Acceptable Use Policy (AUP)

1. Purpose

This Acceptable Use Policy (“AUP” or “Policy”) governs the use of the cloud infrastructure, hosting, computing, storage, networking, and related services provided by inhosted.ai (“inhosted.ai,” “we,” “us,” or “our”).

Our Services may include GPU and CPU cloud servers, virtual machines, dedicated servers, object and block storage, networking, IP addresses, cloud firewalls, load balancers, virtual routers, snapshots, backups, managed databases, APIs, and related infrastructure services.

This Policy is intended to protect our infrastructure, customers, networks, employees, service providers, and third parties from unlawful, abusive, harmful, or unauthorized activity.

By accessing or using our Services, you agree to comply with this Policy, our Terms of Service, and any applicable service-specific agreement.

2. Scope and Applicability

This Policy applies to all customers, account holders, authorized users, administrators, developers, contractors, and other individuals or entities accessing or using our Services.

It applies to all activities conducted through or in connection with our infrastructure, including:

• Virtual machines, GPU instances, CPU instances, and dedicated servers.
• Applications, containers, workloads, and hosted websites.
• Object storage, block storage, snapshots, backups, and databases.
• Public and private IP addresses, virtual networks, firewalls, and routing.
• Load balancers, APIs, automation tools, and management interfaces.
• Customer Content, network traffic, and resources provisioned through the platform.

Customers are responsible for ensuring that their authorized users, applications, and workloads comply with this Policy.

3. Lawful Use

You may use our Services only for lawful purposes and in compliance with applicable laws and regulations.

You must not use our infrastructure to:

• Commit, facilitate, or promote criminal activity.
• Violate applicable cybersecurity, privacy, data-protection, or intellectual-property laws.
• Conduct fraud, identity theft, impersonation, or financial scams.
• Distribute unlawful content or facilitate unlawful transactions.
• Circumvent legally imposed restrictions or valid court orders.
• Violate another person's privacy, confidentiality, or legal rights.
• Facilitate unauthorized access to systems, networks, accounts, or information.
• Operate activities that expose our infrastructure or other customers to material legal, security, or operational risks.

You are responsible for determining whether your intended use of the Services is lawful in the jurisdictions applicable to your activities.

4. Prohibited Cybersecurity Activities

You must not use our Services to conduct or facilitate unauthorized cyber activity.

Prohibited activities include:

• Unauthorized access to computers, servers, networks, databases, or accounts.
• Deploying malware, ransomware, spyware, credential stealers, or destructive code.
• Conducting denial-of-service attacks, distributed denial-of-service attacks, or other deliberate service-disruption activity.
• Performing unauthorized vulnerability scanning, exploitation, or penetration testing.
• Stealing credentials, session tokens, encryption keys, or confidential information.
• Creating, distributing, or operating botnets for malicious purposes.
• Exploiting software vulnerabilities to gain unauthorized access or privileges.
• Evading security controls to conduct prohibited activities.
• Interfering with another customer's workloads, data, or infrastructure.

Security research and penetration testing are permitted only where you have the necessary authorization from the relevant system owner and comply with applicable law and any conditions imposed by that owner.

5. Network Abuse and IP Address Misuse

You must use network resources provided by inhosted.ai responsibly and in accordance with your service plan.

You must not:

• Generate malicious or unauthorized network traffic.
• Conduct IP spoofing, unauthorized traffic redirection, or route manipulation.
• Abuse public IP addresses, network gateways, or shared networking infrastructure.
• Operate open proxies or relays for abusive or unlawful purposes.
• Use infrastructure to facilitate spam, phishing, credential theft, or malicious redirection.
• Interfere with routing, DNS, firewall, or network-control systems.
• Circumvent applicable network restrictions or security controls.
• Use network resources in a manner that materially disrupts other customers or third-party networks.

You are responsible for configuring your network interfaces, routing rules, firewall policies, exposed ports, and access controls appropriately.

6. Spam, Phishing, and Fraud

You must not use our Services to send, host, distribute, or facilitate:

• Unsolicited bulk messages that violate applicable law or recipient requirements.
• Phishing emails, fraudulent websites, or deceptive login pages.
• Email spoofing, impersonation, or fraudulent communications.
• Credential harvesting, payment scams, or identity theft.
• Malicious links, fraudulent downloads, or deceptive advertisements.
• Automated abuse of online forms, platforms, or communication systems.
• Activities intended to evade spam detection, abuse reporting, or legitimate security controls.

Legitimate business communications, transactional email, and authorized bulk messaging may be permitted where they comply with applicable law, recipient permissions, provider requirements, and relevant sending limits.

7. Malware and Malicious Workloads

You must not deploy or use our infrastructure to create, distribute, control, or operate malicious software or infrastructure intended for unlawful or unauthorized activity.

