Acceptable Use Policy

This Acceptable Use Policy ("AUP") sets out the rules for using services provided by PrivyNet Ltd ("PrivyNet", "we", "our", "us"). It is designed to protect our infrastructure, our customers, and the wider internet community.

This AUP applies to:

• All PrivyNet services, including shared VPN access, dedicated VPN infrastructure, APIs, and related services.

• All users of your account, including employees, contractors, and any third parties you grant access to.

• All account types, including paid services, trials, and any free tiers (if offered).

• All traffic transmitted through, and content stored on, our infrastructure.

This AUP forms part of our Terms of Service. Violations may result in suspension, termination, or other enforcement actions as described in Section 12.

By using our services, you agree to comply with this AUP. If you do not agree, you must not use our services.

You must not use PrivyNet services to engage in, facilitate, or promote any illegal activities, including but not limited to:

General Violations:

• Violating any applicable UK, EU, or international laws or regulations.

• Engaging in fraud, identity theft, money laundering, or financial crimes.

• Evading law enforcement or regulatory investigations.

• Facilitating illegal gambling, unlicensed financial services, or other regulated activities without proper authorisation.

Computer Misuse Act 1990 Violations:

• Attempting to gain unauthorised access to any computer, system, network, or data ("hacking").

• Impairing the operation of any computer or system without authorisation.

• Creating, distributing, or using tools designed to facilitate unauthorised access or computer misuse.

• Assisting or encouraging others to engage in computer misuse.

Intellectual Property Violations:

• Infringing copyrights, trademarks, patents, or other intellectual property rights.

• Distributing pirated software, media, or other copyrighted content at scale.

• Operating services that facilitate large-scale copyright infringement (e.g., torrent indexing for pirated content).

PrivyNet reserves the right to cooperate with law enforcement authorities investigating potential criminal activity, and to report suspected crimes to appropriate authorities.

Unauthorised security testing, scanning, or probing of third-party systems is strictly prohibited.

Prohibited Activities:

• Port scanning, vulnerability scanning, or penetration testing of any systems, networks, or services you do not own or have explicit written permission to test.

• Attempting to bypass authentication, authorisation, or security controls on third-party systems.

• Probing, scanning, or testing the security of PrivyNet infrastructure without prior written authorisation.

• Running automated tools that generate excessive requests or traffic to third-party services (e.g., brute-force attacks, credential stuffing).

Testing Your Own Systems:

You may conduct security testing on systems you own or control, or where you have explicit written authorisation from the owner, subject to the following conditions:

• Your testing must not impact PrivyNet infrastructure or other customers.

• Your testing must comply with all applicable laws.

• You must not use our services to mask the origin of attacks on third parties.

Responsible Disclosure:

If you discover a security vulnerability in PrivyNet services, please report it responsibly to security@privynet.co.uk. Do not attempt to exploit vulnerabilities or access data beyond what is necessary to demonstrate the issue.

Authorised Testing:

If you require permission to conduct security testing that may affect our infrastructure, contact us in advance at security@privynet.co.uk to discuss scope and obtain written authorisation.

You must not use PrivyNet services to launch, participate in, or facilitate security threats, including:

Denial of Service (DoS/DDoS):

• Launching or participating in denial-of-service attacks against any target.

• Using our infrastructure as part of a botnet or coordinated attack network.

• Amplification attacks, reflection attacks, or any traffic designed to overwhelm targets.

• Using "booter" or "stresser" services through our infrastructure.

Malware & Harmful Code:

• Creating, distributing, hosting, or controlling malware, viruses, trojans, ransomware, spyware, or other harmful code.

• Operating command-and-control (C2) infrastructure for malware or botnets.

• Distributing exploit kits, rootkits, or other hacking tools designed to compromise systems.

• Hosting phishing kits, credential harvesting pages, or fake login portals.

Network Intrusion:

• Intercepting, monitoring, or capturing network traffic not intended for you ("packet sniffing") without authorisation.

• Spoofing IP addresses, MAC addresses, or other network identifiers to impersonate others or evade detection.

• Man-in-the-middle attacks or traffic interception.

• Exploiting network protocols or infrastructure vulnerabilities.

Credential Abuse:

• Credential stuffing, brute-force attacks, or password spraying against any service.

