Access controls for Ultrac.
Ultrac is general-purpose unrestricted AI. API access requires an approved account; keys are account-bound, labeled, and revocable.
Current access controls.
API access requires account approval. Keys are tied to an account, rate limits apply per key and account, and account holders can revoke keys.
Ultrac supports research, writing, coding, analysis, automation, and other tasks that require unrestricted AI. Security work is one use case. This page describes account access, tool permissions, data handling, and responsible use.
Model requests require a configured model host. Tool execution depends on the permissions you grant in the harness.
Account approval permits access to Ultrac. It does not verify identity, organization, or authorization to access a particular system.
The API does not provide per-request audit logs or an audit-export endpoint.
Current controls require account approval for API access, enforce rate limits, and let account holders revoke keys.
Four controls in the current API.
These controls are account approval, account-bound keys, rate limits, and key revocation.
Approved accounts
The API checks that an account is approved before serving protected requests. Approval is not identity or organization verification.
- Approval required for API access
- Approval is not identity verification
Account-bound API keys
Keys belong to an account, can be labeled, and can be revoked by an account holder. Per-operator identity, model or tool scopes, and key expiry are not supported.
- Account-bound
- Labeled
- Revocable
Rate limits
Rate limits apply per API key and account. The service does not provide organization-wide quotas or anomaly detection.
- Per-key limits
- Per-account limits
- No anomaly review queue
Key revocation
Account holders can revoke their own API keys. The API rejects keys marked as revoked.
- Account-holder revocation
- Revoked keys rejected by the API
What API keys can do today.
A key is tied to an account and can be labeled and revoked. Keys do not have per-operator identity, model or tool scopes, or expiration settings. The key page records limited key metadata, including when it was last used; it is not a per-request audit log.
- Created for an account and given a label.
- The secret is shown once; the verifier stores a hash.
- An account holder can revoke the key.
- Rate limits apply per key and account.
No per-request audit record, content digest, SIEM export, or tamper-evident log is available.
What the application persists.
The application stores saved chat history and long-running task records. It does not offer zero-data-retention mode or per-request audit export.
Saved chats
Dashboard user and assistant messages are stored as chat history. Use the dashboard's delete action to request deletion of a chat.
Long-running tasks
Task prompts or messages and task events are stored. Run and event records are assigned a 30-day DynamoDB TTL; deletion may occur after the TTL expires, not at an exact time.
Per-request audit
The API does not provide per-request audit records, content digests, or export to a SIEM. Key metadata such as creation, last-use time, and revocation is available in the account's key list.
Data-handling terms
No zero-retention mode or deployment-specific data-processing guarantee is described here. Confirm applicable data-handling terms in writing before sending sensitive material.
Use Ultrac responsibly.
Use Ultrac for tasks you have the right to perform. Obtain authorization before accessing or testing someone else's systems. Account approval is not verification of your identity, organization, or authorization for a specific engagement.
Examples of supported tasks
In scope- Malware analysis, reverse engineering, and detection engineering
- Exploit reproduction and PoCs against systems you own or are authorised to test
- Threat intelligence, adversary emulation, purple-team exercises
- Incident response, forensics, and containment planning
- Vulnerability research and coordinated disclosure
- Coding, including code review
- Research, writing, document analysis, and problem solving
- Data analysis, workflow planning, and automation
Out of scope
Out of scope- Operations against systems you have no written authorisation to touch
- Fraud, extortion, or ransomware operations at any scale
- Bulk targeting of private individuals - surveillance, doxxing, stalkerware
- Credible mass-casualty uplift (CBRN)
- Sexual content involving minors
- Anything your jurisdiction reserves to a warrant you do not hold
Account approval permits access but does not verify identity or organization. Account holders can revoke their API keys. There is no organization-level admin access control or per-request audit export in the current application.
No dedicated or Sovereign deployment is currently provisioned. Isolation, jurisdiction, SSO/RBAC, retention, audit logging, and support arrangements are not available guarantees. Contact us to discuss requirements before sending sensitive material.
Contact usQuestions about access and data handling.
Review the available controls and their current limitations.
- So the model has no limits at all?
- No. Requests involving mass-casualty harm, sexual content involving minors, targeted harassment of private individuals, fraud, extortion, or unauthorized access remain out of scope. Ultrac is general-purpose unrestricted AI; these restrictions concern misuse, not the range of topics it supports.
- Doesn't this just relocate the risk into your vetting process?
- Account approval, account-bound API keys, rate limits, and key revocation are implemented. Per-request audit, organization-level access controls, and additional identity or data-handling controls are not currently available.
- What happens when someone with access misuses the service?
- An account holder can revoke an API key. The service does not provide a per-request audit export or organization-admin controls; do not rely on it as an incident-audit system.
- Can I get a dedicated or Sovereign deployment?
- No dedicated or Sovereign deployment is currently provisioned. Any future deployment would require separate technical and data-handling review; no residency, isolation, SSO/RBAC, retention, logging, or support guarantees should be assumed.
Review the terms before using Ultrac.
Contact us to confirm applicable data-handling terms before using Ultrac. Do not send sensitive material until those terms and the required controls are confirmed in writing.
access@ultrac.io · ZKLABS Software & Services Private Limited