Acceptable Use Policy

An acceptable use policy on a no-KYC host might look like a contradiction. It is not, and the reasoning is worth stating.

Transit providers disconnect networks that host criminal infrastructure. When that happens every customer on the network loses service, including the journalist, the researcher and the person running a VPN for their family. Enforcing this policy is what protects those customers. A host that tolerates malware is not being generous to its users; it is spending their uptime.

Beyond that: a privacy position is worth defending publicly and we intend to keep defending it. Conflating privacy with impunity is the single most effective way to lose that argument, and we are not going to help.

The following result in immediate suspension without notice and without refund, in every location including all 4 marked DMCA-ignored:

• Child sexual abuse material. Any involvement whatsoever. Reported to the relevant authority. No notice, no appeal, no refund.
• Spam and unsolicited bulk email, including snowshoe operations, list-washing, and hosting infrastructure that supports a spam operation run elsewhere.
• Phishing and credential harvesting, including sites impersonating banks, exchanges, hosting providers or any other party.
• Malware — hosting, distribution, or command-and-control. Includes ransomware panels, stealer infrastructure, loaders and botnet controllers.
• Denial-of-service attacks originating from our network, and booter, stresser or DDoS-for-hire services.
• Carding, fraud and stolen-data marketplaces, including infrastructure processing stolen payment data.
• Unauthorised access to third-party systems, including credential-stuffing and exploitation without written authorisation from the target.
• Anything criminal under the law of the country hosting the server.

Because other providers restrict these and customers reasonably ask:

• Tor relays and bridges in every location. Tor exit relays in the Netherlands, Iceland, Romania and Moldova; not in the United States location.
• VPN endpoints, personal or commercial, in every location.
• Cryptocurrency nodes, validators and mining pools. Proof-of-work mining on shared VPS hardware is not permitted, for the ordinary reason that it degrades neighbours.
• Adult content that is lawful in the hosting jurisdiction and involves only consenting adults.
• Torrent traffic and seedboxes in Iceland, Moldova, Panama and Seychelles, where a US copyright notice has no legal force and no local mechanism behind it, and in our 3 EU sites (the Netherlands, Romania and Bulgaria), where it is equally permitted but a complaint substantiated under the Digital Services Act is assessed and passed to you rather than ignored. Not in the United States location.
• Security research — scanners, honeypots, malware analysis sandboxes and authorised red-team infrastructure. Written authorisation from the target is required for anything touching third-party systems, and we will ask to see it.
• Mail servers, subject to the anti-spam provisions above. Reverse DNS is configurable and we will help with deliverability.
• Content critical of governments, corporations or individuals, subject to the law of the hosting jurisdiction.

Handling depends entirely on the jurisdiction hosting the server.

• Iceland, Moldova, Panama and Seychelles: a US copyright notice is logged and forwarded to you for information, and no action is taken on the notice itself, because it carries no legal force in these countries and no local instrument stands behind it.
• Our EU Member State sites — the Netherlands, Romania and Bulgaria: a US notice has no direct force in any of them either, but all 3 are inside the Union, so Art. 16 of the Digital Services Act (Regulation (EU) 2022/2065) obliges us to accept a complaint about a customer's server and to deal with what it says. A complaint precise and substantiated enough to meet Art. 16(2) leaves us knowing it, and Art. 6(1) withdraws our liability exemption if we do not then act. In these locations we therefore assess substantiated complaints on their merits, tell you what arrived and give you a reasonable opportunity to respond before anything happens. We do not suspend on receipt, and we cannot promise that only a local court order will ever move us.
• The United States: full DMCA safe-harbour procedure applies, including takedown and counter-notice. This is stated plainly on the location page before you order.

A court order from a court with jurisdiction over the hosting facility is honoured in every location without exception. Details on the DMCA policy page.

Shared infrastructure requires some limits, and ours are deliberately generous:

• Sustained CPU use at 100% across all cores for more than 24 hours on a shared node may prompt a conversation about moving to dedicated hardware. We contact you first.
• Proof-of-work mining is not permitted on shared VPS hardware. It is permitted on dedicated servers.
• Exceeding your bandwidth allowance throttles the port to 10 Mbps for the remainder of the month. We do not bill overage and we do not suspend for transfer.
• Disk I/O patterns that materially degrade neighbours are rate-limited rather than terminated, and you are told when it happens.

Immediate-suspension categories (section 2): suspended on verification, notified afterwards, no refund. Verification means we confirmed the material or activity ourselves — we do not act on an unverified accusation.

Everything else: you receive a description of what we observed and, where the harm allows it, 48 hours to remediate. Most cases are compromised servers rather than malicious customers, and most are resolved by the customer patching and rotating credentials.

Appeals: reply to the suspension notice. A different engineer reviews it. We have reversed suspensions and will say so when we were wrong.

Report abuse to [email protected]. Reports including evidence — logs with timestamps and timezone, headers, packet captures — are actioned considerably faster than assertions.