Acceptable Use Policy

1. Scope

This AUP applies to:

• All visitors and users of canyoninc.net and any Canyon-operated subdomains
• Clients accessing the Canyon client portal
• Clients and their authorized users of any Canyon-managed IT systems, infrastructure, software, or networks
• Third parties accessing Canyon systems on behalf of a client

2. Prohibited Uses — Website and Client Portal

You may not use Canyon's website or client portal to:

• Violate any applicable federal, Tennessee state, or local law or regulation
• Attempt to gain unauthorized access to any part of the website, portal, or underlying infrastructure
• Transmit or upload malware, ransomware, spyware, viruses, or any other malicious code
• Conduct denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks against Canyon or any third party
• Use automated tools (scrapers, crawlers, bots) to extract content or data without Canyon's written permission
• Impersonate Canyon, its employees, or any other individual or entity
• Harvest or collect personal information about other users without their consent
• Submit false, misleading, or fraudulent information through contact forms or portal communications
• Probe, scan, or test the security vulnerability of Canyon's systems without explicit written authorization
• Interfere with or disrupt the integrity or performance of the website, portal, or related systems

3. Prohibited Uses — Managed Services

Clients receiving managed IT, cybersecurity, or software services from Canyon may not use Canyon-managed systems, networks, or infrastructure to:

• Distribute illegal content: Store, transmit, or publish content that violates copyright, constitutes defamation, is obscene, or is otherwise unlawful
• Conduct unauthorized security testing: Run penetration tests, vulnerability scans, or similar activities against any system — including your own — without coordinating with Canyon in advance
• Send unsolicited communications: Use Canyon-managed email infrastructure or servers for spam, bulk unsolicited messages, or communications that violate the CAN-SPAM Act or other applicable law
• Mine cryptocurrency: Use Canyon-managed compute resources for cryptocurrency mining or similar resource-intensive activities not related to your business operations
• Bypass security controls: Disable, circumvent, or attempt to defeat security controls, monitoring agents, or endpoint protection deployed by Canyon as part of your managed services
• Share credentials: Share service account credentials, MFA codes, or administrative access with unauthorized parties
• Facilitate data exfiltration: Transfer large volumes of sensitive or confidential data to unauthorized external locations

4. Security Obligations

Clients of Canyon's managed services share responsibility for maintaining a secure environment. You agree to:

• Report incidents promptly: Notify Canyon immediately upon discovering or suspecting a security incident, breach, or compromise affecting Canyon-managed systems
• Protect credentials: Safeguard all login credentials, API keys, and access tokens. Report lost or compromised credentials immediately
• Maintain endpoint hygiene: Keep user devices reasonably up to date and follow Canyon's endpoint security guidelines where provided
• Cooperate with security measures: Allow Canyon to deploy, configure, and maintain security tools (antivirus, EDR, backup agents, monitoring) as specified in your services agreement
• Coordinate changes: Notify Canyon before making significant changes to network configurations, adding new systems, or changing firewall rules affecting Canyon-managed infrastructure

5. Data Handling Obligations

In connection with Canyon-managed services, you agree not to direct Canyon to process personal data in ways that violate applicable privacy law, including the Tennessee Information Protection Act (TIPA, effective July 1, 2025), HIPAA (if applicable), or other regulations governing the data you control.

You are responsible for ensuring that your use of Canyon's services complies with any legal obligations you have as a data controller or covered entity. Canyon's obligations as a processor or business associate are set out in your services agreement or applicable Business Associate Agreement (BAA).

6. Consequences of Violation

Canyon reserves the right to take any of the following actions in response to an AUP violation, at our discretion and without prior notice where urgent action is required:

• Issue a written warning
• Temporarily suspend access to the portal or specific services
• Terminate services in accordance with your services agreement
• Report illegal activity to appropriate law enforcement authorities
• Seek injunctive relief or other legal remedies for violations causing harm

Where feasible, Canyon will provide written notice and a reasonable opportunity to cure the violation before taking action. In cases of security incidents, active attacks, or serious legal violations, Canyon may act immediately without prior notice.

7. Reporting Violations

If you observe or suspect an AUP violation — by yourself, another user, or a third party — please report it to:

• Security incidents: Your designated Canyon support contact or legal@canyoninc.net
• Legal or compliance concerns: legal@canyoninc.net

Reports are treated confidentially to the extent permitted by law.

8. Changes to This Policy

Canyon may update this AUP at any time. We will notify active clients of material changes via email or through the client portal. Continued use of services after changes are posted constitutes acceptance of the updated AUP.

9. Contact

• Email: legal@canyoninc.net
• Company: Canyon, INC. — Chattanooga, TN