Acceptable Use Policy
Rules for lawful, fair, and safe use of Codexvert infrastructure — including quantified fair use, KYC-gated email, nested virtualization throttling, and guardian-consented minor access.
1. Scope and Purpose
This Acceptable Use Policy ("AUP") sets binding rules for all Codexvert services, including VPS, game servers, web hosting, cPanel, and mail hosting. It is incorporated into the Terms of Service. Violations may result in warning, throttling, suspension, or termination and may be reported to law enforcement where required, particularly for child safety and critical abuse.
2. General Principles
- You are responsible for all activity originating from your account, servers, IP addresses, and mailboxes, including activity by your end-users, contractors, and customers.
- You must use services lawfully under Indian law and in compliance with applicable laws of your jurisdiction where they impose higher standards.
- You must not attempt to circumvent quotas, cgroup limits, billing, rate-limits, authentication, or security controls.
3. Minor and Guardian-Consented Use
Account ownership is generally restricted to individuals 18 years or older. For Minecraft / Game Hosting and Web Hosting only, individuals aged 13 to 17 may own an account subject to verified parental or legal guardian consent and assumption of full liability. The guardian's email and identity proof are recorded, and the guardian receives all abuse and billing notices. VPS, Mail Hosting, cPanel reseller services, and Nested Virtualization remain strictly 18+ even with guardian consent.
4. Prohibited Activities
| Category | Rule |
|---|---|
| Child Safety (CSAM) | Zero tolerance. Any hosting, storage, or transmission of child sexual abuse material results in immediate permanent termination, preservation of evidence for a minimum 90 days, and reporting to law enforcement under POCSO and IT Act. |
| Illegal Content | Content unlawful under Indian law. For foreign illegality, double illegality (unlawful both in India and access jurisdiction) is required for enforcement to prevent over-refusal. |
| Malware & C2 | Distribution of malware, ransomware, keyloggers, exploits, or operation of command-and-control infrastructure is prohibited. |
| Phishing & Fraud | Phishing pages, credential harvesting, fake payment portals, and scams are prohibited. |
| DDoS & Attacks | Denial-of-service, amplification attacks, unauthorized scanning, brute-force, credential stuffing, IP spoofing are prohibited. |
| Cryptocurrency Mining | Completely prohibited on all shared infrastructure, including inside nested guests and containers. Detected via host-level MSR, CPU scheduler steal heuristics, and power telemetry. First confirmed offense results in immediate termination without refund for Critical abuse and 90-day evidence hold. |
| Copyright Infringement | Hosting or distributing infringing content is subject to notice-and-takedown via the Copyright & DMCA Policy. |
5. Enforcement Ladder, Severity, and Reseller Safe Harbor
Enforcement escalates based on severity:
- Critical (CSAM, phishing, malware C2, active DDoS, cryptomining): response target within 1 hour, immediate quarantine or suspension, 90-day evidence hold.
- High (port scanning, credential attacks, spam spikes, repeat copyright): response within 4 hours, rate-limit or temporary quarantine.
- Medium (misconfiguration, single low-confidence notice, quantified fair-use): warning and monitoring within 24 hours.
Creating multiple accounts to circumvent limits, promotions, suspensions, or abuse measures is prohibited and will result in merging and termination of evading accounts. Legitimate multi-accounts for separate legal entities or family members at the same IP are permitted if declared via Paymenter ticket with distinct email, KYC, and payment instrument.
6. Resource Usage and Quantified Fair Use
Shared services operate on multi-tenant nodes. Sustained operation beyond plan allocation that degrades neighboring tenants constitutes a fair-use violation.
Quantified Definition: "Sustained overuse" means consumption exceeding 85% of allocated vCPU, RAM, disk I/O, or bandwidth for more than 6 hours per day across 3 or more consecutive days, corroborated by hypervisor evidence of neighbor degradation (CPU steal time greater than 10% or iowait greater than 20%). A single continuous burst of up to 8 hours for legitimate workloads, such as video rendering, is not a violation.
