Acceptable Use Policy (AUP)

1. Scope

1.1. This Acceptable Use Policy (“AUP”) governs the permitted use of the hosted services provided by Sync Motion GmbH (“Sync Motion”, “we” or “us”). It supplements our General Terms and Conditions, the applicable service description and any individual agreements.

1.2. The AUP applies to all hosted services provided by Sync Motion and the functions connected with them. This includes in particular:

• SFTP servers and managed volumes
• FTP/FTPS bridges
• managed MQTT brokers, including free broker instances
• Sync Motion Stack and services built on it
• credentials, keys, certificates and management interfaces
• backups, monitoring and other technical ancillary services

1.3. It applies to all customers and to every person a customer grants access to the booked services. The Customer is responsible for ensuring that its employees, administrators, contractors, connected systems and other authorized users also comply with this AUP.

2. Permitted use

2.1. The services may be used to exchange, transfer and store data and to operate lawful industrial and business applications. Permitted uses include in particular:

• file exchange with machines, controllers, partners, suppliers and customers
• transfer of telemetry, process, sensor and operational data via MQTT
• connecting PLCs, edge devices, gateways, SCADA, MES and ERP systems
• storing files directly related to the operated application or data exchange
• development, test and staging environments
• other contractually agreed purposes

2.2. Use must remain within the booked scope of services and comply with applicable law and the rights of third parties.

3. General obligations of the Customer

3.1. The Customer undertakes:

• to use the services exclusively for lawful purposes;
• to provide complete and accurate customer and contact details;
• to adequately protect credentials, passwords, keys, certificates and tokens and not to disclose them to unauthorized persons;
• to keep connected devices, clients, scripts and applications in a secure and up-to-date state;
• to remedy identifiable security vulnerabilities or compromised access without delay and to inform us about them;
• to take reasonable measures against abusive use of its access and connected systems;
• to respond to legitimate security or abuse inquiries from Sync Motion within a reasonable period;
• to obtain all permits, licenses and consents required for its activities and the transferred data.

4. Prohibited use

4.1. The services may not be used for unlawful, fraudulent, harmful or abusive purposes. The uses listed in Sections 4.2 to 4.7 are prohibited in particular.

4.2. Unlawful content. Storing, transferring or distributing content that violates applicable law. This includes in particular child sexual abuse material, unlawful extremist or terrorist content, unlawful threats or incitement to violence, content that infringes personality, data protection, trademark, copyright or other rights of third parties, and unlawful offers, goods or services.

4.3. Fraud and deception. Use for fraudulent or misleading activities, in particular phishing and credential theft, identity theft, fraudulent payment or investment offers, unauthorized impersonation of other companies, brands or persons, and circumvention of identity, security or payment controls.

4.4. Malware and attacks. Storing, distributing or operating malware, ransomware, spyware or other malicious code, botnets or command-and-control infrastructure, exploit kits, DDoS infrastructure, or systems for unauthorized access to third-party devices, accounts, networks or data. Port scans, vulnerability scans, brute-force attacks or other security testing against third-party systems or against Sync Motion's infrastructure are also prohibited unless the respective operator has given express authorization.

4.5. Spam and unsolicited communication. Use for sending or supporting spam, unsolicited advertising, bulk messages or other communication without the required consent.

4.6. Resource abuse. Any use that impairs the stability, security or availability of the services for other customers, in particular:

• cryptocurrency mining
• persistently exceptional CPU, memory, connection, message or I/O load outside the booked scope of services
• operating public proxy, VPN, relay or Tor exit services
• operating an MQTT broker as a public or anonymous messaging service for arbitrary third parties
• flooding topics, retained messages or connections, and connection or reconnect loops without reasonable back-off
• public file sharing or operating a managed volume as a general download or media distribution service
• password cracking
• load testing against systems for which no express authorization exists
• deliberate circumvention of technical restrictions, storage, connection or message limits, or security measures

4.7. Resale. Commercial resale, subletting or permanent transfer of the services to third parties requires the prior written consent of Sync Motion. Connecting the Customer's own customers, partners or suppliers to the Customer's data exchange does not constitute resale.

5. Critical applications

5.1. The services are intended for monitoring, data acquisition, analysis and data exchange of industrial plants. Transferring telemetry, process and operational data and using the services as a data source for dashboards, evaluations and notifications is expressly permitted.

5.2. The standard services are not intended for applications whose failure or delay can directly cause serious harm to life, health, the environment, property or critical infrastructure. Without a prior written agreement they may therefore not be used as a direct control, safety, interlock or emergency component in which a machine or plant depends on the availability or latency of the service without its own local safeguards.

5.3. The Customer ensures that its plants remain in a safe state even in the event of failure, delay or maintenance of the service.

6. Access and responsibility for third parties

6.1. The Customer is liable for all actions carried out through its access, credentials, keys, certificates, tokens or connected devices, regardless of whether they were performed by the Customer itself, its employees, contractors, partners or unauthorized third parties, to the extent the Customer is responsible for the unauthorized use.

6.2. The Customer undertakes in particular:

• to restrict access to authorized persons and systems;
• to remove or block access, keys, certificates and devices that are no longer needed;
• to use separate credentials for each connected device or system where possible;
• to protect credentials against unauthorized use;
• to stop identifiable abuse of its access or connected systems.

7. Monitoring and investigation of abuse

7.1. Sync Motion does not carry out a general prior review of the content of data transferred or stored by customers.

7.2. To the extent legally permissible and technically necessary, we are however entitled:

• to monitor the load and security of our systems;
• to evaluate technical log, connection and traffic data;
• to investigate security incidents and abuse reports;
• to inspect the affected access, files, topics or configurations where there are concrete indications;
• to request information and remediation of a violation from the Customer.

7.3. A review takes place only to the extent required to maintain security and availability, to investigate a possible violation or to fulfil legal obligations.

8. Measures in the event of violations

8.1. In the event of an actual or sufficiently substantiated suspected violation of this AUP, Sync Motion may, depending on the nature, severity and urgency, take in particular the following measures:

• inform the Customer and request remediation;
• apply technical protective measures such as rate limits or connection restrictions;
• temporarily block individual functions, access, keys, topics or content;
• restrict access to the affected services;
• stop harmful processes, disconnect affected clients or isolate compromised systems;
• temporarily suspend the service in full;
• terminate the contract in accordance with the contractual and statutory provisions;
• make legally required reports to the competent authorities.

8.2. In the event of acute security risks, ongoing attacks, fraud, phishing, malware, danger to third parties, impairment of other customers or serious legal violations, measures may be taken without prior notice.

8.3. Where the situation allows, we inform the Customer about the measure and give it the opportunity to respond or remedy the issue. Sync Motion's claims to remuneration remain unaffected by a suspension to the extent the Customer is responsible for the violation.

9. Reporting abuse

9.1. Indications of possible abusive use of a service provided by Sync Motion can be reported to office@sync-motion.com or via the contact details in the legal notice.

9.2. Where possible, a report should include the following information:

• the affected service, hostname, access or URL
• a description of the suspected violation
• date and time of the observation
• available evidence, log excerpts or screenshots
• contact details for possible queries

9.3. We review substantiated reports and take appropriate measures where necessary.

10. Changes to this AUP

10.1. Sync Motion may amend this AUP where this is necessary due to legal changes, new security requirements, technical developments or further development of the services offered.

10.2. The current version is published on the Sync Motion website. Existing customers are informed of material changes in an appropriate manner.