1. Applicability of Special Terms #

1.1 these special terms apply when you order or use security products and services ("the Service") from Volcano Engine. The specific content of the Service is subject to the security section under Cloud Infrastructure - Products on the official Volcano Engine website. If these special terms include specific provisions, those shall apply. These special terms do not apply to security hosting services, penetration testing services, red-blue team confrontation services, cloud workload protection platforms, or container security protection platforms.
1.2 once you order or use the Service, these special terms, together with (1) the "Volcano Engine Service Terms" and "Volcano Engine Privacy Policy" published on the Volcano Engine website, (2) the "Product and Service Agreement", (3) the order agreement/service order, (4) the service level agreement (if any), and (5) other applicable service rules, constitute the complete agreement between you and Volcano Engine regarding your order or use of the Service.
1.3 matters not explicitly addressed in these special terms shall be governed by the applicable provisions of other agreements or service rules between you and Volcano Engine.

2. Service Usage Rules #

2.1 You must log in to the Volcano Engine official website with your legally registered Volcano Engine official account and use this service through the official website console. If you use API and/or online SDK access keys, you should follow the instructions to use the service. You are responsible for the integrity and confidentiality of the keys and must take proper security measures, including but not limited to access management and key encryption.
2.2 You understand and agree that Volcano Engine services are fully automated by technical tools. Unless otherwise agreed in writing and/or to fulfill special obligations under the service agreement (such as troubleshooting or detection where applicable), Volcano Engine does not manually intervene in the service process or results.
2.3 Volcano Engine services are limited to your use for your products as stipulated in the service agreement. You understand and agree that if you use this service commercially or obtain profits directly or indirectly in other ways, you must obtain prior written permission from Volcano Engine. If you exceed the authorized scope of use, transfer, sublicense, or rent any resources, technical support, or services provided by Volcano Engine (including to your affiliates), Volcano Engine has the right to immediately terminate such license. You shall bear all losses and consequences arising therefrom, and Volcano Engine will not be liable.
2.4 You agree to comply with the "Volcano Engine Information and Network Security Rules" (“Security Rules”). If you violate the Security Rules or any part of this agreement, including but not limited to lacking all necessary qualifications and permits to conduct business at the time of signing, failing to complete related procedures, or losing all or part of the qualifications during the agreement period, Volcano Engine has the right to suspend services and require you to make corrections within a specified period. If you fail to correct within the specified period, Volcano Engine has the right to terminate this agreement, hold you liable for breach of contract, and seek compensation for corresponding losses.

3. Service Trial (Usage) Instructions #

3.1 Volcengine may provide free services or free usage within a certain limit through invitation testing, public testing, or other methods. The specific free trial (usage) period/limit is subject to the information published on the Volcengine official website. During the free period or within the free limit, you do not need to pay. Volcengine does not rule out charging fees in the future. When that happens, Volcengine will announce the charging policy and regulations in advance by posting notices on appropriate sections of the website or sending in-site notifications. If you continue using the services after the charging period begins, you must pay for the subsequent use according to the valid charging policy at that time. The specifics are subject to the disclosures on the Volcengine official website or the "Product and Service Testing Agreement" you signed with Volcengine (if any).
3.2 During the free trial, Volcengine supports service availability and reliability but does not guarantee any service availability or reliability. The Service Level Agreement applies only after you activate the official release version of the products and services.

4. Special Service Instructions #

4.1 DDoS Protection Service
You will enjoy DDoS protection services within the bandwidth range you purchased. If the attack traffic possibly exceeds your purchased protection bandwidth, you should upgrade to a higher bandwidth protection promptly. Otherwise, your server may experience service interruptions due to attacks or triggering blackhole policies.
4.2 Key Management System
If you no longer use the Key Management System, log in to the console promptly to delete your key information.
4.3 Advanced Network Threat Detection System and Cloud Firewall
4.3.1 To ensure normal service operation, the advanced network threat detection system and cloud firewall services will collect your business traffic metadata and security alert data.
4.3.2 You will receive security protection within the bandwidth range you purchased for the advanced network threat detection system and cloud firewall. If your business traffic exceeds the purchased protection bandwidth, the product cannot protect the excess bandwidth. Any resulting direct or indirect losses are your responsibility.
