NRP Acceptable Use Policy (web)

Citation

National Research Platform (NRP). “National Research Platform Acceptable Use Policy.” Draft 0.1, PDF, publication date unknown (the PDF file was made on Aug. 30, 2025). https://nrp.ai/NRP-AUP.pdf. Read 2026-10-15.

Bottom line

• The NRP Acceptable Use Policy (AUP) is a one-page user agreement. Users accept it at first access and “every 12 months thereafter”.
• It bans regulated data (“HIPAA, PII, CUI, FERPA”), use for “financial gain” and “any unlawful purpose”. NRP logs use for “administrative, operational, accounting, monitoring and security purposes”.
• The penalty is “loss of access”.

Background

NRP runs the Nautilus Kubernetes cluster from the San Diego Supercomputer Center (SDSC) at the University of California, San Diego. The NRP Policies (web) page says “You need to accept the AUP before using the cluster”.

Key claims

• “When you receive access to any of NRP services, and every 12 months thereafter, you will be asked to accept and re-acknowledge your responsibilities regarding use of systems and services of NRP. These provisions are in addition to any you are subject to at your institution.” (preamble)
• “Violations of this AUP may result in loss of access to NRP resources. Activities in violation of any laws will be reported to the proper authorities for investigation and prosecution.” (preamble)
• Data: “NRP does not provide services or resources that satisfy the security requirements for handling or processing HIPAA, PII, CUI, FERPA, or any other data protected by statute or data-use agreement. You agree to not introduce these types of data to NRP resources.” (item 1)
• No guarantee: “NRP does not guarantee that resources and services will be available, that they will suit every purpose, nor that data will never be lost or corrupted.” (item 2)
• Prohibited uses (item 4, read from the PDF text because the Markdown copy drops two bullets):
  • “financial gain”
  • “any unlawful purpose”
  • “attempt to breach or circumvent any NRP administrative controls or security controls”
  • “in violation of any agreement or terms-and-conditions of software or data introduced to these NRP resources.”
• “You agree to comply with all applicable laws and relevant regulations, such as export control laws and HIPAA.” (item 4)
• Reporting and backup: “You agree to immediately report any known or suspected security breach or misuse of your access to security [at] sdsc.edu You understand that you are responsible for backing up your data.” (item 5)
• Monitoring: “Logged information, including information provided by you for registration purposes, is used for administrative, operational, accounting, monitoring and security purposes.” The log data “cannot be deleted until it is naturally aged-out by a data-retention policy.” (item 6)
• Acknowledgment: publications must state, “This work used resources available through the National Research Platform (NRP) at the University of California, San Diego.” (item 7)

Evidence and method

This is a policy text. It has no data.

Limits

• The document says “Draft 0.1”. It may not be final.
• The ban on “financial gain” has no definition. It does not say if a startup or a company may use NRP.
• It names no steps between a violation and “loss of access”, such as a warning.
• It does not say how long logs are kept.