Acceptable Use Policy

2.1 Services covered

• IP transit, peering and connectivity over AS209990;
• anycast content delivery and edge caching;
• Karmuz Edge - encrypted tunnels and edge proxying;
• authoritative DNS;
• object storage.

2.2 Who is bound

• Customers - anyone who contracts with us for a service.
• Users - anyone a Customer permits to use a service, including staff, contractors, sub-users, resellers' customers and end users.
• Content - anything stored, hosted, transmitted, cached or delivered through a service, whoever provided it.

A Customer accepts this AUP when it orders or uses a service, and is responsible to us for compliance by every User under its account.

2.3 Peering

Peers are not Customers. Interconnection with AS209990 is governed by our peering policy. The network-integrity requirements in section 7 apply to any party exchanging routes with us, as a condition of interconnection that is accepted by establishing or maintaining a session.

5.1 Child sexual abuse material

Any material depicting or facilitating the sexual abuse or exploitation of minors is prohibited absolutely. Confirmed cases result in immediate removal, immediate termination of the account, and a report to the Dutch hotline operated by EOKM (Expertisebureau Online Kindermisbruik) and to the competent authorities. Where a competent authority issues a preservation order, we preserve the account and traffic records it specifies; we do not retain the material itself except as such an order requires.

We act on orders from the Dutch Authority for Online Terrorist and Child Pornographic Material (ATKM) under the Wet bestuursrechtelijke aanpak online kinderpornografisch materiaal (the Dutch act on administrative enforcement against online child sexual abuse material), and on reports from EOKM, without waiting for a further legal determination.

5.2 Terrorist content

Content that incites, solicits, glorifies or provides instruction for terrorist offences, or that solicits participation in a terrorist group, is prohibited. Under Regulation (EU) 2021/784 and its Dutch implementing act, a removal order from the ATKM must be executed within one hour of receipt. We keep a monitored abuse contact and treat such orders as our highest operational priority at any hour. Customers must be reachable so that we can act at the source where possible.

Where we execute a removal order, we preserve the Content removed and the related data for six months under Article 6 of Regulation (EU) 2021/784, and longer where a competent authority or court so orders.

5.3 Other illegal content and activity

• Content that infringes copyright, trade marks, database rights or other intellectual property, and the distribution of counterfeit goods.
• Incitement to violence or hatred, unlawful discrimination, threats, harassment, doxxing, stalking, and non-consensual intimate imagery.
• Defamatory material, and material that unlawfully violates another person's privacy.
• Sale or distribution of controlled substances, weapons, stolen data, stolen credentials or other goods whose sale is unlawful.

5.4 Fraud and financial crime

• Phishing, brand impersonation, spoofed login pages, and any scheme designed to obtain credentials, payment details or personal data by deception.
• Carding, payment fraud, triangulation fraud, money laundering, and the facilitation of any of these.
• Fake webshops, advance-fee fraud, investment and cryptocurrency scams, Ponzi and pyramid schemes.
• Providing regulated financial services, or selling pharmaceuticals, without the licence the law requires.
• Any activity whose purpose is to obscure the identity of a party engaged in the above, including so-called bulletproof hosting.

5.5 Security and network abuse

• Distribution of malware, ransomware, stalkerware or exploit kits, and operation of botnet command-and-control infrastructure.
• Unauthorised access to, or interference with, any system, network or account.
• Originating, coordinating, or assisting denial-of-service attacks, including operating deliberate amplification or reflection infrastructure and selling or advertising "stresser" or "booter" services.
• Source-address spoofing, BGP hijacking, route leaks, or announcing prefixes without documented authorisation.
• Operating open resolvers, open relays, open proxies or misconfigured services exploitable for amplification or laundering of attack traffic.
• Scanning, probing or testing systems the Customer does not own or hold documented written authorisation to test.

5.6 Messaging abuse

• Unsolicited bulk email or messaging, and any sending that does not meet applicable consent, identification and opt-out requirements.
• Phishing by message, and spoofing of sender identities or originating addresses.
• Sending to recipients who have withdrawn consent, or to addresses obtained without a lawful basis.

5.7 Resource abuse

• Activity that materially degrades a service or the network for others.
• Circumvention of plan limits, quotas, trial restrictions or billing controls.
• Cryptocurrency mining, except where approved in writing under section 6.

5.8 Categories we do not carry at all

We do not host, cache or deliver the following, and we do not grant exceptions for them:

• adult, sexual or pornographic content and services, including live webcam and adult chat services;
• gambling, betting and lotteries, whether or not licensed, and services that support them;
• anonymisation services sold or offered to the public, including commercial VPN exit services, open proxy services and cryptocurrency mixers.

We do not carry these even where the operator can identify and act against an abusing user. Tor exit nodes are not covered by the third bullet and are dealt with under section 6.

6.1 What our services are not for

Our services are not designed or warranted for safety-critical or life-critical use, and must not be relied on where failure could cause death, personal injury, or severe environmental or property damage.

8.1 General

Customers must comply with all laws applicable to their use of the services, including Dutch and EU law and the law of any jurisdiction in which they or their Users are established or operate. This includes, as relevant:

• Regulation (EU) 2022/2065 (Digital Services Act);
• Regulation (EU) 2021/784 on terrorist content online, and the Dutch implementing act;
• the Wet bestuursrechtelijke aanpak online kinderpornografisch materiaal (the Dutch act on administrative enforcement against online child sexual abuse material);
• Regulation (EU) 2016/679 (GDPR) and the ePrivacy rules;
• the rules on electronic marketing and sender identification in the Telecommunicatiewet;
• consumer protection, e-commerce and distance-selling rules.

