Rules for every drill.

Family Drill is for household education on systems you control. An organizer activates one plain-language household agreement before surprise drills begin. Any member can ask the organizer to stop.

Required boundaries

• Invent the organization.Do not copy a bank, delivery service, government office, school, or any other real brand.
• Send honest mail.Use an authenticated From address on a domain you own. Do not forge headers or identities.
• Collect nothing sensitive.No passwords, codes, payment details, personal data forms, attachments, or downloads.
• Reveal the drill.Identify the drill immediately after engagement. Review a miss without punishment.
• Keep it in the household.No workplace campaigns, strangers, public targets, or people outside the household agreement.

What we refuse

We will not support phishing kits, real-brand impersonation, forged From headers, DKIM manipulation, credential harvesting, caller-ID spoofing, covert tracking, or delivery tactics meant to evade defenses. We will not connect SendGrid or another provider as a phishing-simulation service.