What Huzz checks automatically
Before a request reaches a model, Huzz reads the text in it (fields such asmessages, content, input, prompt and instructions) and compares that text with a fixed list of English-language word patterns. It does not look at images, audio or files. A pattern check can miss a request that breaks these rules, and it can match a harmless one; see Appeals.
Today the check records; it does not refuse. A request that matches is still sent to the model and answered, and the match is recorded (see Privacy and audit summary). Refusing matching requests is not switched on yet. When it is, a matching request will be refused with 403 and this body:
Policy block shape
Both decisions are recorded today and, once refusing is on, both refuse the request.
hard_block marks content that is illegal (severity: illegal, enforced_by: law), and soft_block content that this policy prohibits (severity: prohibited, enforced_by: huzz_aup).
csam
You may not use Huzz to create, transform, find, share or trade child sexual abuse material, or to sexualise or exploit minors in any way. The automatic check flags requests to make, find or share such material.violent-extremism
You may not use Huzz to support terrorism or violent extremism: recruitment, propaganda, fundraising, attack planning or instructions, or help evading detection. The automatic check flags requests for recruitment, propaganda or fundraising material for terrorist or violent extremist groups.non-consensual-intimate-imagery
You may not use Huzz to create, edit, share or identify intimate images of a person without their consent, including sexual deepfakes of real people, or to coerce or blackmail anyone with such images. The automatic check flags these requests.malware
You may not use Huzz to create, change, deploy or hide malware, or to break into systems or accounts you are not authorised to access. The automatic check flags requests to write malware, ransomware, keyloggers or credential stealers, and requests to steal passwords, cookies, session tokens or other credentials.fraud-phishing
You may not use Huzz for fraud, phishing, scams, credential harvesting, fake documents or payment abuse. The automatic check flags requests to write phishing messages or pages, and to clone login, bank or payment pages to capture credentials.privacy-doxxing
You may not use Huzz to reveal, infer, gather or publish private information about a person without authorisation, including doxxing and stalking. The automatic check flags requests to doxx a person or to find or publish a private person’s home address, phone number or social security number.Also not allowed
The uses below break this policy too. Huzz does not check for them automatically today. A key or project used for them can be restricted (see Account standing).weapons
Help to build, acquire, modify, target or deploy weapons, including chemical, biological, radiological, nuclear, explosive and conventional weapons.spam-platform-abuse
Automated spam, abuse of other services, fake engagement, getting around rate limits, rotating keys to avoid enforcement, or probing Huzz systems without authorisation.harassment
Abuse, threats, intimidation or sexual harassment aimed at a person or a protected group, including coordinated harassment.deceptive-deepfakes
Impersonating real people, or making synthetic media that misleads people about someone’s words, actions, identity or consent, when the use is abusive, fraudulent, non-consensual or otherwise harmful.ip-infringement
Getting around rights management, or making content meant to infringe copyright, trademark, publicity or other intellectual-property rights.self-harm
Instructions for, encouragement of, or help hiding self-harm. Supportive, prevention-focused and recovery-focused uses are allowed.regulated-advice
Medical, legal, financial, insurance, employment, housing, credit and other regulated advice given without the user control, professional review and disclaimers the law requires. If you build such a product, those are your responsibility.political-election-manipulation
Manipulating voting, suppressing participation, targeting voters deceptively, impersonating candidates or officials, or generating misleading election information.sensitive-personal-data
Processing health, biometric, financial, location, identity or protected-class data in a way that is not lawful, authorised and limited to what the task needs.Account standing
The Huzz team can warn, restrict or suspend an API key or a project. A restricted or suspended key is refused with403 account_restricted (see Errors). A request that breaks these rules can lead to a restriction whether or not the automatic check flagged it.
Appeals
If you believe a request was flagged or refused by mistake, or a key restricted by mistake, write to [email protected] with thereference_id from the response.
Privacy and audit summary
Huzz records every request it checks: the route, model, decision, category, timing and a SHA-256 hash of the request’s text (content_hash), not the text itself. When a request matches one of the six categories, Huzz also keeps the full request body as evidence, for abuse review, support and appeals. This happens today, while matches are recorded and not refused.