Public passive mode, governed authorized deeper access, and the operating boundaries for the product family.

Permitted use

What the product is meant to support

• Use the tool only for domains you are authorized to review or for passive informational analysis where that use is appropriate.
• Every anonymous request starts in passive_public and stays limited to public DNS, HTTPS, TLS, visible headers, indexing signals, trust files, and a tightly capped set of same-host public pages.
• authorized_deep is available only when verified ownership, an active authorized engagement, and the right approvals exist for the reviewed domain or account.
• In authorized_deep, only read-only connectors, approved trusted exports, monitoring or history context, and governed operational evidence may deepen the review.

Prohibited use

What the product is deliberately blocked from doing

• No exploit attempts, brute-force discovery, hidden-path enumeration, password spraying, malware simulation, or authenticated interaction in the public lane.
• No anonymous or unapproved use of connectors, uploads, or authorized_deep workflows.
• No following of third-party domains discovered in page content and no requests to localhost, private IP ranges, or metadata endpoints.
• No attempts to repurpose the tool as a penetration-testing, infrastructure-mutation, or offensive platform.

Data handling

How private access, approved evidence, and audit controls are handled

• Only the minimum required request details are collected to run the review, deliver private access, maintain consent records, and support abuse controls.
• Private results remain behind opaque tokens plus one-time email verification and stay noindex, noarchive, nofollow, and out of sitemap discovery.
• Trusted artifacts or exports enter quarantine first and remain blocked until scanner or manual review plus approved_for_parse controls allow structured extraction.
• Monitoring, alerting, approvals, and audit traces may be retained for authorized workflows so KMayer can explain what changed, why an alert fired, and how evidence was used.

Retention, monitoring, and audit

Results follow conservative retention defaults unless a KMayer administrator changes that setting. Where monitoring, history, or authorized workflows are enabled, the system may also retain change events, alert context, approvals, and audit traces so recurring behavior stays explainable instead of opaque.

Related policies

The tool should be read alongside KMayer’s Privacy Policy, Cookie Policy, and Terms and Conditions. Those pages govern the broader site relationship while this page explains the tool-specific operating rules.