Acceptable use

Draft. Written by the team, not reviewed by a lawyer. It needs review before it is relied on in a dispute.

This is not boilerplate. We operate perimeter infrastructure for crypto and VPN projects, which are legitimate businesses that also attract people who are not running one. This document is what we point at when we disconnect someone, so it says plainly what is out of bounds and how fast we act.

Prohibited outright

Fraud against people. Phishing pages, fake wallets and exchanges, cloned login flows, sites that exist to take credentials or funds under a false identity. This includes hosting the page, the redirector, or the mail that delivers the link.

Malware and botnets. Distributing malware, or running command-and-control, loaders, droppers, or any part of the delivery chain.

Attacks from our infrastructure. Denial of service, credential stuffing, scanning at scale, or any unauthorised access attempt directed at third parties, whether or not the target is a customer of ours.

Child sexual abuse material. Reported to the authorities without notice to the customer and without waiting for a reply. There is no discussion of this one.

Spam. Bulk unsolicited mail, list-bombing, or sending on behalf of a party whose consent records cannot be produced. Applies equally to mail we help deliver and mail sent through infrastructure we operate.

Concealing the above. Fast-flux, domain rotation, or bulletproof-style reselling whose purpose is to keep the activities above running.

Requires a conversation first

Some legitimate work looks like the list above from outside. Tell us before you start, not after we notice:

• Penetration testing and red-team work against your own systems or with written authorisation from the target
• Security research, malware analysis, honeypots and sinkholes
• Anything that will generate sustained unusual outbound traffic

We are not looking for a reason to say no. We are looking to avoid taking your service down because it looked like an incident.

VPN and privacy services

We operate infrastructure for VPN providers and treat that as ordinary work. The customer remains responsible for what their users do and for having a process that responds to abuse reports about them. We do not require logging of user traffic, and we will not ask a provider to break their own privacy commitments.

What we do require is a working abuse contact that answers, and action on reports that concern the categories prohibited above.

How we respond

Immediate suspension, then notice: child sexual abuse material, active attacks originating from the infrastructure, and anything causing ongoing harm to third parties.

Notice, then suspension: everything else, with a deadline proportionate to the harm — typically 24 to 72 hours to fix or explain.

We do not issue warnings we do not intend to act on, and we do not quietly degrade service instead of telling you.

Reporting abuse

Write to abuse@rxt.sh with the domain or address, what you observed, and when. Reports are read by a person. Include enough that we can verify it ourselves; we do not act on an assertion alone, except for the immediate-suspension categories above.