This includes ransomware operations, malicious command-and-control systems, destructive payloads, unauthorized botnets, and infrastructure designed to facilitate cyberattacks.

Security analysis, malware research, digital forensics, and defensive testing may be permitted in appropriately authorized and isolated environments, subject to applicable law, service restrictions, and any additional approval requirements communicated by inhosted.ai.

Customers must take reasonable precautions to prevent their workloads from becoming compromised or being used to harm others.

8. GPU, CPU, and High-Performance Computing Workloads

Our GPU, CPU, and high-performance computing resources may be used for lawful activities such as artificial intelligence, machine learning, inference, rendering, scientific computing, data analysis, simulation, software development, and other permitted workloads.

You must not use computing resources to:

• Conduct unauthorized attacks or computational abuse.
• Circumvent resource limits, quotas, metering, or technical controls.
• Deliberately interfere with shared infrastructure or other customers' performance.
• Exploit platform vulnerabilities to obtain unauthorized compute resources.
• Run workloads that violate applicable law or the terms of your selected Service.
• Conceal prohibited activity through deceptive workload configurations.

You must comply with the resource limits, fair-use conditions, capacity restrictions, and technical requirements applicable to your plan.

8.1 Cryptocurrency Mining

Cryptocurrency mining and other blockchain-related computing are permitted only where expressly allowed by the applicable product terms, plan, or written authorization from inhosted.ai.

Where permitted, such activities remain subject to resource limits, energy and capacity constraints, security requirements, billing terms, and applicable law.

Do not assume that cryptocurrency mining is permitted on every GPU, CPU, or dedicated-server offering.

9. AI, Machine Learning, and Model Hosting

Customers may use supported infrastructure for lawful AI training, model inference, experimentation, and deployment.

You must not use our Services to develop, host, or operate AI systems for unlawful purposes, including:

• Fraud, impersonation, or deceptive credential collection.
• Unauthorized surveillance or unlawful processing of personal information.
• Generating or distributing malicious software for unauthorized use.
• Automating cyberattacks, harassment, or other prohibited conduct.
• Violating intellectual-property rights or applicable data-protection requirements.
• Evading applicable legal restrictions or platform-specific safeguards.

You are responsible for ensuring that datasets, models, prompts, outputs, and hosted AI applications comply with applicable law and the terms governing your use of those materials.

Nothing in this section prohibits legitimate AI research or development solely because a workload involves powerful computing resources.

10. Content, Copyright, and Intellectual Property

You must have the rights, licences, permissions, and legal authority necessary to store, host, process, transmit, or distribute content through our Services.

You must not use our infrastructure to:

• Distribute copyrighted material without authorization.
• Infringe trademarks, patents, trade secrets, or other protected rights.
• Host counterfeit goods or facilitate unlawful distribution.
• Circumvent lawful access restrictions or digital-rights protections.
• Misappropriate confidential or proprietary information.

If we receive a credible complaint concerning alleged infringement, we may investigate and take action as permitted or required by applicable law and our agreements.

Reports should include sufficient information to identify the affected material, the relevant rights, and the basis of the complaint.

11. Data Protection and Sensitive Information

You are responsible for determining whether the data you store or process through our Services may lawfully be handled using your selected infrastructure.

You must:

• Have the required legal basis and authorization to process personal information.
• Provide appropriate notices and obtain any required consents.
• Apply access controls, authentication, encryption, and retention measures appropriate to the data.
• Comply with applicable privacy, data-protection, confidentiality, and sector-specific requirements.
• Ensure that your data storage and transfer arrangements satisfy applicable legal and contractual obligations.

You must not use our Services to unlawfully disclose personal information, expose confidential records, or access data belonging to other customers.

Where a Data Processing Agreement applies, you must comply with its requirements in addition to this Policy.

12. Resource Consumption and Service Limits

You must use computing, storage, networking, and other resources in accordance with your selected plan and applicable service documentation.

You must not:

• Circumvent storage, bandwidth, compute, API, or request-rate limits.
• Exploit provisioning systems to obtain resources without authorization.
• Deliberately exhaust shared resources or degrade service quality.
• Misrepresent resource consumption or interfere with usage metering.
• Operate workloads that materially impair infrastructure stability.
• Resell, sublicense, or share access to Services where prohibited by your agreement.

If usage exceeds an applicable limit or creates a material risk to the platform, we may contact you, impose reasonable technical restrictions, or take other proportionate action permitted under our agreements.

13. Account Security and Access Credentials

You are responsible for maintaining the security of your accounts, workloads, and credentials.

You must:

• Protect passwords, SSH keys, API tokens, certificates, and other secrets.
• Use strong authentication and available security features.
• Limit administrative access to authorized users.
• Apply appropriate operating-system and application updates.
• Secure exposed ports and administrative interfaces.
• Revoke compromised or unnecessary credentials promptly.
• Notify us promptly if you suspect unauthorized access or account compromise.