4.3.3 If your business requires a significant increase in traffic bandwidth protection (i.e., business traffic bandwidth increases by 30% or more compared to the previous month), you must notify Volcengine at least three working days in advance and obtain confirmation. Otherwise, Volcengine assumes no responsibility for service availability impacts caused by this.
4.4 Cloud Security Center
4.4.1 The Cloud Security Center service provides security monitoring for users of Volcengine Cloud Server service and Volcengine Load Balancer service (hereafter “Cloud Server” and “Load Balancer”). You can only activate the Cloud Security Center after activating Cloud Server and/or Load Balancer.
4.4.2 To provide the Cloud Security Center service, Volcengine needs to analyze access data for all cloud servers and load balancers under your account. By activating this service, you authorize Volcengine to collect and analyze all access data under your account's cloud servers and load balancers.
4.4.3 Once the Cloud Security Center service is activated, the security health check feature will be enabled automatically. When your applications or services running on Volcano Engine products have vulnerabilities, weak passwords, or open unknown ports, the security health check service will promptly monitor and alert you to these risks in your products. During detection, the security health check service automatically extracts and replays URLs from network traffic for security checks. The extracted content does not include COOKIE or POST data; it only includes URLs with desensitization applied. The extracted information is used solely to detect users' security risks and will not be used for any other purpose.
4.4.4 The Cloud Security Center service will push threat intelligence information about attacker IPs to you as a security alert. This threat intelligence information is generated by the Cloud Security Center service through data computation and rule matching. It includes attributes of the attacker IP, geographic location, and scan results of open ports on the attacker IP.
4.4.5 The Cloud Security Center service consists of the Cloud Security Center Agent plugin installed on your server and the Cloud Security Center server in the cloud. You authorize Volcano Engine to collect security feature information such as files, processes, and login logs on your server through the Cloud Security Center Agent plugin installed on your server and upload it to the Cloud Security Center server in the cloud for security analysis, providing you with corresponding security functions. You can enable or disable some or all functionalities via the Cloud Security Center console. If you choose to disable related functions, the corresponding security services will stop providing support.
4.4.6 You understand that Volcano Engine cannot guarantee compatibility of the Cloud Security Center Agent plugin with all server systems. Due to possible incompatibility, your server resource usage may increase significantly, and server downtime may occur. You acknowledge and accept that Volcano Engine Cloud does not assume any responsibility for issues caused by this compatibility.
4.4.7 You understand that security events and threat information provided by the Cloud Security Center service serve only as a reference for assessing security risks and making security decisions. You bear all risks and consequences of any actions based on the Cloud Security Center service.
4.4.8 If you use the Model Security Scanning service of Cloud Security Center, we specifically remind you: (1) this service aims to provide security scanning for your own business and models, including but not limited to security testing, performance analysis, and bias detection. Unauthorized testing, scanning, or analysis of any third-party models or systems is strictly prohibited. (2) You must ensure that your models comply with all applicable laws, regulations, and industry standards. In particular, you must ensure that the evaluated models do not infringe on any third party's intellectual property rights, personal information, privacy, or involve illegal content. (3) You need to assess whether the model risk evaluation service is compatible with your current systems and software based on your technical environment and requirements. (4) You must provide us with necessary information, including but not limited to contact details and model service information, and offer necessary assistance. If there are any changes, you should update this information promptly and notify us. You are responsible for any consequences caused by providing false, inaccurate, or incomplete information, as well as by the actions or omissions of your management personnel. (5) Before using this service, you must back up your data and materials. Any data or credential loss or leakage caused by your insufficient protection or operational errors, along with any resulting losses or consequences, will be your own responsibility. (6) Due to the specific nature of computer and internet technologies, using the model risk assessment service may involve risks such as system downtime, business interruptions, or data loss. You should clearly understand and accept these risks and take preventive measures. We are not responsible for any consequences or losses caused by system downtime, business interruptions, or data loss resulting from the service. (7) Given the complexity and variability of models, we cannot guarantee the complete elimination of all risks or vulnerabilities. However, we commit to continuously optimizing service quality and standards according to technological developments to safeguard your models and systems as much as possible. (8) Due to technical limitations and external factors (such as model complexity and dynamic data changes), we cannot guarantee absolute accuracy or completeness of assessment results. Therefore, we are not liable for decisions or actions made based on these results. (9) We provide this service offline on a per-instance basis, independent of subscription length, and it is not subject to the Cloud Security Center Service Level Agreement. (10) This service charges per instance and is completed once the provided model has been scanned and the corresponding report submitted.
