BlueBytes Legal Intelligence Platform End User Policy.

Version 1.0. Applies to all end users, administrators, contractors, partner users, and other authorized users of the BlueBytes Legal Intelligence Platform.

1. Purpose

This End User Policy establishes the rules for responsible, secure, and lawful use of the BlueBytes Legal Intelligence Platform ("BlueBytes" or the "Platform"). BlueBytes is designed to support legal intelligence, legal research, policy analysis, case review, document review, training readiness, and related workflows for authorized organizations.

BlueBytes is a decision-support and research-support tool. It does not replace professional judgment, legal review, prosecutorial discretion, law enforcement judgment, supervisory approval, or court requirements.

2. Scope

This Policy applies whenever a user accesses or uses BlueBytes, including through the BlueBytes web application, an organization-branded workspace, the shared BlueBytes document library, organization knowledge bases, chat, case review, citation, summary, upload, export, email, copy, reporting, and future Platform features.

If this Policy conflicts with a written agreement between BlueBytes and a customer organization, the written agreement controls to the extent of the conflict.

3. Authorized Use

Users may use BlueBytes only for authorized organizational purposes and only within the access rights assigned to them. Acceptable uses include legal, policy, procedural, training, and operational research; reviewing and summarizing approved materials; preparing internal drafts and case review materials; and organizing information from approved knowledge bases.

Users must not use BlueBytes for personal matters, unauthorized outside work, political activity, commercial resale, or any purpose outside the user's assigned role.

4. Human Review Required

BlueBytes outputs may be incomplete, outdated, inaccurate, misleading, or unsupported by the underlying source material. Users are responsible for reviewing and validating all Platform outputs before relying on them.

• Verify all cited authorities, citations, quotations, procedural rules, and factual assertions against authoritative sources.
• Confirm that retrieved materials are current, applicable, and within the relevant jurisdiction.
• Review outputs for omissions, bias, overstatement, hallucinated authorities, or unsupported conclusions.
• Apply independent professional judgment and obtain required supervisory or legal review.
• Preserve records according to applicable recordkeeping, public records, discovery, litigation hold, and agency retention obligations.

No user may rely solely on BlueBytes to make, recommend, or automate a decision that materially affects a person's rights, liberty, employment, benefits, discipline, custody status, immigration status, charging exposure, sentencing exposure, or access to public services.

5. No Legal Advice to End Users

BlueBytes provides information retrieval, summarization, drafting assistance, and analytical support. It does not create an attorney-client relationship between BlueBytes and any user, customer, agency, defendant, witness, victim, member of the public, or third party.

Users who are not licensed attorneys must not present BlueBytes output as legal advice. Users who are attorneys remain responsible for complying with professional duties, including competence, confidentiality, supervision, communication, candor, billing, and independent review.

6. Confidentiality and Sensitive Information

Users must protect confidential, privileged, sealed, restricted, personally identifiable, criminal justice, investigative, employment, medical, juvenile, victim, witness, informant, or otherwise sensitive information.

Users may enter or upload sensitive information into BlueBytes only when they are authorized to use it, the use is permitted by organizational policy and contract, the use is not prohibited by law or order, the information is limited to what is reasonably necessary, and required redactions or access restrictions have been applied.

Users must not upload credentials, private keys, API keys, passwords, security tokens, malware, exploit code, contraband content, or information the user is not authorized to possess, process, disclose, or transmit.

7. Knowledge Bases and Uploaded Materials

Organization administrators and authorized users are responsible for materials they upload, maintain, assign, or remove from BlueBytes knowledge bases. Uploaded materials must be accurate enough for the intended use, within the organization's rights to process, assigned to the correct access group, and updated or removed when obsolete or no longer permitted for use.

Users must not attempt to enumerate, extract, scrape, reconstruct, bulk download, or reverse engineer the shared BlueBytes library, another organization's knowledge base, embeddings, prompts, retrieval logic, model behavior, system prompts, source ranking, or security controls.

8. Prohibited Uses

Users must not use BlueBytes to violate law, rule, regulation, court order, professional duty, contract, grant condition, agency policy, or data-sharing agreement.

