Terms, Ethics & Acceptable Use
Physical Security Atlas (“the Atlas”, “we”, “us”) is an unincorporated research project that documents systemic weaknesses in RFID physical-access credentials. This page is the single agreement governing your use of it. It combines four things: our Code of Ethics, our Acceptable Use Policy, the licence you grant us over what you submit, and the Terms of Service. By creating an account or using the Atlas, you agree to all of it.
The Atlas is a defensive tool. It exists so that organizations can find and revoke compromised credentials and adopt more secure access-control standards. Everything below follows from that purpose.
Code of Ethics
Everyone who contributes to or uses the Atlas agrees to uphold these principles:
- Defensive purpose. Use the Atlas only to identify, understand, and remediate physical-access vulnerabilities — never to exploit them.
- Do no harm. Never use information here to gain unauthorized entry, endanger people or property, or facilitate a crime.
- Authorized collection only. Collect RFID or credential data only from systems you own or are explicitly authorized to assess. Do not clone a credential or tamper with a Physical Access Control System (PACS) without permission from its owner.
- Do not tamper with systems you rely on. Including your own employer's, landlord's, or institution's, absent authorization.
- Respect privacy. Minimize personal data. Do not submit information that identifies individuals beyond what is necessary to describe an exposure.
- Responsible disclosure. Give affected organizations a fair opportunity to remediate; coordinate rather than publicize recklessly.
- Accuracy and integrity. Submit truthful, validated data, and correct or withdraw errors promptly.
- Legal compliance. Follow all applicable laws and your own organization's policies.
- Accountability. Submissions are attributed to your account, validated on entry, and open to community corroboration and administrator review.
These principles are not decoration. Breaching them is a breach of this agreement, with the consequences described under Suspension and termination.
Acceptable Use Policy
You may
- Search and review exposures to assess and improve the security of systems you are responsible for.
- Submit access-credential data you are legally authorized to collect.
- Use monitoring features, such as address watches, for locations in which you have a legitimate interest.
- Cite the Atlas in research, reporting, and security assessments, subject to Attribution below.
You may not
- Use any information here to attempt or facilitate unauthorized access to any facility, system, or asset.
- Collect or upload credential data from systems you do not own or are not authorized to test.
- Submit false, misleading, or malicious data.
- Attempt to de-anonymize, surveil, harass, or target individuals.
- Scrape, bulk-export, or redistribute the database except through features provided for that purpose.
- Access the Atlas by automated means, or circumvent rate limits, query limits, authentication, or the instructions in our
robots.txt, except through an interface we provide for that purpose. - Share your account, or probe, attack, or disrupt the platform itself.
- Resell or sublicense access to the Atlas or its data.
- Use the service for any unlawful purpose.
No eligibility decisions about people
The Atlas describes the security of buildings and credential technologies, not the trustworthiness of people. You may not use it, or anything obtained from it, as a factor in deciding any individual's eligibility for credit, insurance, employment, volunteering, housing or tenancy, a government licence or benefit, or any similar determination. The Atlas is not a consumer reporting agency and does not provide consumer reports.
Your submissions and the licence you grant us
You keep ownership of what you submit. We claim no title to your records.
By submitting, posting, or displaying any record, data, or other content through the Atlas, you grant us a perpetual, irrevocable, worldwide, royalty-free, non-exclusive, sublicensable licence to host, store, reproduce, adapt, publish, publicly display, distribute, and create aggregated and derived works from that content, for the purpose of operating, providing, promoting, and improving the Atlas and any public interface to it — including search, the public map, statistics, bulk export, and any application programming interface we may offer.
Two parts of that deserve plain explanation, because they sound broader than they are:
- Why irrevocable. Records are read by others, counted in public statistics, and folded into derived and aggregated data. If a contributor could withdraw the licence retroactively, we could not vouch for the integrity of the database or of anything already published from it. The licence covers the data, not you: you can close your account at any time.
- Why sublicensable. Serving the data through a map provider, an API consumer, or a mirror is technically a sublicence. Without this, ordinary operation of the site would be outside the grant.
You represent and warrant that you have the rights and authority to grant this licence, and that everything you submit was collected in accordance with the Code of Ethics above.