4.4.9 If you use the Cloud Security Center's Threat Emergency Tracing service, we specifically remind you: (1) This service aims to provide post-incident host intrusion threat tracing for your own ECS cloud servers, including attack compromise confirmation, root cause analysis, damage assessment, causal inference, backbone attack path discovery, threat mitigation, and emergency response. (2) You agree to promptly provide us with complete basic information for threat tracing analysis, including but not limited to: threat details, detailed network architecture, business system architecture, network device logs, business system logs, host logs, remote authorized access credentials for affected hosts, and authorized access to various security device management platforms and related information. (3) You understand and acknowledge that due to the complexity of endpoint devices and network systems, we cannot guarantee 100% tracking of attackers and their intentions. You shall not claim losses from Volcano Engine on this basis. (4) We provide this service to you offline on a per-use basis, unrelated to the purchase duration. This service is not subject to the Cloud Security Center Service Level Agreement. (5) This service is billed per use; once the threat you provide has been traced and the corresponding report submitted, that service instance is complete. (6) Both parties shall keep all information involved during the service confidential and fulfill the corresponding confidentiality obligations.
4.4.10 When you use the Cloud Security Center alarm large model analysis function, the system analyzes your intrusion alarm data through the large model and outputs alarm analysis results. Besides this, we will not use your intrusion alarm data for any unauthorized purposes and will take measures to ensure data security. The content output by this service is generated by an AI model and cannot replace professional personnel for responses. The output is for your reference only and cannot be used as a basis for decision-making. We strive to improve the quality of generated content, but due to current technological limitations, we cannot guarantee that the content is true, accurate, or complete.
4.5 Attack Surface Management
If you use the Attack Surface Management service, you must also comply with the Attack Surface Management User Service Usage Instructions published on the Volcano Engine official website.
4.6 Cloud Encryption Machine
4.6.1 You are responsible for the integrity and confidentiality of your cloud encryption service passwords and passcodes. You bear all losses and consequences caused by the loss or leakage of the above passwords, passcodes, or data due to your improper maintenance or confidentiality.
4.6.2 You should carefully read the product/service descriptions of the cloud encryption machine on the Volcano Engine official website to assess its compatibility with your chosen operating system, cloud server, and other products or services.
4.6.3 Although the cloud encryption machine undergoes thorough testing, it cannot guarantee full compatibility with all software and hardware systems, nor can it guarantee it is completely error-free. If incompatibility or software errors occur, you may contact Volcano Engine through the contact information published on their official website to obtain technical support. If compatibility issues cannot be resolved, you may choose to stop using the cloud encryption machine.
4.7 Web Application Firewall
4.7.1 When using WAF with the CNAME access method, a public IP will be automatically created. You must comply with relevant laws and regulations when using this IP and must not engage in illegal activities. You are legally responsible for your usage.
4.7.2 When accessing WAF protection through cloud instances, please be cautious when deleting these instances. You bear all network and business risks if you delete the cloud instance yourself.
4.7.3 The IP geolocation data built into the web application firewall may only be used within the web application firewall or other Volcano Engine products you have purchased (such as log services). You may not obtain or use this data for other purposes without authorization.
4.8 Multi-Cloud Security Platform
4.8.1 When using the Multi-Cloud Security Platform, the platform analyzes the security assets and risk event data of the cloud accounts you add. This data is used solely to detect your security risks and will not be used for any other purpose.
4.8.2 You understand that the security events and threat information provided by the Multi-Cloud Security Platform serve only as references for assessing security risks and making decisions. You bear all risks and consequences arising from any actions based on this service.
