account or key to escape an enforcement action taken under clause 7.
- Credential sharing. You must not disclose, publish, embed in a distributed client, or otherwise share an API key. Keys are issued to one account, and you are liable for every request made with a key issued to yours. You must report a compromised key so that it can be blocked.
- Resale and sublicensing. You must not resell, sublicense, rent, or otherwise provide the Service to a third party as a competing inference API, and you must not present the Service as your own infrastructure, except under a separate written agreement with the operator.
- Extraction and scraping. You must not use the Service to extract, reconstruct, distil, or approximate the weights of any model, you must not run automated benchmark, crawl, or scraping harnesses against the Service without the operator's prior written permission, and you must not use output to train or fine-tune another model where the licence of the model you called forbids it.
- Denial of service. You must not send traffic designed or reasonably likely to degrade the Service for other customers, probe or attack the platform, its providers, or its infrastructure, or interfere with request routing, metering, or logging.
- Metering circumvention. You must not tamper with usage metering, billing, or your wallet balance, use a payment instrument you are not authorised to use, or raise a payment dispute in place of the refund process published in the billing policy.
The operator does not publish a fixed request-rate figure and may apply a limit to an individual API key at any time, including as an enforcement action under clause 7.
In short — not binding
Every model carries its own licence, and that licence's use restrictions bind you as a term of this policy.
Binding text
Every model served through the Service is licensed to the operator by a third party on that third party’s own terms. Several of those licences treat making a model available over an API as distribution, and require the licensor ’s use restrictions to be enforceable provisions of the agreement between the operator and you. This clause is that provision.
You agree that:
- The licence governing each model you call, together with any acceptable-use, prohibited-use, or usage policy that the licence incorporates, applies to your use of that model and of its output in addition to this policy. Those restrictions are incorporated into this policy by reference and are enforceable terms of your agreement with the operator.
- A breach of a model's licence, or of a prohibited-use policy that its licence incorporates, is a breach of this policy and of the Terms of Service, and the operator enforces it under clause 7.
- Where a licence requires attribution, a licence copy, a naming convention, or notice to downstream recipients, you must satisfy that requirement in any product or service you build on that model or its output.
- Where you make a model's functionality available to your own users, you must impose these restrictions on them in terms at least as restrictive as this policy, and you must enforce those terms.
- Trade-compliance and export-control obligations imposed by a model's licence apply to you as terms of this policy.
- The licence recorded for each model in the live catalogue is published at Model licences. Where the catalogue records no licence for a model, the operator makes no representation about the terms on which that model may be used, and you must satisfy yourself before you call it.
- The operator may stop serving a model, restrict how it is used, or withdraw your access to it, at any time and without notice, where its licence or its licensor requires that.
In short — not binding
Indian law bars ten categories of information outright, and several kinds of content are criminal offences.
Binding text
The operator is established in India and provides the Service from India. Rule 3(1)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 requires the operator to inform you not to host, display, upload, modify, publish, transmit, store, update, or share information in the categories below. You must not send information in those categories to the Service, and you must not use the Service to generate it. The information:
- belongs to another person and to which you do not have any right;
- is defamatory, obscene, pornographic, paedophilic, invasive of another person's privacy including bodily privacy, insulting or harassing on the basis of gender, libellous, racially or ethnically objectionable, relating to or encouraging money laundering or gambling, or otherwise inconsistent with or contrary to the laws in force;
- is harmful to a child;
- infringes any patent, trademark, copyright, or other proprietary right;
- violates any law for the time being in force;
- deceives or misleads the addressee about the origin of the message, or knowingly and intentionally communicates any misinformation or information which is patently false and untrue or misleading in nature;
- impersonates another person;
- threatens the unity, integrity, defence, security, or sovereignty of India, friendly relations with foreign States, or public order, or causes incitement to the commission of any cognisable offence, or prevents investigation of any offence, or is insulting to another nation;
- contains a software virus or any other computer code, file, or program designed to interrupt, destroy, or limit the functionality of any computer resource;
- is patently false and untrue, and is written or published in any form with the intent to mislead or harass a person, entity, or agency for financial gain or to cause any injury to any person.
Content in several of these categories is also a criminal offence under the Information Technology Act, 2000.
| Row label | What it prohibits |
|---|---|
| Section 66Computer-related offences | Dishonestly or fraudulently doing any act referred to in section 43, including unauthorised access, damaging data, and introducing a computer contaminant. |
| Section 66CIdentity theft | Fraudulently or dishonestly using another person's electronic signature, password, or other unique identification feature. |
| Section 66DCheating by personation | Cheating by personation using a computer resource or a communication device. |
| Section 66EViolation of privacy | Capturing, publishing, or transmitting the image of a private area of any person without that person's consent. |
| Section 66FCyber terrorism | Acts intended to threaten the unity, integrity, security, or sovereignty of India, or to strike terror in the people. |
| Section 67Obscene material | Publishing or transmitting obscene material in electronic form. |
| Section 67ASexually explicit material | Publishing or transmitting material containing a sexually explicit act in electronic form. |
| Section 67BChild sexual abuse material | Publishing, transmitting, creating, collecting, browsing, or downloading material depicting children in a sexually explicit act. Reporting such material is additionally mandatory under the Protection of Children from Sexual Offences Act, 2012. |
The operator complies with a lawful order of an Indian court or of a lawfully authorised agency. Clause 6 states what the operator discloses and preserves.