We are not obliged to publish, retain, or continue to display anything you submit. We may hide, correct, or remove any record, at our sole discretion, including where we believe it to be inaccurate, unlawfully obtained, or submitted in breach of this agreement.
Attribution
If you reproduce Atlas data or materials in a publication, report, presentation, or product, attribute them to Physical Security Atlas and indicate our ownership of the underlying compilation. Contributors are credited by account for the records they submit.
Terms of Service
Registration and eligibility
- By opening an account you represent and warrant that you are at least 18 years of age.
- Registration is limited to approved email domains, and to persons not barred from receiving the service under applicable law.
- You are responsible for keeping your password and two-factor device secure, and for all activity under your account. Tell us promptly if you believe your account has been compromised.
- You agree that the registration details you give us are accurate and kept up to date.
Data accuracy
Records are crowdsourced. Every submission is checked automatically against structural rules before it is stored, and each record carries a data-confidence signal derived from the credential itself — but structural validation is not the same as confirming that a credential is live, correctly attributed, or still in use. We do not independently verify each piece of data and make no guarantee of its accuracy, completeness, or currency.
Suspension and termination
We may suspend or terminate your account, remove content, or restrict access at any time if you breach this agreement, if we are required to do so by law, or if continuing to provide the service becomes impractical. Serious breaches — in particular unauthorized collection or any use of the Atlas to attempt physical access — may also be referred to your institution or to law enforcement. You may stop using the Atlas and close your account at any time.
Provisions that by their nature should survive termination — including the contributor licence, disclaimers, limitation of liability, and indemnity — continue to apply after your account ends.
Intellectual property
The Atlas software, design, and the compilation of the database are ours or our licensors'. Nothing in this agreement grants you a right to use our name, logo, or brand features without written permission. You may not remove or obscure proprietary notices, or reverse engineer the platform except where the law expressly permits it.
Disclaimer of warranties
The Atlas is provided “as is” and “as available”, without warranties of any kind, whether express or implied, including any implied warranties of merchantability, fitness for a particular purpose, accuracy, and non-infringement. We do not warrant that the service will meet your requirements, that it will be uninterrupted, timely, secure, or error-free, or that any information obtained through it will be accurate or reliable. You use the Atlas at your own risk.
Nothing in this section excludes or limits any warranty or liability that cannot lawfully be excluded or limited. Some jurisdictions do not permit certain exclusions, so only the limitations lawful where you are will apply to you.
Limitation of liability
To the fullest extent permitted by law, we are not liable to you for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, business, goodwill, or data, however caused and under any theory of liability, even if we have been advised of the possibility of such loss.
Our total liability to you for direct damages, actually proven, arising out of or relating to the Atlas will not exceed one hundred United States dollars (US$100). This limit applies even if it causes a remedy to fail of its essential purpose.
Indemnification
You agree to defend, indemnify, and hold harmless Physical Security Atlas and the individuals who operate it from and against any claims, demands, liabilities, damages, losses, and expenses, including reasonable legal fees, arising out of or relating to your use of the Atlas, the data you submit, or your breach of this agreement — including any claim that your collection of credential data was unauthorized.
Governing law and venue
This agreement is governed by the laws of the State of California, without regard to its conflict-of-laws rules. You and we agree to submit to the exclusive jurisdiction of the state and federal courts located in the State of California for any dispute arising out of or relating to this agreement, and we may nonetheless seek injunctive relief in any jurisdiction where it is needed.
If any provision of this agreement is found unenforceable, it will be limited or removed to the minimum extent necessary and the rest will remain in force. Our failure to enforce a provision is not a waiver of it. This agreement is the entire agreement between you and us regarding the Atlas and supersedes any prior understanding.
Changes to this agreement
We may revise this agreement. When we do, we will publish the new version here with a new version number and effective date, and note the change in the revision history below. If you continue to use the Atlas after a revision takes effect, you accept the revised agreement. Because the version you accepted is recorded against your account, we can tell which text applied to you at any point.
Contact
Report suspected misuse, inaccurate records, or other concerns through Support once signed in, or contact the team directly. Questions about the project itself are answered on the About page.
Revision history
- Version 1.0 August 1, 2026 First consolidated release. Merges the Code of Ethics and Acceptable Use Policy into a single binding document and adds the contributor licence, warranty disclaimer, limitation of liability, indemnity, and governing-law provisions.