Skip to content
UxerProof

Responsible testing

Only what you own, or are authorised to test

Automated journeys against systems you do not control are not a grey area for us. The product is built so that it cannot be used that way.

Draft for legal review. This document is an accurate description of intended practice, written for engineering and product alignment. It has not yet been reviewed by counsel and is not final contractual language.

The rule

You may run a Circuit only against a website or application that your organisation owns, or that you have explicit written authorisation from the owner to test. This applies to every Environment, including staging and preview deployments.

How the product enforces it

  • Domain verification is mandatory. An Environment cannot be executed against until the workspace has proved control of the domain with a DNS TXT record, a meta tag or a well-known file.
  • There is no arbitrary-URL runner. The product has no "paste a URL and test it" entry point, by design.
  • Authorisation is attested per Environment. The person adding an Environment must confirm the organisation owns or is authorised to test it, and that attestation is recorded as an audit event with their identity and timestamp.
  • Verification can be revoked. If a domain stops resolving its verification record, execution against that Environment is suspended.
  • Execution is rate limited and identifiable. Circuits are designed to run at human pace with an identifiable user agent, so your own monitoring can distinguish them.

What UxerProof is not

  • It is not a penetration testing tool and must not be used to probe for vulnerabilities.
  • It is not a scraper, a credential stuffer, or a load-testing tool.
  • It is not a way to test a competitor's product.
  • It is not a substitute for research with real users who have real stakes.

Journeys that touch real consequences

Circuits can complete purchases, submit forms and trigger approvals. Point them at a staging or preview Environment whenever a step has a real financial, legal or communication side effect, and use test data for anything an AI User has to type.

Handling other people's data

Do not use production personal data as Circuit input. Evidence that captures personal data should be redacted, and Ephemeral Mode exists precisely for journeys where nothing raw should survive report synthesis.

Enforcement

Verified abuse of these rules ends in suspension. See the acceptable use policy for the full list of prohibited activity.