1. Introduction and Scope
This Acceptable Use Policy (“AUP”) governs all use of the QueryDesk platform, products, and services (collectively, the “Services”) provided by DevHub LLC (“DevHub,” “we,” “us,” or “our”). This AUP applies to all users of the Services, including individuals and entities who access the Services under a free trial, paid subscription, or negotiated agreement (each, a “Customer”).
This AUP is incorporated by reference into the QueryDesk Terms of Service at querydesk.com/terms and any applicable Master Services Agreement or Order Form between QueryDesk and Customer (collectively, the “Agreement”). Capitalized terms not defined here have the meaning given in the Agreement. In the event of a conflict between this AUP and the Agreement, the Agreement controls unless it expressly incorporates this AUP on a specific point.
By accessing or using the Services, you agree to comply with this AUP. Customer is responsible for ensuring that its Authorized Users, employees, contractors, and any other parties granted access through Customer’s account (collectively, “Customer Personnel”) comply with this AUP. Customer’s failure to enforce compliance by Customer Personnel is a breach of the Agreement by Customer.
2. Definitions
For purposes of this AUP:
- “Authorized User” means an individual who is authorized by Customer to use the Services and who has been supplied a user identification and password by Customer (or by DevHub at Customer’s request).
- “Connected Database” means any database, data store, or data source that an Authorized User configures for access through the Services, including but not limited to PostgreSQL, Microsoft SQL Server, and Oracle database instances.
- “Customer Data” means any data, content, or information that Customer or Customer Personnel submits to, stores in, transmits through, or retrieves using the Services, including query results, query text, schema metadata, AI assistant prompts and responses, and audit records.
3. General Prohibited Conduct
Authorized Users must not use the Services to engage in, facilitate, or encourage any of the following activities. The examples provided are illustrative and not exhaustive.
3.1 Unauthorized Database Access
Authorized Users must not use the Services to connect to, query, or otherwise interact with any Connected Database that the Authorized User is not authorized to access under the policies of the database owner or operator. Customer represents and warrants that, for each Connected Database configured in its QueryDesk environment, Customer (a) owns the database or (b) has obtained all necessary rights, permissions, and authorizations from the database owner to access that database through the Services.
DevHub is not responsible for verifying authorization to access any Connected Database, and the provision of connectivity through the Services does not constitute authorization.
3.2 Circumvention of Security and Governance Controls
The Services include approval workflows, audit logging, role-based access controls, data masking, and other governance features (collectively, “Governance Controls”). Authorized Users must not:
- Attempt to bypass, disable, tamper with, or defeat any Governance Control;
- Execute queries through channels intended to evade approval workflows where such workflows have been configured by Customer;
- Delete, alter, falsify, or suppress audit log entries, or attempt to do so;
- Share authentication credentials, session tokens, or access artifacts in a manner that obscures the identity of the person actually executing queries;
- Use service accounts, shared accounts, or automated integrations in a manner that defeats the attribution of query activity to a specific individual, except where such use is expressly configured and approved by Customer administrators; or
- Exploit or attempt to exploit any vulnerability, misconfiguration, or defect in the Services to gain elevated privileges or access data the Authorized User is not otherwise authorized to access.
3.3 AI Query Assistant Use
The Services include an AI query assistant that operates using a Customer-supplied API key for a third-party large language model provider (“BYOK”). Authorized Users must not:
- Submit prompts, instructions, or data to the AI query assistant designed to extract, exfiltrate, or expose credentials, API keys, environment variables, system prompts, or internal QueryDesk infrastructure details;
- Attempt prompt injection, jailbreaking, or other adversarial techniques against the AI query assistant or any underlying model;
- Use the AI query assistant to generate queries intended to violate this AUP, including queries designed to circumvent Governance Controls or access unauthorized data;
- Submit Customer Data to the AI query assistant in violation of Customer’s own policies or applicable law, including by submitting data subject to regulatory restrictions the Customer has not authorized for LLM processing; or
- Misrepresent AI-generated query output as human-authored where such representation would mislead reviewers, approvers, or auditors relying on the audit log.
Customer acknowledges that AI assistant prompts and responses are retained on QueryDesk’s infrastructure and may be viewed by the originating user and by Customer’s chosen AI provider under that provider’s terms. Customer is responsible for ensuring its Authorized Users are aware of this and for implementing internal controls regarding what data Authorized Users include in AI assistant prompts.
3.4 Reselling, Reverse Engineering, and Unauthorized Redistribution
Authorized Users must not:
- Resell, sublicense, rent, lease, or otherwise make the Services available to any third party, except as expressly permitted in the Agreement;
- White-label, rebrand, or present the Services as the Authorized User’s own product or as the product of any party other than DevHub;
- Reverse engineer, decompile, disassemble, or attempt to derive the source code, underlying ideas, algorithms, file formats, or non-public APIs of the Services, except to the extent this restriction is prohibited by applicable law;
- Build a competing product or service using the Services, or use the Services to benchmark or analyze the Services for competitive purposes without DevHub’s prior written consent; or
- Circumvent any technical limitation, license key, seat count, rate limit, or feature gate in the Services.
Customers may request authorization to perform security research on the Services by emailing security@querydesk.com.
3.5 Generic Abuse of Infrastructure
Authorized Users must not use the Services or any DevHub-provided infrastructure to:
- Mine, generate, validate, or otherwise process cryptocurrency or other blockchain-based tokens;
- Conduct web scraping, crawling, or bulk data harvesting against third-party websites or services;
- Send unsolicited commercial communications (“spam”), phishing messages, or other mass messaging;
- Host, distribute, or execute malware, ransomware, viruses, worms, or other malicious code;
- Conduct denial-of-service attacks, port scanning, vulnerability scanning against third parties, or other network abuse;
- Impose an unreasonable or disproportionately large load on DevHub’s infrastructure, including through automated tooling, concurrent session abuse, or queries designed to consume excessive compute, memory, or storage; or
- Use the Services in any manner that could damage, disable, overburden, or impair DevHub’s servers or networks, or interfere with any other party’s use of the Services.