• Trading, selling, or distributing stolen credentials or personal data.

• Operating services that facilitate credential theft or account takeover.

You must not use PrivyNet services for email or messaging abuse, including:

Spam & Bulk Messaging:

• Sending unsolicited bulk email ("spam"), regardless of content.

• Sending unsolicited commercial messages or advertisements.

• Operating mailing lists without proper consent and unsubscribe mechanisms.

• Chain letters, pyramid schemes, or similar mass-messaging activities.

Email Infrastructure Abuse:

• Operating open mail relays that can be exploited by spammers.

• Forging, spoofing, or falsifying email headers, sender addresses, or routing information.

• Sending email with deceptive subject lines or misleading content.

• Harvesting email addresses from websites or other sources without consent.

Phishing & Fraud:

• Sending phishing emails designed to steal credentials, personal information, or financial data.

• Impersonating legitimate organisations, individuals, or services via email.

• Operating fake customer support or technical support scams.

• Social engineering attacks conducted via email or messaging.

Messaging Platforms:

These rules apply equally to other messaging systems (SMS, instant messaging, push notifications, etc.) used through or in connection with our services.

If you operate legitimate email services through our infrastructure, you must:

• Implement proper authentication (SPF, DKIM, DMARC).

• Maintain up-to-date abuse handling procedures.

• Promptly respond to abuse complaints.

• Comply with applicable anti-spam laws (e.g., PECR, CAN-SPAM).

You must not abuse PrivyNet resources in ways that degrade service quality for other customers or violate the intended use of our services.

Bandwidth & Network Abuse:

• Consuming excessive bandwidth in a manner that negatively impacts other customers or our infrastructure.

• Generating sustained high traffic volumes that exceed reasonable use for your service tier.

• Connection flooding, SYN floods, or other traffic patterns designed to exhaust resources.

• Using our VPN services for large-scale data scraping, crawling, or harvesting without authorisation.

Prohibited Resource Uses:

• Cryptocurrency Mining: Using PrivyNet infrastructure for cryptocurrency mining, proof-of-work calculations, or similar computationally intensive activities is strictly prohibited unless explicitly authorised in writing.

• Tor Exit Nodes: Operating Tor exit nodes on our infrastructure is prohibited due to the abuse and legal risks associated with exit traffic.

• Open Proxies: Running open proxy servers that can be used by unauthorised third parties is prohibited.

• File Sharing Hubs: Operating public file-sharing services, torrent trackers, or similar services that attract high volumes of potentially infringing traffic.

Automation & Bots:

• Running automated tools, bots, or scripts that generate excessive load or violate third-party terms of service.

• Automated account creation, scraping, or data extraction at scale.

• Activities that cause our IP addresses to be blocklisted or flagged for abuse.

IP Reputation:

You must not engage in activities that damage the reputation of our IP address ranges, including:

• Activities that cause our IPs to appear on spam blocklists or abuse databases.

• Traffic patterns that trigger abuse reports from third parties.

• Activities that cause ISPs or services to block our IP ranges.

We reserve the right to monitor usage patterns and take action, including rate-limiting, suspension, or termination, if your usage negatively impacts our infrastructure or other customers.

You must not use PrivyNet services to store, host, transmit, or distribute prohibited content, including:

Absolutely Prohibited (Zero Tolerance):

• Child Sexual Abuse Material (CSAM): Any content depicting or promoting child sexual abuse is strictly prohibited. We will immediately terminate accounts, preserve evidence, and report to law enforcement (NCMEC, IWF, NCA, or local authorities).

• Terrorism & Extremism: Content that promotes, supports, or facilitates terrorism, violent extremism, or terrorist organisations.

Other Prohibited Content:

• Malicious Content: Malware, exploit code, phishing pages, or other content designed to harm users or systems.

• Harassment & Doxxing: Content that harasses, threatens, stalks, or publishes private information about individuals without consent ("doxxing").

• Hate Speech: Content that promotes hatred, discrimination, or violence based on race, ethnicity, religion, gender, sexual orientation, disability, or other protected characteristics.

• Illegal Goods & Services: Content facilitating the sale of illegal drugs, weapons, counterfeit goods, stolen property, or other contraband.

• Fraud & Scams: Phishing pages, advance-fee fraud schemes, fake investment platforms, or other deceptive content.