4.8.3 If you use the database audit module in the Multi-Cloud Security Platform, we specifically remind you that: (1) database auditing is deployed using the traditional image method; (2) purchasing database audit service requires cross-service authorization to access your Volcengine account’s VPC network information; otherwise, purchase is not possible; (3) each database audit instance supports only one VPC; auditing data assets across multiple regions or VPCs requires purchasing multiple services; (4) each order for database audit service can only purchase one instance specification; for different or multiple same specifications, multiple orders are needed; (5) database audit instances cannot be upgraded smoothly between specifications—you need to place a new order to upgrade or downgrade.
4.8.4 If you use the remote emergency response service in the Multi-Cloud Security Platform, we specifically remind you that: (1) before using the service, carefully review Volcengine’s official service descriptions, technical specifications, and procedures, understand them and potential consequences, and follow the operational guidelines during use; you assume all risks, and Volcengine is not liable for any consequences from violating these guidelines; (2) you must assess compatibility between emergency response service and your operating system, cloud servers, or other products/services; (3) this service involves scanning, testing, detecting, and analyzing your designated computer or network systems and is for your own business use only; it must not be used on third-party websites, servers, or businesses; (4) back up your data and materials before use; you are responsible for the integrity and confidentiality of your data, passwords, and credentials stored or provided on Volcengine Cloud Platform; any loss or leakage resulting from your mismanagement is your responsibility; (5) if the service involves licenses for third-party software or cloud security products, you agree to comply with the relevant license agreements; (6) provide Volcengine with contact information of service users and network/cloud product managers, update changes promptly, and bear responsibility for inaccurate or incomplete information and the actions of these personnel; (7) due to the nature of computers and the internet, risks such as system downtime, business interruption, and data loss may occur during remote emergency response; you acknowledge and accept these risks, and Volcengine is not liable for related consequences or losses; (8) security incidents are complex and cannot guarantee 100% restoration of attack chains or absolute hardware/software security, but Volcengine commits to continually improving service quality with advancing technology.
4.8.5 If you use the privacy security service within the Multi-Cloud Security Platform, you commit that the data processed by this service is lawfully collected by you, with legal authorization from the data subjects. Your collection and use comply with national personal information protection and data security laws, and do not infringe on any third party’s rights. You shall provide related legal authorization documents upon Volcengine’s request. You also need to separately sign the Data Entrusted Processing Agreement with Volcengine.
4.8.6 If you use the data security module in the Multi-Cloud Security Platform, we specifically remind you that: (1) the module includes auditing, desensitization, asset inventory, classification, and grading submodules. Use the functions necessary for your needs; (2) compatibility issues may exist among submodules; carefully review product information to confirm functionality meets your requirements; (3) some functions may require application system modifications, which may increase your workload. You bear all risks and consequences arising from improper use leading to business issues.
4.8.7 if you use the security authentication service in the multi-cloud security platform, you should comply with the security authentication service usage guidelines:
4.8.7.1 security authentication service: this method relies on the operator’s “communication gateway number retrieval” and SIM card recognition technologies within the mobile data network. By integrating multi-cloud security protection capabilities, it provides a mobile internet identity authentication method. The security authentication service supports offering users a secure one-click number retrieval feature on advertising H5 landing pages.
4.8.7.2 Interface: Use the SDK and service request interface provided by Volcano Engine, integrating it into your ad H5 landing page to support secure one-click number retrieval for users.
4.8.7.3 You must submit information according to the application requirements for security certification permissions stated on this site and bear full responsibility for the authenticity, legality, and validity of the submitted information; Volcano Engine has the right to make a comprehensive judgment based on your information and reserves the right to decide whether you meet the permission activation requirements.
4.8.7.4 Volcano Engine offers paid security certification services based on its integrated three-network native security certification capabilities and verification of three-network number-related information. Volcano Engine is responsible for providing interfaces that implement the security certification service and verify security one-click number retrieval related information.
4.8.7.5 When you use Volcano Engine's security certification services to serve related users, you are responsible for the software, hardware, and network access used for this service, including but not limited to building all software and hardware devices related to this project, system debugging, activation, maintenance, daily business management, and the transmission from your system to Volcano Engine's security certification service platform, bearing the related costs.