You must not share stolen credentials, bypass account restrictions, or access another customer's account or infrastructure without authorization.

14. Scanning, Monitoring, and Security Testing

You must not conduct scanning, penetration testing, stress testing, or other activities that may affect our infrastructure or third-party systems unless you have the necessary authorization.

Where inhosted.ai requires prior approval for testing against its own platform, shared infrastructure, management interfaces, or network, you must obtain that approval before beginning the activity.

Authorized testing must remain within the agreed scope and must not create unnecessary disruption, expose other customers' data, or compromise service availability.

Customers may perform legitimate security testing on systems they own or are authorized to test, subject to applicable law and the technical conditions of their Service.

15. Prohibited Hosting and High-Risk Activities

You must not use our Services to host or facilitate:

• Fraudulent marketplaces or unlawful commercial schemes.
• Phishing, credential theft, or malicious redirection services.
• Unauthorized command-and-control infrastructure.
• Botnets or systems designed to conduct abusive automated activity.
• Unlawful distribution of personal, confidential, or copyrighted information.
• Content or services that violate applicable law.
• Activities intended to evade sanctions, lawful restrictions, or enforcement actions.

Certain high-risk but potentially lawful workloads may require additional review or written approval before deployment. Customers must comply with any applicable product-specific restrictions.

16. Customer Responsibilities

You are responsible for:

• All workloads, applications, and content deployed through your account.
• Ensuring that authorized users comply with this Policy.
• Maintaining appropriate security and access controls.
• Managing operating systems, applications, and software you administer.
• Configuring backups and data-retention settings where applicable.
• Monitoring resource consumption and charges.
• Responding to abuse notifications and security concerns.
• Ensuring that your activities do not violate third-party rights or applicable law.

Unless expressly included in your Service, inhosted.ai is not responsible for managing the security, configuration, or lawful operation of customer-controlled applications and workloads.

17. Reporting Abuse and Security Incidents

If you discover suspected abuse, unlawful activity, unauthorized access, or a security issue involving our Services, please contact us through the designated reporting channel.

When reporting an issue, include relevant information such as:

• The affected IP address, hostname, resource, or URL.
• The date and time of the activity, including the time zone where known.
• A description of the suspected violation.
• Relevant logs or supporting evidence, where lawfully available.
• Your contact details for follow-up.

Do not include passwords, private keys, access tokens, or unnecessary personal information in your report.

We may request additional information reasonably necessary to assess a report.

18. Investigation and Enforcement

We may investigate suspected violations of this Policy and take reasonable and proportionate action consistent with applicable law and our contractual obligations.

Depending on the circumstances, actions may include:

• Requesting clarification or additional information.
• Issuing a warning or requiring corrective action.
• Blocking abusive traffic or restricting affected network functions.
• Disabling an exposed port, API credential, or compromised account.
• Restricting, isolating, or suspending affected workloads.
• Suspending or terminating Services where permitted by the applicable agreement.
• Removing or disabling access to prohibited content where legally required or otherwise permitted.
• Preserving relevant records where legally permitted or required.
• Reporting suspected unlawful conduct to competent authorities where appropriate or legally required.

We may take immediate action without advance notice where reasonably necessary to address an imminent security threat, protect customers or infrastructure, prevent material harm, or comply with applicable law.

Where reasonably practicable and lawful, we will provide notice and an opportunity to remedy a violation before imposing significant restrictions.

Any enforcement action affecting customer data will remain subject to applicable law, the Privacy Policy, and relevant contractual commitments.

19. Appeals and Restoration of Services

If you believe an enforcement action was taken in error, you may contact our support team and request a review.

Please provide the affected account or resource details, the action you are challenging, and relevant supporting information.

We may require corrective action or reasonable security assurances before restoring affected Services.

Restoration is subject to the outcome of our review, applicable law, and the relevant service agreement.

20. Relationship with Other Policies

This Policy forms part of the terms governing your use of inhosted.ai Services and should be read alongside:

• Terms of Service.
• Privacy Policy.
• Applicable Service Level Agreement.
• Refund and Cancellation Policy.
• Data Processing Agreement, where applicable.
• Product-specific service documentation and customer agreements.

If another agreement contains additional acceptable-use requirements for a particular Service, those requirements will also apply. In the event of a conflict, the applicable agreement will govern to the extent specified in that agreement and permitted by law.

21. Changes to This Policy

We may update this Policy to reflect changes in our infrastructure, Services, security requirements, operational practices, or applicable law.

The revised version will be published on our website with an updated “Last Updated” date.

Where required by law or contract, we will provide notice of material changes.

Your continued use of the Services after an updated Policy takes effect will be subject to the revised Policy to the extent permitted by applicable law and your agreement.

22. Contact Information

For questions about this Policy or to report suspected misuse of our infrastructure, contact:

Please verify the legal entity, business address, and reporting channels before publication.