Ryft — Acceptable Use Policy
Last updated: October 6, 2026 Effective date: October 6, 2026
This Acceptable Use Policy (the "Policy") governs your use of Ryft, an API security testing desktop application ("Ryft" or the "Software"), published by Ryft Security, LLC ("we," "us," or "our"). This Policy is incorporated into and forms part of the Ryft End User License Agreement and Terms of Service (together, the "Terms"). Capitalized terms not defined here have the meaning given in the Terms.
Ryft is an offensive security testing tool. It can generate and send attack traffic — including vulnerability probes, fuzzing and brute-force requests, authorization and cross-identity (BOLA) tests, and intercepted or replayed traffic — to any target you direct it at. With that capability comes responsibility. Read this Policy in full before you use Ryft. Your use of Ryft constitutes your agreement to it.
Ryft is licensed and sold for professional and business use only, for authorized security testing. It is not offered to or intended for consumers. By using Ryft you represent that you acquire and use it in a business or professional capacity.
1. The Authorization Requirement (Binding)
1.1. You may use Ryft only against assets that you own, or that you have explicit, current, written authorization to test. This is the single most important rule in this Policy. There are no exceptions to it.
1.2. Definition of "authorization." For the purposes of this Policy, you have "authorization" to test a target only when all of the following are true:
(a) The authorization is granted by a person or organization with the actual legal authority to permit security testing of the target and of every system, network, account, and data store the testing will touch;
(b) The authorization is explicit and in writing (for example, a signed statement of work, a penetration-testing engagement contract, a rules-of-engagement document, a written internal approval from the asset owner, or the published terms of a bug-bounty or vulnerability-disclosure program that expressly permit the testing you intend to perform);
(c) The authorization is current — it is in force at the time you test and has not expired or been revoked; and
(d) The testing you perform falls within the defined scope of that authorization.
1.3. Definition of "scope." "Scope" means the specific boundaries of what you are permitted to test, as set out in your authorization. Scope typically includes: the exact systems, hosts, domains, APIs, endpoints, and accounts in bounds; the systems and data expressly out of bounds; the permitted testing techniques (for example, whether destructive, denial-of-service, or data-modifying actions are allowed); the permitted time windows; and any required notifications or points of contact. You must stay within scope at all times. Anything not clearly within scope is out of scope.
1.4. You are solely and fully responsible for determining, obtaining, documenting, and maintaining authorization and scope for every target you test, for the entire duration of your testing. This responsibility rests entirely with you. We do not grant you authorization to test anything, and nothing in Ryft, its documentation, its marketing, or these Terms is or constitutes authorization to test any particular target.
1.5. Ryft's authorization gate is a safeguard, not a grant of authority. Ryft includes an explicit in-application authorization gate and an "aggressive actions" gate that is off by default. Acknowledging a prompt, enabling a gate, or configuring Ryft in any way does not create, prove, or substitute for real-world legal authorization. These controls are reminders and friction to help you act deliberately; they do not make any use lawful or authorized.
1.6. Your authorization must expressly cover interception and traffic capture. Ryft can act as an intercepting proxy — it can install a local certificate authority on your device, decrypt TLS, and capture, inspect, modify, store, and replay traffic. The authorization you obtain under Section 1.2 must expressly permit this interception and traffic capture with respect to every system, network, account, and communication the testing will touch. The unauthorized interception, capture, or recording of communications is a distinct offense from unauthorized access, and it may violate wiretap and interception laws — including the U.S. federal Wiretap Act and the Electronic Communications Privacy Act (ECPA), U.S. state all-party-consent statutes, and foreign equivalents — even where you are otherwise authorized to access the target. Authorization to access a system does not by itself authorize intercepting, decrypting, or recording the communications of its users or of any third party; you are solely responsible for obtaining the consent that applicable interception law requires for every communication you capture.
2. Your Responsibilities
2.1. You are responsible for all activity conducted through your installation of Ryft and for all consequences of that activity.
2.2. Before testing any target, you must satisfy yourself that you have authorization and scope as defined in Section 1, and you must be able to produce evidence of that authorization if asked by the asset owner, a program operator, or a competent authority.
2.3. You must comply with all applicable laws, regulations, and contractual obligations in every jurisdiction relevant to you, to the target, and to the systems and data your testing may affect.
2.4. Bug-bounty and vulnerability-disclosure (VDP) programs. If you test a target under a bug-bounty program, a VDP, or any similar program, you must read and comply with that program's rules, scope, and safe-harbor terms. Program rules may be narrower than what Ryft is technically capable of; the program's rules govern. Testing outside a program's stated scope is unauthorized testing under this Policy, even if the organization runs a program for other assets.
2.5. You are responsible for configuring Ryft appropriately for your authorized scope — including whether to enable the "aggressive actions" gate — and for the volume, intensity, and nature of the traffic you generate.
