Skip to content
Hackiwi
Get started

Legal - Acceptable use

Acceptable Use Policy

Last updated: September 2026

Hackiwi sends deliberately deceptive email as a training exercise. The line between that and an attack is drawn by two things: the recipients are your own people, and the sending domain is one you have verified you own. This policy states those limits and the rest of what the platform may and may not be used for.

Scope

Clause 1.1. This Acceptable Use Policy (the "Policy") governs use of the Hackiwi platform and forms part of the Terms of Service. Terms defined there have the same meaning here.
Clause 1.2. It binds the Customer and every User the Customer authorises. The Customer is responsible for its Users' compliance.
Clause 1.3. This Policy exists because Hackiwi sends deliberately deceptive email. The difference between a legitimate security exercise and an attack is who receives the message and who owns the domain it came from. Those two limits are not negotiable.

Permitted uses

You may use Hackiwi for:

  • internal security awareness training for your own employees and contractors;
  • phishing simulations sent only to people within your own organisation;
  • simulations sent only from domains you have verified you own within the platform;
  • OSINT checks on domains you own and on the email addresses of your own employees.
Clause 2.1. "Your own organisation" means the legal entity that holds the subscription and its affiliates, and the employees and contractors of those entities. It does not extend to customers, suppliers, candidates, partners, or members of the public.
Clause 2.2. Where a group of companies shares one subscription, each entity within scope must have authorised the exercise.

Prohibited uses - phishing simulations

You must not:

  • send simulations to anyone outside your organisation;
  • send from domains you do not own or have not verified;
  • use simulation templates to conduct an actual phishing attack;
  • run simulations targeting protected characteristics - including race, religion, gender, disability, age, sexual orientation, pregnancy, or trade union membership;
  • run simulations designed to cause psychological harm.

What the last two mean in practice

Clause 3.1. A simulation must not select its recipients by reference to a protected characteristic, nor use content that demeans or singles out a group defined by one.
Clause 3.2. Lures that a reasonable person would find cruel rather than instructive are prohibited. Examples include fabricated notices of redundancy or dismissal, fabricated bonus or salary awards, fabricated bereavement or medical emergencies, and fabricated disciplinary or immigration proceedings. A simulation should teach recognition, not inflict distress.
Clause 3.3. You must not use the platform to collect real credentials. The platform records only that a submission occurred and never stores what was submitted; attempting to circumvent that design is a material breach.
Clause 3.4. You must not impersonate a third-party brand in a way that infringes its trade marks, or a named individual in a way likely to damage them, beyond what is necessary for a realistic exercise.
Clause 3.5. You must not use simulation results as the sole basis for a disciplinary sanction against an individual. Simulation data is collected for awareness purposes; see section 4 of the Privacy Policy.

Prohibited uses - general

You must not:

  • attempt unauthorised access to other organisations' data;
  • carry out bulk API scraping or data export;
  • resell or white-label the Service without written permission;
  • use the Service in violation of applicable law.

Platform integrity

Clause 4.1. You must not probe, scan or test the vulnerability of the platform or circumvent its authentication, authorisation, rate limiting or tenancy boundaries, except under a written authorisation from us. To report a vulnerability you have found, write to [email protected]; good-faith reports are welcome.
Clause 4.2. You must not interfere with the operation of the Service, place an unreasonable load on it, or use automated means to access it other than through documented interfaces.
Clause 4.3. You must not use the Service to send unsolicited bulk email of any kind, to distribute malware other than inert simulation artefacts within your own organisation, or to host or transmit unlawful content.
Clause 4.4. You must not direct scanning, OSINT or monitoring features at infrastructure you do not own or are not authorised to test.
Clause 4.5. You must not misrepresent your identity or authority when creating an account, verifying a domain, or requesting support.

Domain verification and sending controls

Clause 5.1. The phishing simulator will send only from a domain the organisation has verified it controls. This is enforced by the platform, not merely promised here.
Clause 5.2. The simulator is available only to verified organisations. It is not available to individual or family accounts. Everyone can learn to recognise phishing for free; what is restricted is the ability to send it.
Clause 5.3. You must keep your verified domain list accurate and remove domains you no longer control.
Clause 5.4. Attempting to bypass domain verification, or verifying a domain you do not control, is a material breach of the Terms of Service and may constitute a criminal offence.

Employment law and works councils

important
Customers are responsible for ensuring phishing simulations comply with applicable employment law and works council agreements. In some European jurisdictions employees must be informed that simulations may occur. Hackiwi recommends consulting employment counsel before deploying simulations in regulated jurisdictions.
Clause 6.1. Running simulations against employees is a form of monitoring. In a number of European jurisdictions this engages obligations that sit with you as employer, not with us as your processor.
Clause 6.2. Depending on where your people work, those obligations may include:
  • informing employees in advance that simulations may occur, generally without disclosing their timing or content;
  • consulting or obtaining the consent of a works council, employee representative body or trade union - in the Netherlands, for example, the works council has a right of consent over personnel monitoring arrangements under the Wet op de ondernemingsraden;
  • completing a data protection impact assessment before systematic monitoring begins;
  • setting out in an internal policy how results will and will not be used.
Clause 6.3. You warrant that you have met these obligations before running a simulation. Section 12 of the Terms of Service sets out the corresponding indemnity.
Clause 6.4. We recommend a written internal position that simulation results are used in aggregate for awareness, and not as evidence in individual performance or disciplinary processes. That position is easier to hold if it is decided before the first campaign rather than after it.

Reporting abuse

Clause 7.1. If you believe Hackiwi is being used in breach of this Policy - including if you have received a simulated phishing message from an organisation you do not work for - report it to [email protected].
Clause 7.2. Include the message headers where you can. We investigate every report, and we will act on the account responsible.
Clause 7.3. Vulnerability reports about the platform itself also go to that address. We do not pursue legal action against researchers who act in good faith, stay within their own tenant, and give us a reasonable opportunity to fix what they find.

Consequences of violation

Clause 8.1. Violation of this Policy may result in suspension or termination of the account.
Clause 8.2. Where we reasonably believe a breach is occurring and that continued operation would cause harm, we may suspend a feature or the whole account immediately and without prior notice, under section 10.3 of the Terms of Service. We will tell you what happened and what is needed to restore service as soon as we reasonably can.
Clause 8.3. Serious violations may be reported to the appropriate authorities. Sending deceptive email to people outside your organisation, or from a domain you do not own, may constitute a criminal offence in the jurisdictions where the recipients are, and we will cooperate with lawful requests from law enforcement.
Clause 8.4. We will normally give notice and an opportunity to remedy a breach that is not causing ongoing harm. Repeated breaches, or any breach of section 3 or section 5, may lead to termination without a further opportunity to remedy.

Changes and contact

Clause 9.1. We may update this Policy as the platform and the threat landscape change. The date at the top of this page shows when it was last revised, and we will give at least 30 days' notice of material changes to the administrative contact on the account.
Clause 9.2. Questions about whether a planned exercise is permitted are welcome before you run it, at [email protected]. Asking first is always cheaper than a suspension.
Legal entity
Hackiwi B.V.

This document was prepared in good faith. Hackiwi recommends that customers seek independent legal advice regarding their own compliance obligations.