This policy lists what you may not do with Stasho. It is part of the Terms of Service and applies to everything you deploy, to your App VMs and to how you use your account.

1. What is not allowed

• Content or activity that is illegal under Belgian or EU law, or under the law of the place where you are.
• Child sexual abuse material, in any form.
• Phishing, collecting other people’s passwords or login details, and pretending to be someone else.
• Malware, command-and-control servers, and delivering exploits.
• Spam and unsolicited bulk messages.
• Infringing other people’s intellectual property, such as their copyright or trademarks.
• Crypto mining.
• Port scanning, brute-forcing logins, denial-of-service attacks, or any other attack from a VM.
• Getting around the trial limits or the one-trial-per-account rule, for example with extra wallets or GitHub accounts.
• Anything that puts the independent node operators or the network at risk.

2. What we do when this policy is broken

• Where we can stop a use by technical means, we may do so: the service enforces the trial limits, and we may block mining or attack traffic from a managed App VM, or stop the VM.
• Where we cannot, we may remove the content and suspend your account, following the notice and removal procedure in section 6 of the Terms of Service.
• Removal is final. We keep no copy of removed content, only the address and fingerprints that identify it, and cannot put it back.
• We may report illegal use to the authorities. We comply with lawful orders, and we report to the authorities any information suggesting a threat to someone’s life or safety.

3. How to report abuse

Use the form at docs.stasho.xyz/report-abuse, which needs no sign-in, or write to report@stasho.xyz.

Include:

• the URL or IP address of the content or the traffic;
• what you saw and when;
• why you believe it is illegal or breaks this policy;
• who you are in this matter, for example a member of the public, the rights holder or an authority, and any order or case reference;
• your name and email address. The form asks for both on every report except reports of child sexual abuse material, which can be made anonymously.

How we answer:

• A person reviews every report.
• If you give an email address, we confirm that we received your report.
• When we act, the owner of the content receives a statement of reasons by email, if we have an email address for them.
• If you gave an email address, we tell you the outcome by email.