Enforcement: first occurrence warning with upgrade recommendation, second within 7 days throttling to plan limits, third suspension pending review.
6.1 DDoS Mitigation Included
DDoS attacks mitigated at the edge via Cloudflare Magic Transit are included in uptime calculations. Only attacks exceeding 500 Gbps or attacks succeeding due to customer origin leak or DNS bypass are excluded from SLA calculations.
7. Nested Virtualization Rules
- Running a hypervisor inside your VPS without the paid addon is a violation.
- Default 20% Throttle: All VPS with nested virtualization enabled are limited to 80% of allocated CPU and RAM via cgroup. This preserves node health.
- Performance Unlock: Customers may restore 100% allocation by purchasing the Performance Unlock addon priced at 20% of the current VPS plan fee per cycle. The unlock is optional.
- Subdivision and Reselling: Partitioning a single VPS to resell independent VPS or hosting services is prohibited unless Performance Unlock is active, prior written approval has been obtained via Paymenter with a designated abuse contact, and a minimum 20% resource overhead is maintained at all times.
- Nested workloads, including inside nested guests, remain subject to mining prohibition and fair-use caps. Mining detection applies at host level even inside nested VMs.
- Implementation requires authenticated request: initiation via Paymenter, email, Discord, or WhatsApp is allowed, but final implementation requires confirmation via a unique link sent to the registered email, expiring in 2 hours, with 2FA verification if enabled. Guest OS may be specified as "TBD – Benchmarking" to allow evaluation, with one free OS change within 72 hours.
8. Email and Mail Rules – KYC-Gated SMTP
Once approved, explicit rate limits apply and are visible in the control panel: 100 emails per hour for new accounts under 30 days, 500 per hour for established accounts in good standing, 2,000 per day hard cap per IP, with 20% burst allowance for 5 minutes. Bulk sending exceeding 100 recipients requires valid SPF, DKIM, DMARC, rDNS, and List-Unsubscribe header. Compromised mailboxes may be automatically locked.
Unsolicited bulk email, open relays, and sending from forged or unowned domains are prohibited at all times.
9. Network Security
- No IP spoofing, MAC spoofing, ARP poisoning, or host impersonation.
- No operation of open proxies, open resolvers, or other abuse-enabling services.
- Maintain patched OS, applications, and control panels free of default credentials and respond promptly to security notices.
10. Game Server Rules
Mods, plugins, and jars are permitted provided they do not attack the panel, node, or other tenants. Cryptomining on game servers is prohibited and results in immediate termination on first offense. DDoS-protected ports are as assigned; proxying attacks onto shared infrastructure is prohibited. Snapshots are provided as same-node convenience and are not off-site backups; the Paymenter panel displays a warning to maintain off-site backups.
11. Reselling
See Section 5 Safe Harbor and Section 7 subdivision rules. Resellers remain fully responsible for compliance unless safe harbor demonstration is completed within 24 hours.
12. Cooperation and Law Enforcement
Codexvert cooperates with lawful requests from Indian authorities under the Information Technology Act 2000 including sections 69, 69A, 79, 67C, and under CrPC §91, BNSS §94-95, and POCSO, subject to strict verification: official government domain email, officer identity card, station letterhead, FIR or case number verifiable via CCTNS, and mandatory callback to a published official number. Requests lacking verification are declined or referred for court order. Foreign requests, including foreign emergencies, are handled exclusively via Mutual Legal Assistance Treaties and letters rogatory; foreign emergency requests are forwarded to the Indian nodal officer within 6 hours without direct disclosure to a foreign entity unless directed by an Indian court.
Evidence preservation follows the hierarchy defined in the Terms of Service: court and law enforcement preservation orders of 90 to 180 days pause deletion, followed by Critical abuse evidence hold of minimum 90 days, followed by DPDP erasure requests, followed by standard 7-day billing termination. Emergency disclosures without prior notice are documented, logged, and followed by customer notification within 72 hours unless prohibited by an explicit gag order bearing a court docket number.
Built for the infrastructure behind your ideas.