3. Prohibited Uses (Non-Exhaustive)
The following uses of Ryft are strictly prohibited. This list gives examples of prohibited conduct; it is not exhaustive, and conduct not listed here may still violate this Policy, the Terms, or the law.
You must not use Ryft to:
3.1. Access or test without authorization. Probe, scan, fuzz, intercept, brute-force, enumerate, or otherwise test any system, API, network, account, or data that you do not own and are not currently and explicitly authorized in writing to test, or to test any such asset outside the authorized scope.
3.2. Violate computer-misuse and data-protection law. Engage in any activity that violates the United States Computer Fraud and Abuse Act (CFAA), the United Kingdom Computer Misuse Act, the EU and UK General Data Protection Regulation (GDPR), or any other applicable computer-crime, unauthorized-access, interception, wiretap, data-protection, privacy, or intellectual-property law anywhere in the world.
3.3. Attack third-party, shared, or multi-tenant systems without authorization. Direct testing at third-party systems, shared hosting or infrastructure, cloud control planes, upstream providers, content-delivery networks, or other tenants on shared infrastructure, where you do not have authorization covering those specific systems. Authorization to test your own asset does not extend to the infrastructure or co-tenants it shares.
3.4. Endanger critical, medical, or safety systems. Test critical infrastructure (such as utilities, energy, water, transportation, telecommunications, or financial-market systems), medical devices or healthcare systems, industrial control systems (ICS), SCADA, or other operational-technology systems, or any safety-of-life or safety-critical system, without specific, current, written authorization that expressly identifies and covers such systems and the testing techniques to be used against them. Ryft is not designed, intended, or licensed for use that could lead to death, personal injury, or severe physical or environmental damage. Even where you hold such authorization, you assume all risk of testing any such system, and you must not conduct testing that could foreseeably impair its safe or continued operation.
3.5. Cause denial-of-service or destruction without authorization. Perform denial-of-service or distributed-denial-of-service attacks, resource-exhaustion attacks, or any intentionally destructive, data-corrupting, data-deleting, or service-degrading action, unless such actions are expressly and specifically authorized in writing and in scope. Note that Ryft is non-destructive by default and that destructive capabilities are gated; enabling a gate does not authorize these actions.
3.6. Develop or distribute malware. Use Ryft to create, test, stage, deliver, or distribute malware, ransomware, backdoors, exploits intended for unlawful use, or other malicious code.
3.7. Steal, exfiltrate, or traffic in data. Exfiltrate, copy, retain, sell, publish, or otherwise traffic in data you are not authorized to access, including personal data, credentials, trade secrets, or other confidential information.
3.8. Harm others. Use Ryft to harass, stalk, defraud, extort, surveil, or otherwise harm any person or organization, or to further any criminal enterprise.
3.9. Circumvent the license or the Software. Bypass, disable, tamper with, or circumvent Ryft's licensing, activation, authorization gate, aggressive-actions gate, or any other access-control, safety, or anti-piracy mechanism; share, resell, or redistribute license keys except as the Terms permit; or use Ryft beyond the scope of the license you purchased (see the Terms for license scope, which is per device / per installation).
3.10. Misrepresent authorization. Falsify, forge, or misrepresent authorization, scope, identity, or affiliation in connection with any testing.
4. No Monitoring; No Control Over Targets
4.1. Ryft is a local-first application that runs entirely on your machine. We do not monitor, control, see, or have any ability to restrict what targets you select or what traffic you send. Ryft does not transmit your testing data, captured traffic, scan findings, or target information to us, and it contains no usage telemetry.
4.2. Because testing happens entirely under your control and on your own authority, you — not we — bear complete responsibility for ensuring every use is authorized and lawful. Our inability to observe your activity does not reduce your obligations under this Policy in any way.
5. Enforcement, Termination, and Cooperation
5.1. Violation is a material breach. Any violation of this Policy is a material breach of the Terms.
5.2. Termination. We reserve the right to suspend or terminate your license and your right to use Ryft, with or without notice, where we have a good-faith belief that you have violated this Policy or the Terms. Termination for violation does not entitle you to any refund (all sales are final; see the Terms).
5.3. Cooperation with law enforcement. We reserve the right, where we receive credible evidence of unlawful use of Ryft, to cooperate with law enforcement and other competent authorities and to respond to lawful legal process, consistent with our Privacy Policy and applicable law. Given our local-first, no-telemetry design, the information we hold is limited to seller-side records such as purchase and license data (see the Privacy Policy).
5.4. No waiver. Our failure to enforce any provision of this Policy is not a waiver of our right to do so later.
6. Changes to This Policy
We may update this Policy from time to time. The "Last updated" date above reflects the most recent version. Your continued use of Ryft after a change takes effect constitutes acceptance of the updated Policy.
7. Contact
Questions about this Policy may be sent to legal@ryftapi.com. General support questions may be sent to support@ryftapi.com.
This Policy is governed by the laws of Virginia, and any disputes are subject to the governing-law and venue provisions of the Ryft Terms of Service.