• Defamation: Content that is knowingly false and defamatory, published with intent to harm.

• Non-Consensual Intimate Images: Intimate images shared without the consent of the depicted individual ("revenge porn").

• Animal Abuse: Content depicting or promoting animal cruelty.

Infringing Content:

• Content that infringes copyrights, trademarks, or other intellectual property rights.

• We respond to valid DMCA and equivalent takedown notices. Repeat infringers will have their accounts terminated.

We do not proactively monitor all content, but we may take action upon receiving complaints, abuse reports, or legal requests, or upon discovering violations.

As a PrivyNet customer, you have the following responsibilities:

Account Security:

• Maintain strong, unique passwords for your account. We strongly recommend enabling multi-factor authentication (MFA) if available.

• Keep your credentials confidential and do not share them with unauthorised individuals.

• Notify us immediately at support@privynet.co.uk if you suspect unauthorised access to your account.

• Regularly review account activity and access logs.

Contact Information:

• Maintain an accurate and up-to-date email address in your account settings.

• Respond promptly to communications from PrivyNet regarding security, abuse, or policy matters.

• Ensure you receive and review notifications from us.

User Compliance:

• You are responsible for ensuring that all users of your account (employees, contractors, customers, or any third parties you grant access to) comply with this AUP.

• You are responsible for all activity conducted through your account, whether authorised by you or not.

• If you provide services to third parties using our infrastructure, you must have your own acceptable use policies and enforce them.

Workload Security:

• You are responsible for securing any applications, workloads, or services you deploy on our infrastructure.

• Keep software, operating systems, and dependencies up to date with security patches.

• Implement appropriate access controls, encryption, and security measures for your workloads.

• Monitor your workloads for signs of compromise or abuse.

Incident Reporting:

• Promptly report any security incidents, suspected breaches, or AUP violations to abuse@privynet.co.uk.

• Cooperate with PrivyNet during investigations of security incidents or abuse complaints.

• Preserve relevant logs and evidence when requested.

You must not attempt to compromise the integrity, availability, or security of PrivyNet services or infrastructure.

Prohibited Activities:

• Attempting to access systems, data, or accounts that you are not authorised to access.

• Circumventing or attempting to circumvent usage limits, quotas, rate limits, or access controls.

• Interfering with or disrupting PrivyNet services, servers, or networks.

• Attempting to probe, scan, or test the vulnerability of our systems without prior written authorisation.

• Introducing malware, backdoors, or other malicious code into our infrastructure.

• Attempting to overload, crash, or degrade the performance of our systems.

• Evading monitoring, logging, or security controls.

• Creating multiple accounts to circumvent enforcement actions, abuse limits, or evade detection.

• Reselling, sublicensing, or providing access to our services without authorisation.

Cooperation:

You agree to cooperate with PrivyNet in investigating suspected violations of this AUP or security incidents affecting our infrastructure.

Monitoring:

We may monitor usage patterns, traffic, and system activity to detect and prevent abuse, ensure service quality, and protect our infrastructure. We do not monitor the content of encrypted traffic, but we may analyse metadata and traffic patterns.

If you become aware of a violation of this AUP, or if you are affected by abuse originating from PrivyNet infrastructure, please report it to us.

How to Report:

• Email: abuse@privynet.co.uk

• Subject Line: Include "AUP Violation" or "Abuse Report" and a brief description.

What to Include:

To help us investigate efficiently, please provide:

• Your contact information (name, email, organisation).

• Date and time of the incident (with timezone).

• IP addresses or identifiers involved.

• Description of the abuse or violation.

• Relevant logs, screenshots, headers, or other evidence.

• Any harm or impact you have experienced.

Our Response:

• We aim to acknowledge abuse reports within 24 hours on business days.

• We will investigate reports promptly and take appropriate action.

• Due to privacy and legal constraints, we may not be able to share details of our investigation or actions taken.

False Reports:

Submitting knowingly false or malicious abuse reports is itself a violation of this AUP and may result in action against your account.

Legal Requests:

For law enforcement or legal requests, please contact legal@privynet.co.uk with appropriate documentation (e.g., court orders, subpoenas, production orders).

Violations of this AUP may void your Service Level Agreement (SLA) entitlements.

