Rules & responsibilities
What you can build on AxForge, what you must not, and who is responsible for what. This is a plain-language orientation for developers — the binding documents are the Acceptable Use Policy, the Terms, and the DPA. It is not legal advice.
Who is responsible for what
AxForge provides EU-hosted inference and keeps your content private; you decide what to send and what to build. In GDPR terms you are the controller and AxForge is a processor for the data you send.
- Running inference in the EU on open-weight models, in the region your key is pinned to.
- Zero retention: not storing, logging, or training on your prompts or completions.
- Securing the platform and isolating each tenant.
- Publishing which models serve each capability (model transparency).
- Having a lawful basis for any personal data you send, and minimising it.
- What your application does with model output, and any human oversight it needs.
- Disclosing to your end users that they are interacting with AI where the EU AI Act requires it.
- Keeping your API keys secret and rotating them if exposed.
Do / don't
The Acceptable Use Policy is the full list; these are the essentials.
- Build assistants, search, extraction, coding tools, and content generation for legitimate purposes.
- Send the minimum data a task needs; prefer pseudonymised inputs.
- Keep a human in the loop for decisions that affect people materially.
- Handle errors and rate limits with backoff and retries.
- Generate content that is illegal, that harms or targets people, or that facilitates fraud, malware, or abuse.
- Use output to make consequential decisions about people without human review (credit, employment, legal, medical).
- Send data you have no right to process, or special-category data without a proper basis and safeguards.
- Embed a raw key in a browser, mobile app, or public repo — proxy through your own backend.
Examples by use case
How the split plays out in the things people actually build.
Support / chat assistant
- Fine: answer product questions, draft replies, summarise a ticket. Tell users it's an AI assistant.
- Watch: don't let it promise refunds or make binding commitments without a human check; don't feed it a customer's full account record when the question needs one order.
RAG over internal documents
- Fine: embed your docs, retrieve the relevant passages, and pass them as context. Content is processed in memory and not retained.
- Watch: you control your vector store — apply your own access controls so a user can't retrieve documents they shouldn't see. Redact secrets you don't need the model to read.
Coding assistant
- Fine: point aider, Continue or Cline at AxForge and let it read and edit your repo.
- Watch: review generated code before shipping; don't paste live credentials or customer data into prompts.
Images, speech & music
- Fine: generate and edit assets, transcribe audio, synthesise speech for your own product.
- Watch: don't impersonate a real person's likeness or voice, or produce deceptive media; respect the rights in any source material you upload.
Personal data (PII)
- Fine: process personal data you have a lawful basis for — it stays in the EU and is never retained or trained on.
- Watch: you're the controller. Sign the DPA, minimise what you send, and honour your users' rights. See GDPR & AI.
If something needs a review
Building something novel, high-risk, or at scale and want a second opinion on the boundaries? Talk to an engineer — we would rather help you get it right than find out later.