4.8.7.6 You guarantee your right to use this service for security certification of designated targets. You guarantee that you collect users' personal information with their legal authorization or other legal bases, ensuring compliance with personal information protection and data security laws and regulations, without infringing on users' legitimate rights and interests.
4.8.7.7 You should respond quickly and cooperate actively with Volcano Engine to handle complaints caused by your use of security certification services, providing a formal reply within six hours following Volcano Engine's specified format.
4.8.7.8 You may use this service only within your own business and may not directly or indirectly sublease or resell Volcano Engine's security certification capabilities to third parties or provide security certification services for third parties.
4.8.7.9 Your use of this service must not affect Volcano Engine's systems or products. If it does, Volcano Engine has the right to suspend services, and you agree to comply with Volcano Engine's adjustments to your business call volume to ensure stable and secure certification services. You will resolve and bear full responsibility for any disputes with customers arising from this.
4.8.7.10 The agreed security certification service is limited to users of China's three major operators (China Mobile, China Telecom, China Unicom) within mainland China (excluding Hong Kong, Macau, and Taiwan) only. You are responsible for resolving and bearing all consequences of complaints arising from roaming calls to the security authentication service by Chinese carrier users abroad.
4.8.7.11 Volcengine provides security authentication services as is, based on current features. Volcengine does not guarantee uninterrupted or error-free operation of the security authentication service. You agree to use the related services under the security authentication service’s current status and features at your own risk. Volcengine has the right to suspend or terminate all or part of the security authentication services at any time. You agree not to hold Volcengine liable for any suspension or termination.
4.8.7.12 Volcengine makes no commitment or guarantee regarding the validity, accuracy, timeliness, or authenticity of the security authentication service and feedback results, nor does it guarantee the service meets your needs; you understand that the feedback information from the security authentication service is for your business risk control reference only, and you assume all risks and consequences of any actions based on the service and feedback.
4.8.7.13 If the three major carriers (China Mobile, China Telecom, China Unicom) require explaining the source of the security authentication service capabilities to users or brand exposure, Volcengine will notify you simultaneously. You must present and display the interface as required; otherwise, Volcengine has the right to suspend or terminate all or part of the security authentication services, and you bear all consequences arising from this.
4.8.7.14 If the three major carriers (China Mobile, China Telecom, China Unicom) require legality verification of applications using the security authentication service (through collection and verification of the application's unique identifier), Volcengine will request you to provide the application's unique identifier for business configuration to carry out the legitimacy check. If you refuse or fail to provide or correct the unique identifier in a timely manner as required, Volcengine has the right to suspend or terminate all or part of the security authentication services, and you bear all consequences arising from this.
4.8.8 If you use the graded protection evaluation services in the Multi-Cloud Security Platform, we specifically remind you: (1) these services include graded protection classification and gap assessment, security reinforcement plans, and third-party cooperative graded protection evaluation services. Volcano Engine will cooperate with qualified graded protection evaluation agencies to provide these services; (2) you must comprehensively, accurately, and timely provide detailed information about your information systems to Volcano Engine and the evaluation agencies, including but not limited to system architecture, business processes, security measures, and data asset details to ensure the services are based on complete and accurate information. If incomplete or incorrect information causes deviations or delays, you bear the responsibility and losses; (3) throughout the service period, you must designate a dedicated team or personnel to actively and closely cooperate with Volcano Engine and the evaluation agencies, participate in surveys, assessments, planning, and remediation meetings, fulfill all tasks and requirements as agreed, and ensure smooth service progress. If lack of cooperation hinders progress or prevents achieving objectives, you bear full responsibility.
4.8.9 If you use the Data Cross-Border Security Gateway product in the Multi-Cloud Security Platform, you must comply with laws and regulations on cross-border data flow and independently complete necessary declarations, including data export security assessments, signing personal information cross-border standard contracts, or obtaining personal information protection certifications according to actual circumstances.