SLA Voidance:

If your account is suspended or services are affected due to an AUP violation:

• You are not entitled to SLA credits for any downtime during the suspension.

• Any scheduled maintenance or service actions taken to address abuse are excluded from SLA calculations.

• Service credits will not be issued for enforcement actions taken in response to AUP violations.

This ensures that customers cannot claim SLA credits when service interruptions result from their own policy violations.

Remediation Period:

• If we notify you of an AUP violation and request remediation, you must resolve the issue within the timeframe specified (typically 24-72 hours, depending on severity).

• Failure to remediate may result in continued suspension or termination.

• For severe violations (e.g., CSAM, active attacks, law enforcement requests), immediate termination may occur without a remediation period.

Repeat Violations:

• Repeat violations may result in immediate termination without prior warning.

• We maintain records of AUP violations and may consider past behaviour when taking enforcement action.

• Accounts terminated for AUP violations may be prohibited from creating new accounts.

PrivyNet takes violations of this AUP seriously and may take any of the following enforcement actions:

Range of Actions:

Depending on the nature and severity of the violation, we may:

• Issue a warning and request that you cease the prohibited activity.

• Require you to remediate the violation within a specified timeframe.

• Remove, disable, or block access to prohibited content.

• Rate-limit, throttle, or restrict your services.

• Blackhole traffic, block ports, or null-route IP addresses.

• Suspend your account or specific services (temporarily or indefinitely).

• Reset credentials or revoke API keys.

• Terminate your account permanently.

• Cooperate with law enforcement, regulators, or affected third parties.

• Report suspected crimes to appropriate authorities.

• Pursue civil remedies or refer matters for criminal prosecution.

Immediate Action:

We reserve the right to take immediate action, without prior notice, where we reasonably believe:

• Immediate action is necessary to protect our infrastructure, other customers, or third parties.

• Your account is being used for illegal activity.

• We are required to act by law or legal process.

• Delay would cause irreparable harm.

We will notify you as soon as practicable after taking emergency action and, where appropriate, provide an opportunity to respond or remediate.

No Liability:

PrivyNet shall not be liable for any damages arising from enforcement actions taken in good faith to address AUP violations.

Appeals:

If you believe an enforcement action was taken in error, you may submit an appeal to legal@privynet.co.uk within 14 days. Include your account details, the action taken, and your explanation. We will review appeals in good faith but are not obligated to reinstate terminated accounts.

We may update this Acceptable Use Policy from time to time to address new threats, technologies, legal requirements, or operational needs.

Notification of Changes:

• Material Changes: For significant changes that affect your rights or obligations, we will provide at least 14 days' notice via email and/or notice on our website before the changes take effect.

• Minor Changes: For clarifications, formatting, or non-material updates, we may update the policy without individual notice.

Effective Date:

The "Last Updated" date at the top of this policy indicates when it was last revised. The current version is always available on our website.

Continued Use:

Your continued use of our services after changes take effect constitutes acceptance of the revised AUP. If you do not agree to the changes, you should discontinue use of our services before the effective date.

Review Recommendation:

We recommend reviewing this policy periodically, especially before engaging in new activities that may be affected by AUP rules.

Questions:

If you have questions about whether a specific activity is permitted under this AUP, contact us at abuse@privynet.co.uk before proceeding. We are happy to provide guidance where possible.

If you have questions about this Acceptable Use Policy, need to report abuse, or require clarification on permitted activities, please contact us:

Abuse Reports:

• Email: abuse@privynet.co.uk

• Use for: AUP violations, spam, attacks, prohibited content, security incidents originating from our infrastructure.

Security Issues:

• Email: security@privynet.co.uk

• Use for: Reporting vulnerabilities in PrivyNet systems, responsible disclosure, security testing authorisation requests.

General Support:

• Email: support@privynet.co.uk

• Use for: Account questions, technical support, service enquiries.

Legal & Law Enforcement:

• Email: legal@privynet.co.uk

• Use for: Legal requests, court orders, subpoenas, law enforcement enquiries.

Response Times:

• Abuse reports: Acknowledged within 24 hours (business days).

• Security issues: Acknowledged within 24 hours.

• General enquiries: Within 5 business days.

We appreciate your cooperation in helping us maintain a safe and reliable service for all customers.