• Do not fabricate evidence, citations, reports, investigative records, legal authorities, witness statements, admissions, or chain-of-custody records.
• Do not mislead a court, tribunal, opposing party, public agency, supervisor, client, victim, witness, defendant, or member of the public.
• Do not generate discriminatory, harassing, retaliatory, defamatory, threatening, exploitative, or abusive content.
• Do not profile, target, investigate, charge, discipline, detain, search, surveil, or otherwise act against a person based solely on AI-generated output.
• Do not make automated eligibility, employment, disciplinary, charging, custody, sentencing, benefits, or rights-impacting decisions.
• Do not conduct unauthorized surveillance, biometric identification, social scoring, predictive policing, or individual risk scoring.
• Do not bypass access controls, interfere with service operation, test security without authorization, or attempt to access another user's or organization's data.
• Do not resell, sublicense, share, publish, or commercialize BlueBytes access or outputs outside the user's authorized organization.

9. User Accounts and Security

Each user must use their own account. Shared accounts are prohibited unless expressly approved in writing by BlueBytes and the customer organization.

• Keep credentials confidential and use multi-factor authentication when required.
• Access BlueBytes only from approved devices, networks, and browsers.
• Log out or lock unattended devices.
• Report suspected account compromise, unauthorized access, data exposure, or security incidents promptly.
• Follow organization policies for remote access, device management, email forwarding, downloads, storage, printing, and public records handling.

10. Records, Audit, and Monitoring

BlueBytes may record prompts, uploaded file metadata, retrieved context, generated responses, citations, assignments, usage activity, account events, administrative actions, and related logs as permitted by the applicable agreement and law. Users should assume Platform activity may be visible to authorized administrators, auditors, legal reviewers, and support personnel according to role-based access controls and applicable agreements.

11. Accuracy, Citations, and Source Use

Users must verify that a cited source exists, says what the output claims, is quoted accurately, remains current or valid, applies to the relevant jurisdiction and facts, and does not omit contrary authority or material limitations. Where appropriate, users should cite the underlying authoritative source, not BlueBytes itself.

12. External Sharing and Publication

Users must not share BlueBytes outputs outside their organization unless authorized by organizational policy and applicable law. Before external sharing, users must review the output for confidential information, privileged material, sealed or protected information, inaccurate statements, unsupported conclusions, and required disclaimers.

Users must not represent that BlueBytes has independently approved, certified, endorsed, validated, or guaranteed any legal conclusion, policy decision, investigative action, training position, or public statement.

13. Public Records, Discovery, Litigation Holds, and Retention

Use of BlueBytes may create records subject to public records laws, discovery obligations, subpoenas, litigation holds, audit obligations, or internal retention policies. Users must follow their organization's retention and legal hold instructions before deleting, exporting, redacting, forwarding, or withholding Platform materials.

14. Incident Reporting

Users must promptly report unauthorized access, suspected account compromise, accidental upload or disclosure of restricted information, retrieval of another organization's information, incorrect access permissions, materially inaccurate outputs that could affect important decisions, security vulnerabilities, system misuse, or attempts to bypass controls.

15. Administrator Responsibilities

Organization and enterprise administrators must assign users only the access needed for their roles, maintain accurate user groups and knowledge base permissions, remove access when authorization changes, ensure uploaded materials are approved and current, communicate this Policy, monitor use for compliance, and coordinate with legal, records, privacy, security, and compliance personnel as needed.

16. Training and Acknowledgment

Users may be required to complete onboarding, AI-use, confidentiality, cybersecurity, legal ethics, CJIS, public records, or organization-specific training before receiving or retaining access.

By using BlueBytes, each user acknowledges that they have read, understand, and agree to follow this Policy and any organization-specific requirements that apply to their use.

17. Enforcement

Violation of this Policy may result in suspension or termination of access, administrator review, referral to the user's organization, disciplinary action, legal action, reporting to regulators or courts when required, and any other remedy available under applicable agreements or law. BlueBytes may suspend or restrict access when reasonably necessary to protect the Platform, users, customer organizations, third parties, or data security.

18. Policy Updates

This Policy may be updated from time to time to reflect changes in the Platform, law, security requirements, professional obligations, customer agreements, or operational practices. Continued use of BlueBytes after notice of an updated Policy constitutes acceptance of the updated Policy unless a governing written agreement provides otherwise.