Acceptable Use Policy

Remote desktop software is a tool for helping people and a tool for robbing them, and the difference is entirely in who is holding it. This policy says which uses are not allowed. It applies to Nelkira and to any relay we operate.

The rule underneath all the others

Connect only to machines you own, or that the owner has knowingly given you permission to access. Knowingly means they understood what they were agreeing to. Permission obtained by pretending to be someone else, by frightening someone, or by telling them their computer has a problem it does not have, is not permission.

Specifically not allowed

Fraud and deception

You must not use Nelkira to defraud anyone. That includes, and is not limited to: telephoning people claiming to be from a bank, a software company, a government department or a utility; claiming a computer is infected in order to be let onto it; persuading someone to install Nelkira so that you can reach their online banking; and using a session to move money, install remote access for later, or take documents from a person who does not understand what is happening.

This is the abuse that matters most for software of this kind, and we treat it as the most serious breach of this policy. See what to do if this has happened to you.

Access without authority

You must not connect to a machine you have no right to reach; try access passwords or machine numbers that are not yours in the hope of finding one that works; keep access after permission has been withdrawn, including after leaving a job; or use Nelkira to move from a machine you may access to systems you may not.

Hiding what you are doing

You must not install Nelkira on someone else’s machine without telling them, or configure it so the people using that machine cannot tell that remote access exists or that a session is in progress. Blanking a machine’s screen during a session is a feature for keeping a bystander in a corridor from reading patient records; it is not a way to hide from the person whose machine it is. Do not remove or defeat the recordNelkira keeps of sessions on the machine it is installed on.

Surveillance of people

You must not use Nelkira to watch a person rather than support a computer: to monitor an employee covertly, to read a family member’s messages, to follow a partner, or to watch anyone who has not been told. Where an employer monitors work computers, it is for that employer to make sure staff know and that the law where they are allows it.

Harm to the service or to others

You must not use a relay we operate to carry traffic that is not a Nelkira session; try to overwhelm, probe or break into it; attempt to decrypt or interfere with sessions belonging to others; misrepresent which machine you are; or resell access to it as if it were your own.

Unlawful content and activity

You must not use Nelkira in the commission of a crime, to distribute malware, to handle material that is unlawful where you or the machine are, or in breach of sanctions or export controls.

If you support other people’s computers

This is the ordinary use of Nelkira, and a few things follow from it:

agree remote access in writing with the organisation whose machines they are, before you install anything;
make sure the people who sit at those machines know remote access is installed, who may use it, and how to tell when a session is happening;
give each engineer their own way in rather than sharing one password around a team, and remove access when someone leaves;
leave the session record alone, and make sure the machine’s owner knows it is there and how to read it.

What we do about breaches

We may suspend or refuse relay service to a machine, an account or a network that we reasonably believe is breaking this policy, and we may do so without notice where the breach is serious — fraud in particular. We may report criminal activity to the authorities and co-operate with their investigations.

What we cannot do is see inside a session to police it, and we will not build the ability to. Our judgement necessarily rests on what we can see — patterns of connection, reports from victims, information from law enforcement — and on what you tell us.

Telling us

To report abuse of Nelkira, write to abuse@nelkira.com, or use the fuller guidance on the abuse reporting page. If money has been taken from you, contact your bank and the police first; we will help them, but they can act faster than we can.