Acceptable Use Policy (AUP)

1. Scope

This AUP applies to every Customer, Authorized User, workload, system, and person using HaxLink Services. Customer is responsible for its users and for activity originating from resources assigned to it, including activity caused by compromised credentials, software, or devices.

Examples below are illustrative, not exhaustive. Conduct may violate this AUP whether attempted, completed, direct, indirect, or performed through automation.

2. Lawful and authorized use

• Do not use the Services for conduct that violates applicable criminal, civil, regulatory, export-control, sanctions, intellectual-property, privacy, or data-protection law.
• Do not use the Services to facilitate fraud, deception, impersonation, identity theft, money laundering, extortion, illegal gambling, trafficking, or sale of unlawful goods or services.
• Do not store, distribute, solicit, or provide access to child sexual abuse material. Reports involving apparent child exploitation may be preserved and referred to competent authorities without notice.
• Do not publish unlawfully intimate, exploitative, threatening, or privacy-invasive content, including non-consensual intimate imagery or doxxing.
• Do not use the Services in a way that violates a court order, regulatory direction, or binding contractual restriction communicated to you.

3. Security abuse

• Do not gain or attempt unauthorized access to accounts, systems, data, networks, or physical facilities.
• Do not conduct vulnerability scanning, penetration testing, credential testing, password attacks, or exploit activity against third parties without documented authorization.
• Do not distribute malware, ransomware, spyware, destructive code, botnets, command-and-control infrastructure, phishing kits, credential harvesters, or tools primarily configured for abuse.
• Do not intercept communications, spoof identity or routing information, forge headers, or conceal an abusive origin.
• Do not use compromised systems, stolen credentials, unauthorized proxies, open relays, or anonymization infrastructure to evade accountability.
• Do not disable, evade, probe, or interfere with HaxLink or partner security, rate, access, metering, logging, or abuse controls.

4. Network and service integrity

• Do not launch or facilitate denial-of-service attacks, amplification, reflection, traffic flooding, packet fragmentation abuse, or resource exhaustion.
• Do not disrupt or degrade other tenants, shared platforms, upstream providers, or public networks.
• Do not announce unauthorized address space, manipulate routing, operate an open resolver or relay, or use invalid source addresses.
• Do not exceed documented limits, create unreasonable load, or consume shared capacity in a way that materially harms others.
• Do not perform cryptocurrency mining, high-intensity proof-of-work, or similarly atypical sustained compute use unless an Order expressly permits it.

5. Messaging, email, and automated traffic

• Do not send unsolicited bulk email or messages, operate spam services, sell spam-enabling lists, or assist delivery designed to evade anti-abuse systems.
• Commercial messaging must have a lawful basis, accurate sender identity, required disclosures, and a functional opt-out that is honoured promptly.
• Do not use purchased, scraped, harvested, or guessed address lists without a documented lawful basis and appropriate consent.
• Do not generate abusive automated traffic, fake engagement, ad fraud, referral manipulation, inventory hoarding, scalping, or service scraping contrary to law or binding site terms.

6. Content and third-party rights

• Do not infringe or misappropriate copyright, trademark, patent, trade secret, publicity, confidentiality, or other rights.
• Do not distribute counterfeit goods, piracy services, unauthorized access devices, or circumvention technology where unlawful.
• Do not falsely represent affiliation, authorization, endorsement, or origin.
• Respond promptly to substantiated rights complaints and preservation requests forwarded by HaxLink.

7. High-risk and regulated workloads

Customer must obtain written approval before using the Services for workloads requiring exceptional safety, legal, or compliance controls, including emergency dispatch, life-support dependencies, weapons systems, high-risk medical decisioning, critical financial-market infrastructure, or government-classified data.

Approval does not transfer Customer's regulatory responsibility or create a warranty that the Services satisfy a specific regime unless the Order expressly says so.

8. Resource use and technical hygiene

• Maintain supported software, timely security patches, malware protection, and secure configurations.
• Use accurate reverse DNS and contact information where relevant to network operations.
• Apply rate limits and safeguards to publicly exposed services and automated interfaces.
• Monitor assigned resources for compromise and respond promptly to HaxLink notices.
• Do not deliberately create excessive support, logging, storage, or network costs outside the agreed service profile.

9. Monitoring and investigation

HaxLink does not undertake to monitor all Customer Content. We may review service metadata, network indicators, logs, complaints, and limited content where reasonably necessary to operate and secure the Services, investigate suspected violations, or comply with law.

Customer must provide timely information and remediation evidence. HaxLink may share relevant information with affected partners, rights holders, security researchers, regulators, or authorities where lawful and proportionate.

10. Enforcement

Depending on severity, history, urgency, and risk, HaxLink may warn Customer, require a remediation plan, block traffic, rate-limit, quarantine resources, remove or disable access to material, suspend affected Services, terminate the Agreement, or refer conduct to authorities.

HaxLink may act immediately where there is imminent risk, apparent criminal conduct, active compromise, child exploitation, a significant network attack, or a binding legal request. Where practical and lawful, we will notify Customer and limit action to affected resources.

Fees continue during a suspension caused by Customer's violation, and Customer is responsible for reasonable investigation, remediation, and partner charges attributable to the violation.

11. Reporting and appeal

Report suspected abuse through the Report Abuse page or contact@haxlink.com. Include affected IP addresses or hostnames, UTC timestamps, log excerpts, and a clear description. Do not send passwords, private keys, or unnecessary sensitive data.

A Customer that believes enforcement was mistaken may appeal with new evidence. HaxLink will route the appeal to personnel not solely responsible for the original decision where practicable. An appeal does not require restoration while material risk remains.