The Digital Services Act, Regulation (EU) 2021/784, the Wet bestuursrechtelijke aanpak online kinderpornografisch materiaal apply to us directly, and this policy is written so that we can meet them. Where the Cyberbeveiligingswet (the Dutch cybersecurity act implementing NIS2) applies to us, we meet its requirements too.

8.2 Sanctions

We do not provide services to, and no service may be used to provide anything of value to, any person, entity, vessel or body that is:

• designated under EU restrictive measures, UN sanctions, Dutch national sanctions lists, or any other sanctions regime binding on us; or
• established in, ordinarily resident in, or acting on behalf of a comprehensively sanctioned or embargoed territory.

Specific EU measures also restrict the provision of certain IT and computing services to the Russian and Belarusian governments and to entities established in Russia or Belarus, including access to hosted AI models and high-performance computing capacity. Customers must not use our services to provide, resell or make available anything falling within those restrictions.

Customers represent that neither they, nor their owners or beneficial owners, nor their Users, are sanctioned parties, and must notify us immediately if that changes. We screen against the EU consolidated list before a service is activated and again when circumstances change, and we may suspend services and make any legally required report where a sanctions risk is identified. Deliberate circumvention of sanctions or export controls is a material breach.

How we handle notices

We acknowledge receipt where contact details are provided. We assess the report in a timely, diligent, objective and non-arbitrary way, and tell the notifier what we decided and how to challenge it. We handle notices in line with the Dutch Gedragscode Notice-and-Take-Down. If someone else is closer to the Content than we are - the Customer, or their reseller - we pass the report to them, and escalate if they do not act.

Priority handling

Orders and notices from the ATKM, law enforcement, the Public Prosecution Service, and other competent authorities are handled with priority and within the statutory deadline - one hour for terrorist content removal orders. Reports concerning child sexual abuse material and active attacks are escalated immediately at any hour. We do not run a staffed 24/7 support desk, but statutory removal orders and reports of this kind reach us out of hours and are acted on at any time.

Orders from authorities

We act on orders issued under Articles 9 and 10 of the Digital Services Act and on other lawful orders, inform the issuing authority of the effect given to them, and notify the affected Customer unless the order or the law prohibits it.

Criminal offences

Where we become aware of information giving rise to a suspicion of a criminal offence involving a threat to the life or safety of a person, we inform the competent authorities without delay, as required by Article 18 of the Digital Services Act.

Abusive notices

We may disregard notices from a source that repeatedly submits manifestly unfounded reports.

11.1 Monitoring

We are under no general obligation to monitor Content or to seek out illegal activity, and we do not review Content proactively. We do operate automated systems for the security, stability and integrity of the network - including flow analysis, intrusion and abuse detection, route validation and capacity monitoring - and we act on reports from third parties, peers and authorities. Carrying out voluntary investigations of this kind does not deprive us of the liability exemptions in Articles 4 to 6 of the Digital Services Act.

We may inspect logs, traffic metadata and account records where necessary to investigate a suspected breach, secure the services, or comply with a legal obligation. We do not inspect the content of customer traffic except where technically necessary for one of those purposes or where required by law.

11.2 Investigation

We may require a Customer to provide information about activity on its account, including the identity of the User responsible for reported abuse, within a stated and reasonable period.

11.3 Measures

Where this policy is breached, or where we are legally required to act, we may take one or more of the following, proportionate to the severity, recurrence and impact of the breach:

• a warning with a remediation deadline;
• rate-limiting, filtering, null-routing or blocking of specific traffic, addresses or ports, on the grounds Regulation (EU) 2015/2120 permits;
• removal of, or disabling of access to, specific Content, including cache purging;
• suspension of an individual service, instance or resource;
• suspension of the account in whole;
• withdrawal or filtering of prefixes, or shutdown of a BGP session;
• termination of the agreement with immediate effect;
• reporting to the competent authorities, and preservation or disclosure of data where legally required or permitted.

We take the narrowest measure that fixes the problem. If suspending one service, withdrawing one prefix or removing one item of Content will do it, we do not touch the rest of the account.

11.4 Notice and immediacy

We ordinarily give notice and a reasonable opportunity to remediate before suspending a service. We may act immediately and without prior notice where there is a risk of serious harm - including child sexual abuse material, terrorist content, active attack traffic, phishing or malware distribution, or a threat to the security or stability of the network. We may also act immediately and without prior notice where a court or competent authority orders us to. In either case we notify the Customer as soon as practicable afterwards.

11.5 Statement of reasons

Where we restrict Content or a service on the ground that it is illegal or incompatible with this policy, we give a clear and specific statement of reasons, in line with Article 17 of the Digital Services Act. It sets out the measure taken and its territorial and temporal scope, the facts relied on, whether the decision followed a notice or our own investigation, whether automated means were used, the legal or contractual ground, and how the decision can be contested.

We give it to the affected Customer and, where the Content was provided by a User rather than by the Customer, to that User where we are able to reach them - directly or through the Customer, who must pass it on. Where we hold electronic contact details, we provide it at the latest on the date the restriction is imposed, as Article 17 requires, including where we acted immediately under section 11.4. Where Content is removed under a removal order for terrorist content, we make the information required by Article 11 of Regulation (EU) 2021/784 available to the content provider.

11.6 Consequences

Suspension or termination for a serious breach does not entitle the Customer to a refund of prepaid fees; where the breach is not serious we refund the unused part pro rata. The Customer remains liable for fees due and for costs we reasonably and demonstrably incur as a direct result of the breach, including abuse handling, remediation and third-party claims, and for any penalty imposed on us that is attributable to the breach rather than to our own acts or omissions.