GAL Runtime Ltd — Acceptable Use Policy
Version 1.1, October 21, 2026
Published October 21, 2026. Applies as specified in the document.

Published October 21, 2026. Existing agreements remain unchanged. Commercial terms apply only when expressly accepted or incorporated into a signed order. Clear boundaries for distributing configurations responsibly. Built for authorized engineering, security and defense workflows, with deployment-specific controls for restricted data.

1. Purpose and scope

This policy describes permitted use of GAL Runtime Ltd’s configuration distribution services . It applies when its version is incorporated into your accepted Order or agreement. It covers authorized users, machine identities and integrations operating for Customer. It does not replace an agreed DPA, alter an open-source license or expand GAL’s access to your systems.

2. Use systems you are authorized to manage

Permission comes first. Distribute only configurations you have the right to use, to systems and recipients you are authorized to manage. Do not impersonate an approver, forge a signature or installation report, misuse another party’s keys, bypass tenant boundaries, or use GAL to obtain unauthorized access.

Safe operation. Do not deliberately distribute malware, steal credentials, disrupt others’ systems, defeat agreed access controls or conceal an unauthorized deployment. Customer remains responsible for reviewing its bundle contents and assessing changes before wider rollout.

3. Security research and testing

Legitimate defensive work and testing on systems you control or are authorized to assess are not prohibited merely because the organization works in security or defense. Tests affecting GAL-operated systems, other tenants or shared infrastructure require GAL’s prior written agreement on targets, methods, timing and handling of findings.

Report suspected vulnerabilities to shay@gal.run with a non-sensitive description and request an appropriate channel before transmitting secrets or exploit material. Do not access another customer’s data to demonstrate a finding. This policy does not itself create a bug-bounty program or grant immunity from applicable law.

4. Restricted data and regulated uses

Ordinary hosted access is not an approved channel for classified information, controlled defense technical data or other specially regulated material. Such processing requires a separate written scope, validated controls and any legally required approvals before the material is supplied. Customer must assess the restrictions applicable to the actual data and recipients.

No use may violate applicable sanctions, export controls, privacy law or third-party rights. Do not use the service to facilitate unlawful violence, exploitation, fraud or surveillance. Any safety-critical deployment requires a separately agreed and validated scope; GAL is not the sole safeguard against injury or physical harm.

5. Respect the agreed service limits

Observe the machine, user, request, storage and other limits stated in your Order. Do not evade those limits by misrepresenting identities or deliberately overloading shared resources. Lawful automation through supported interfaces is permitted within your agreed scope. Wider resale, managed-service use or access for affiliates must be agreed expressly.

6. Reporting and proportionate response

Notify shay@gal.run of suspected misuse or compromised access and cooperate in containing an incident affecting your workspace. Do not include credentials in the initial message.

GAL may limit affected access as permitted by the agreement to address a substantiated risk or breach. Notice, cure and restoration follow the agreement and applicable law. This policy does not grant blanket permission to disclose confidential reports, inspect customer-controlled systems or disregard a DPA. Changes require the agreement’s applicable notice and acceptance process.