In short — not binding
We do not screen prompts, we store content only if you switch it on, and we disclose records when law requires it.
Binding text
The operator does not screen, filter, or moderate the content of requests or responses before they are served. No automated content classification runs in the request path, and the operator does not read your prompts as a matter of course.
Usage metadata for every request, including the model called, token counts, timing, and cost, is recorded to meter and bill your usage, and is retained for 30 days. Request and response content passes through an internal processing queue on its way to metering and, for accounts that have opted in, to storage. The privacy notice describes that flow.
The content of your requests and responses is written to the operator’s database only for accounts that have turned that setting on. The setting is off by default. A stored snapshot has credentials, email addresses, and card-number patterns masked, is held together with your IP address and user agent, and is deleted 14 days after capture. Turning the setting off deletes every snapshot already stored for your account.
Operators of the platform can read stored snapshots across accounts for support and for abuse investigation. Those accesses are permission-gated and logged. Where content is not stored, an abuse investigation runs on usage metadata and on the report the operator received, not on your prompts.
The operator discloses account, usage, and stored content information to a court, a law-enforcement agency, or a government authority where it is required to do so by law or by a lawful order, and preserves the information and associated records available to it for at least 180 days, or for longer where an agency or a court so directs, under rule 3(1)(g) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Where such an order requires it, the operator disables access to the information within 36 hours under rule 3(1)(d) of those Rules.
Where the operator becomes aware of apparent child sexual abuse material, it preserves the material and the associated account records and reports them to the appropriate authority. Reporting is mandatory under the Protection of Children from Sexual Offences Act, 2012 and is not a step the operator can waive.
In short — not binding
We limit, block, or terminate access for a breach, and you can appeal to the Grievance Officer.
Binding text
On becoming aware of a breach, or of a credible report of one, the operator may take any of the actions below. Which action is taken depends on the severity of the breach and on whether it repeats. The operator is not required to warn you first.
| Row label | First response | If it repeats | Appeal route |
|---|---|---|---|
| Rate or volume abuseClause 3.1, 3.5, 3.6 | A per-key request-rate limit is applied to the API key. | The key is blocked and account access is suspended. | Clause 8 |
| Credential and access misuseClause 3.2, 3.3 | The key is blocked, and you are asked to issue a replacement. | The account is terminated. | Clause 8 |
| Prohibited content or conductClause 2.2 to 2.12 | Written notice, and the key is blocked where the conduct is ongoing. | The account is terminated, and the breach is reported where the law requires it. | Clause 8 |
| Child sexual abuse materialClause 2.1 | Immediate termination, preservation of records, and a report to the authorities. | Not applicable. The first response is termination. | None. The decision is final. |
| Model-licence breachClause 4 | Written notice, and access to the affected model is withdrawn. | The account is terminated. | Clause 8 |
| Unlawful content under Indian lawClause 5 | Access to the information is disabled on a lawful order, within 36 hours. | The account is terminated. | Clause 8 |
Where content of yours is stored under clause 6, the operator deletes the content that gave rise to the breach. Suspension or termination does not discharge amounts already due, and the operator may terminate your account for a breach committed by a user, customer, or agent whose traffic you route through the Service.
To appeal, write to the Grievance Officer using the route in clause 8. The operator acknowledges an appeal within 24 hours of receipt and decides it within 15 days of receipt.
At least once a year the operator informs registered users of this policy, the Terms of Service, and the privacy notice, and of the consequences of not complying with them, which include termination of access and removal of non-compliant information.
In short — not binding
Send a report to the Grievance Officer: acknowledgement within 24 hours, decision within 15 days.
Binding text
Gather the evidence
The account, API key prefix, or message concerned, the date and time in UTC, and a copy of the content.
Send it to the Grievance Officer
Use the routes published on the Contact page, and name the category from clause 2 or clause 5.
Track the clock
Acknowledgement within 24 hours, decision within 15 days.
- [email protected]
- Reporting route
- Contact and grievance routes
- Acknowledgement
- Within 24 hours of receipt
- Decision
- Within 15 days of receipt
Anyone may report content or conduct that breaches this policy. The operator does not charge for a report and does not require the person reporting to hold an account.
A complaint made by an individual, or by a person acting on that individual’s behalf, about material that shows the individual nude, in a sexual act, or in an intimate depiction, including material that is impersonated or digitally altered, is acted on within 24 hours of receipt, under rule 3(2)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
A complaint about material that infringes intellectual property must identify the protected work, the material complained of, and the complainant’s authority to act. Making a report the person knows to be false is itself a breach of this policy.
In short — not binding
The cards and headings are reading aids; the numbered text is what binds you.
Binding text
Clause numbers, clause titles, the summary cards at the top of this page, and the short summary beside each clause are provided for convenience. They are not part of the agreement and do not affect the meaning of the binding text.
The operator publishes a change to this policy on this page with a new effective date and version. A material change takes effect 30 days after the operator gives notice by email to the address registered on your account and by a notice on this page. Continuing to use the Service on or after the effective date is acceptance of the change.
If a provision of this policy is held to be unenforceable, the rest of it continues in force. This policy survives termination of your account to the extent needed to give effect to clauses 6, 7, and 8.