Acceptable useTwo things we will not host. The list does not grow.
Most acceptable use policies are four thousand words that reserve the right to terminate you for anything. This one names the two categories we refuse, names the conduct that damages other customers, and then tells you what everyone else quietly refuses and we do not.
Absolute, and exhaustive
Two categories. No notice, no refund, no argument.
These are the only two things you may not publish here, and they are the only case in which we act without a court order. Reports are verified by hand the hour they arrive, confirmed cases are terminated immediately, and the material is preserved for the authority with jurisdiction.
-
01
Child sexual abuse material
Any depiction of the sexual abuse of a minor, without exception or argument.
-
02
Terrorism
Material that finances, directs or incites terrorist violence.
There is no third item and there is no clause elsewhere in this document that creates one. Privacy is worth nothing if the list of exceptions can be extended by whoever complains loudest this quarter, so the number of terminations under this section is published every quarter in the transparency report.
Explicitly permitted
The things other hosts refuse without writing it down.
Almost every customer choosing an offshore host is choosing it for one specific item on this list, and almost every provider leaves that item unmentioned so they can change their mind later. Here it is named.
-
Adult content, legal in the jurisdiction Produced by consenting adults and lawful where it sits. No separate tier, no surcharge, no quiet suspension after the first complaint.
-
File hosting, seedboxes, archives, mirrors Including material somebody will send a notice about. A notice is correspondence and it is answered as correspondence.
-
Journalism, leak sites and document archives The category most likely to attract a legally aggressive complaint and the category most damaged by a host that folds on receipt of one.
-
Tor relays, exits, VPN endpoints and proxies Exits included, on dedicated hardware, with the reverse DNS set so other operators can see what it is. Tell us when you deploy one so abuse handling starts from the right assumption.
-
Cryptocurrency nodes, miners, indexers and exchanges No policy against any of it. Unmetered ports and no per-terabyte billing exist precisely for the workloads that would be repriced elsewhere.
-
Gambling, pharmacy and other licensed-elsewhere trades Lawfulness is decided by the jurisdiction of the entity hosting you and yours, not by the most restrictive country with an opinion about it.
-
Political speech, whatever its politics Unpopular, offensive and wrong are not grounds. Incitement to violence is, and that is a specific legal test rather than a judgement about the argument being made.
-
Security research, scanners and offensive tooling Building, hosting and distributing it, including exploit code. Pointing it at people who did not consent is what the conduct rules above are about.
Conduct, which is a different question entirely
Nothing below is about what you publish. It is about traffic that leaves our network and lands on somebody who did not ask for it — usually another one of our customers, whose service degrades because of a decision they had no part in.
- Outbound attacks
- No attack traffic leaves this network Volumetric floods, amplification, reflection, credential stuffing at scale. A rack that sources an attack gets the whole range filtered by other people, so this one is enforced immediately and without negotiation.
- Unsolicited bulk email
- No spam, from any address, at any volume Not a moral position: one spamming customer puts every address in the block on a reputation list, and the other customers on that block did nothing. Port 25 is closed by default and opened on request once you say what it is for.
- Open services
- No open resolvers, relays or amplifiers A misconfigured DNS resolver or NTP server is a weapon pointed at somebody else. We will tell you before we do anything about it, because it is almost always a mistake rather than a choice.
- Phishing and malware delivery
- No pages that impersonate a real party to harvest credentials Impersonating a bank, an exchange or a login page is fraud against an individual, and it is not a speech question. Malware command and control aimed at machines whose owners did not consent falls in the same place.
- Deliberate resource abuse
- Use what you bought Shared plans have neighbours. Sustained abuse of a shared node gets a conversation and an offer to move you to a dedicated one, not a silent throttle.
- Fraud against payment systems
- No carding, no stolen-instrument shops Trafficking in stolen payment instruments has an identifiable victim who never chose to be involved. Privacy protects people from surveillance; it is not cover for taking their money.
Why this list is not a content list
Every host that grew its rules grew them here first.
The pattern is always the same: a conduct rule about “abuse” is written loosely enough to cover unpopular material, and three years later it is being used for exactly that. So these rules describe packets and load, never subject matter, and the decision on any of them is a factual one an engineer can show you.
How a report is actually handled- No sole-discretion clause Nothing here ends with “or anything we consider inappropriate”.
- No suspension for a complaint A conduct finding needs traffic we can show you, not a letter about you.
- You are told what and when Which flow, which timestamp, which destination. Then a conversation.
What happens when something is wrong
Graduated, and slower than the industry, on purpose.
-
01
Immediately
The traffic stops, the service does not
An attack or a spam run is filtered at the border while we work out what happened. Your machine keeps running; what it is doing to other people does not.
-
02
Within the hour
You are told exactly what we saw
Flows, timestamps, destinations. Nine times in ten this is the first the customer hears that a machine of theirs has been compromised.
-
03
Days 1 – 7
You fix it, or we help you fix it
No charge for the help and no black mark for having been compromised. Being attacked successfully is not misconduct.
-
04
Only if it continues
Suspension, with the balance refunded
Sustained, deliberate abuse after a conversation ends the service. Unused balance is returned — we are not in the business of keeping money over a disagreement.
Before you deploy something contentious.
Can I run a Tor exit node?
Yes, on dedicated hardware, and please tell us when you deploy one so that abuse handling starts from the right assumption rather than treating exit traffic as yours. Set the reverse DNS and publish contact details in the relay descriptor: it makes every report about that address easier for everyone, including you.
Adult content — really, no separate tier?
Really. Lawful adult material produced by consenting adults is hosted on the same plans at the same prices as anything else. The industry practice of a "high-risk" tier at triple the rate is a risk premium for a risk the host has invented.
What about a site that will definitely receive complaints?
That is most of the reason this business exists. Complaints are handled by the process on the no-DMCA page: read, answered, forwarded to you with the complainant named, and acted on only when a court with jurisdiction says so.
Is my security tooling going to get me terminated?
Not for existing. You may build, host and distribute scanners, exploit code and offensive tooling. Running it against systems whose owners did not consent is what the conduct section prohibits, and that is a rule about your outbound traffic, not about your repository.
Why is port 25 closed by default?
Because an unattended open port 25 is the single most common way a new range acquires a reputation problem, and the customers who suffer for it are the ones who did nothing. Ask and it is opened — we just want to know a human is behind it.
Who decides whether something crosses a line?
A person, with the evidence in front of them, and you get to see the same evidence. There is no automated enforcement, no reputation score and no third-party list that can take your service down without anybody here having looked.
Could you add a third prohibition later?
Only in public and only with notice. The list is published, the count of terminations under it is published every quarter, and a change would be visible in both. A policy that can be expanded silently protects nobody, which is exactly why the number is on the transparency report.