Acceptable Use Policy: OpenWAF Browsers addendum (draft)

Last updated: October 29, 2026

This is an English translation provided for convenience. In case of any discrepancy, the Spanish version prevails.

Pending legal review. This addendum describes the rules we apply to OpenWAF Browsers today. It has not yet been reviewed by a lawyer and may change.

In short

OpenWAF Browsers gives your AI agents real browsers that say they are agents. Do not use them to get past the rules of the sites they visit.
No credential stuffing, no bypassing logins, paywalls or CAPTCHAs, no fake accounts or fake engagement, no attacks.
We log the metadata of every request the browsers make, to handle abuse.
We may suspend or terminate keys and organizations without notice when they are abused.
Report abuse to abuse@openwaf.dev.

1. Scope

This addendum adds rules to the Acceptable Use Policy for OpenWAF Browsers, the browser sandbox for AI agents of OpenWAF Cloud, operated by AI Services LLC. It applies to every organization that has access to OpenWAF Browsers, to its members, to its API keys and to every agent, script or person that uses those keys. Everything in the Acceptable Use Policy and the Terms of Service still applies; where this addendum is stricter, it prevails for OpenWAF Browsers.

The organization is responsible for what its agents do with the browsers, including actions an agent takes on its own.

2. Prohibited uses

You must not use OpenWAF Browsers, or let an agent use it, for:

credential stuffing, password spraying, account takeover, or logging in to accounts you are not authorised to use;
getting around access controls: logins, paywalls, geographic restrictions, rate limits, bot challenges or CAPTCHAs, including by passing them to people or to third-party solving services;
creating accounts in bulk, or producing fake engagement: reviews, ratings, votes, comments, clicks, views, followers, sign-ups or purchases that do not come from a real decision of a real person;
scraping or crawling a site where its terms of use or its robots.txt forbid that kind of automated access, or collecting personal data without a legal basis;
spam, fraud, scams, phishing, distributing malware, or creating, storing or sending illegal content;
attacking or scanning third parties: denial of service, vulnerability scanning, intrusion attempts or load tests against systems you do not own or have no written permission to test;
getting around the egress proxy or its rules, or using the browsers to reach private, internal or cloud metadata addresses;
any use that is illegal under the law that applies to you, to us or to the site you visit.

3. Agents must not hide who they are

OpenWAF Browsers runs real Google Chrome without fingerprint spoofing, residential proxies or CAPTCHA solving, and signs requests with Web Bot Auth by default so that sites can identify the agent. You must not use it to hide your identity or your agent’s, or to make automated traffic look like a person’s.

An admin can turn Web Bot Auth signing off for the organization. Turning it off does not permit impersonating people, other agents or organizations, or any use this addendum forbids.

4. What we log

Every request from the browsers goes through our egress proxy. For each one we log its metadata: time, key, session, method, host, port, whether it was allowed or denied and why, status, bytes sent and received, and duration. We use this log, the usage counters and the session records to run the service, to enforce quotas and this addendum, and to handle abuse reports. The egress log is also visible to the organization in the dashboard, the API, the CLI and MCP.

Recordings are made only when the organization asks for them. Session files, recordings included, are kept for 7 days. How we process personal data is described in the Privacy Policy.

5. Suspension and termination

We may disable a key, stop its sessions, suspend OpenWAF Browsers for an organization, or terminate its access, at any time and without notice, when we see or are told about abuse or a breach of this addendum, or when a use puts the service or other people at risk. Access to OpenWAF Browsers is given on approval during the public beta and can be withdrawn. We may also preserve the relevant records and disclose them to the competent authorities when the law requires it.

When we act, we will tell the organization why whenever possible. The appeals process of the Acceptable Use Policy applies.

6. How to report abuse

If a browser of OpenWAF Browsers is misusing your site or service, write to abuse@openwaf.dev. Please include:

the date, time and time zone of the requests;
the affected URLs or hostnames;
the source addresses you saw and, if present, the Web Bot Auth Signature-Agent and Signature-Input headers, which show that the request came from OpenWAF Browsers;
a description of the abuse and any evidence;
your contact details, in case we need more information.

Section 7 of the Acceptable Use Policy applies to authorities.

7. Changes

This addendum is a draft pending legal review, and we may update it. Significant changes will be notified as described in the Terms of Service.