4.9 Large Model Security Platform
4.9.1 Regarding the Large Model Security Firewall service in the Large Model Security Platform, we specifically remind you: (1) this firewall service protects the input to the model and may block or optimize answers, possibly causing outputs received by your client to lack contextual background, continuity, or coherence; (2) due to technological development and other factors, we cannot guarantee 100% accuracy of protection results. If you do not perform any verification and rely solely on these results for subsequent operations, this involves certain risks which you must bear; (3) content risk identification for text, images, audio, and video is fully automated by the system. Volcano Engine does not manually intervene or take any responsibility for the process or results. Due to technological progress, the results from content risk identification are not guaranteed 100% accurate. If you do not verify and fully rely on these results for further operations, you assume the associated risks.
4.9.2 If you use the security intelligent agent in the Large Model Security Platform, we specifically remind you: (1) ensure your use of the security intelligent agent complies with national laws and regulatory requirements; (2) due to technological development, Volcano Engine cannot guarantee 100% accuracy of analysis results. If you do not perform manual secondary verification and directly use the results for business or system blocking, deletion, or other actions, you assume the associated risks; (3) select appropriate operating systems, cloud servers, or related products for the security intelligent agent service; (4) you are responsible for the service stability of your own systems interfaced with the security intelligent agent (such as log systems, information security management systems, and security protection systems). Any risks like judgment interruptions or missing results caused by the instability of your own systems, not the intelligent agent, are your responsibility; (5) the security intelligent agent relies on large models which you can choose from Volcano Engine or third-party providers. You must comply with agreements signed with third parties and relevant laws when using third-party large models.
4.9.3 If you use the large model security evaluation service, we specifically remind you: (1) this service aims to provide model security scanning for your own business and models, including but not limited to security testing, performance analysis, and bias detection. It is strictly prohibited to use this service to perform unauthorized testing, scanning, or analysis on any third-party models or systems. (2) You must ensure your models comply with all applicable laws, regulations, and industry standards. In particular, you must ensure the evaluated models do not infringe any third-party intellectual property, personal information, privacy rights, or involve illegal or harmful content. (3) You need to assess compatibility between the model risk evaluation service and your current systems and software according to your technical environment and needs. (4) You shall provide us with necessary information, including the model service URL, model ID, and model service authentication information. (5) Due to the nature of computer and internet technology, using the model risk assessment service may involve risks such as system downtime, business interruption, or data loss. You must clearly understand and accept these risks and take preventive measures. We do not assume any responsibility for consequences or losses caused by system downtime, business interruption, or data loss arising from the service. (6) Given the complexity and variability of models, we cannot guarantee the complete elimination of all risks or vulnerabilities. However, we commit to continuously optimizing service quality and standards according to technological advances to ensure your model and system security as much as possible. (7) Due to technical limitations and external factors (such as model complexity and dynamic data changes), we cannot guarantee the absolute accuracy or completeness of evaluation results. Therefore, we are not responsible for decisions or actions made based on relying on evaluation results. (8) This service charges per use. Once the scan on the model you provide is completed and a downloadable report is generated, available service uses will be deducted.
4.10 Jeddak PCC (Private Cloud Computing)
4.10.1 VolcEngine Jeddak PCC (Private Cloud Computing) is a general technology product based on confidential computing, cryptographic application, and information flow security, designed to enable secure transfer and application of sensitive data in public cloud environments.
4.10.2 When using VolcEngine Jeddak PCC, the service processes the end-user data you entrust within a confidential computing environment. Jeddak PCC does not retain any of your data, ensuring full-chain security of end-user data. You guarantee that the data processed by VolcEngine Jeddak PCC is obtained legally and compliantly. Your data collection and usage have acquired user authorization, comply with national laws and regulations on personal information protection and data security, and do not infringe on any third-party legal rights.
4.10.3 During your use of Volcano Engine Jeddak PCC services, you need to assess and confirm the required product specifications and quantities based on your business scale and the attributes of each Jeddak PCC product tier, to ensure normal operation of your online services.
4.10.4 While using Volcano Engine Jeddak PCC services, you may present certain features of the Jeddak PCC cloud environment to end users as needed, enhancing the transparency and trustworthiness of the cloud environment in edge-cloud collaboration scenarios, and meeting end users’ requirements for security verification of your services.