4. Regulated Data Restrictions
Customer must not use the Services to process, store, transmit, or otherwise interact with any of the following categories of data:
- Protected Health Information (“PHI”) as defined under the U.S. Health Insurance Portability and Accountability Act (“HIPAA”) and its implementing regulations. DevHub does not enter into Business Associate Agreements and the Services are not designed or warranted for PHI processing.
- Cardholder Data as defined under the Payment Card Industry Data Security Standard (“PCI DSS”), including primary account numbers, card verification values, and magnetic stripe data. DevHub is not PCI-attested and the Services are not designed or warranted for cardholder data processing.
- Classified, controlled unclassified, or export-controlled information subject to U.S. government classification, ITAR, EAR, or equivalent non-U.S. export control regimes.
- Biometric identifiers subject to specific regulatory regimes including the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, the Washington Biometric Identifiers Act, the Colorado biometric provisions, and equivalent laws.
- Children’s personal information subject to the U.S. Children’s Online Privacy Protection Act (“COPPA”) or equivalent laws.
- Any other category of data for which Customer is subject to a specific regulatory, contractual, or statutory obligation that the Services have not been contractually warranted to support.
This restriction applies to data contained in Connected Databases, query results, uploaded files, shared query libraries, AI assistant prompts and responses, audit logs, and any other area of the Services.
Customer bears sole responsibility for determining the regulatory classification of data it processes through the Services and for ensuring that its use of the Services complies with all applicable laws, regulations, and contractual obligations. DevHub does not monitor the content of Customer Data and does not make any determination of regulatory classification on Customer’s behalf.
5. Legal Compliance and Third-Party Rights
Authorized Users must not use the Services to:
- Violate any applicable local, state, national, or international law, regulation, or order;
- Infringe, misappropriate, or violate any intellectual property right, privacy right, publicity right, contract right, or other right of any third party;
- Engage in fraud, deception, or misrepresentation, including facilitating unauthorized access to third-party systems;
- Distribute defamatory, obscene, harassing, threatening, or otherwise unlawful content; or
- Engage in any activity that violates applicable export control or economic sanctions laws of the United States or any other jurisdiction.
6. Customer Responsibilities for Authorized Users
Customer is responsible for:
- Maintaining the confidentiality of all authentication credentials issued to Customer Personnel;
- Promptly notifying DevHub of any unauthorized access, use, or suspected compromise of Customer’s account or credentials;
- Ensuring that Customer Personnel are made aware of, and comply with, this AUP;
- Promptly revoking access for any Authorized User whose role no longer requires access, who leaves Customer’s organization, or who has violated this AUP; and
- All activity that occurs under Customer’s account, whether or not authorized by Customer, except to the extent such activity results from DevHub’s gross negligence or willful misconduct.
7. Enforcement
7.1 Investigation and Cooperation
DevHub reserves the right, but does not assume the obligation, to investigate any suspected violation of this AUP. Customer agrees to cooperate reasonably with DevHub’s investigation, including by providing information, logs, and access reasonably necessary to investigate a suspected violation.
DevHub may cooperate with law enforcement authorities and comply with lawful subpoenas, court orders, and other legal process in connection with suspected violations, subject to the notification obligations in the Agreement and applicable law.
7.2 Remedies
If DevHub determines, in its reasonable discretion, that a User has violated this AUP, DevHub may take any or all of the following actions, with or without prior notice depending on the severity and nature of the violation:
- Issue a warning;
- Require corrective action by Customer;
- Suspend or throttle access to all or part of the Services for the offending User or for Customer’s account generally;
- Remove, disable, or restrict access to Customer Data or configurations that violate this AUP;
- Terminate the Agreement in accordance with its terms; and
- Pursue any other remedy available under the Agreement, at law, or in equity.
DevHub will use reasonable efforts to take the least restrictive measure necessary to address a violation, and to limit suspension to the specific Authorized User or feature implicated in the violation, where feasible.
DevHub will provide Customer with notice of enforcement actions promptly, and in any event within twenty-four (24) hours after taking action, except where prior notice is required to be withheld by law or where the violation involves an imminent risk of harm under Section 7.3.
DevHub is not liable for any loss or damage arising from enforcement actions taken in good faith under this AUP.
7.3 Emergency Action
Notwithstanding Section 7.2, DevHub may suspend access to the Services immediately and without prior notice if DevHub reasonably believes that (a) the violation presents an imminent risk of material harm to DevHub, other Customers, or third parties; (b) the violation involves unlawful conduct; or (c) continued provision of the Services would subject DevHub to legal liability or regulatory action. DevHub will provide notice of emergency action as soon as reasonably practicable.
8. Reporting Violations
To report a suspected violation of this AUP, contact DevHub at abuse@querydesk.com. Reports should include a description of the alleged violation and any relevant supporting information.
9. Changes to This AUP
DevHub may update this AUP from time to time. Material changes will be communicated to Customer through the Services, by email to Customer’s designated contact, or by other reasonable means, and will become effective no less than thirty (30) days after notice, except that changes required by law, regulation, or to address material security or abuse concerns may take effect immediately. Customer’s continued use of the Services after the effective date of a change constitutes acceptance of the updated AUP.
10. Contact
DevHub LLC
Attn: Legal
PO Box 65214
South Salt Lake, UT 84165
United States
Email: legal@querydesk.com