Acceptable Use Policy

1. Purpose and scope

This Acceptable Use Policy (the “Policy”) applies to every organization that uses the UMBREN service and to everyone who acts through it, including members and holders of API credentials. It forms part of the Terms of Service. The provider of the service is [Company legal name — to be completed] (“UMBREN”).

A DDoS mitigation service can be misused in two ways: to hide a service that is itself harmful, and to take control of traffic that belongs to someone else. This Policy is written to prevent both.

2. Register only infrastructure you are authorized to register

You may register an endpoint only if you own the infrastructure or are authorized by its owner to register it. You must not:

• register, or attempt to register, an address, server or service that belongs to a third party without their authorization;
• make a false or misleading statement, or submit a forged or altered document, in a manual verification request;
• run the verification agent on a server you are not authorized to administer, or interfere with the address a verification request is seen to arrive from;
• circumvent, or attempt to circumvent, ownership verification or any activation gate;
• keep an endpoint registered after you have stopped owning or being authorized to register the infrastructure behind it.

Ownership must be verified before an endpoint can progress. Entering an address is never accepted as proof. UMBREN may ask for ownership to be verified again at any time.

3. Services that may not be protected

You must not use UMBREN to shield, host behind, or keep reachable any service that is illegal or abusive. This includes a service that:

• launches, sells, rents or coordinates denial-of-service attacks, including so-called booter and stresser services;
• operates or controls malware, botnets, or command-and-control infrastructure;
• is used for phishing, fraud, or the theft or sale of credentials, payment data or personal data;
• sends unsolicited bulk messages, or supports those who do;
• distributes material that sexually exploits children, or any other content that is unlawful to distribute;
• facilitates unauthorized access to systems or data belonging to others;
• infringes the intellectual property rights of others as its purpose or principal activity;
• is operated in breach of the law that applies to it, or is offered to persons or in places where sanctions law prohibits it.

[Jurisdiction-specific prohibited categories and sanctions wording — to be completed]

4. No attacks and no abuse of the network

You must not use the service, a protected endpoint, or any address or system reached through UMBREN to:

• launch, relay, reflect or amplify a denial-of-service attack against anyone;
• send traffic with a forged source address;
• scan, probe or test the vulnerability of systems you are not authorized to test;
• attack, overload, probe or map UMBREN, an upstream scrubbing provider, or another customer;
• interfere with another customer's use of the service.

You must not run a load test or a simulated attack against a protected endpoint, including your own, without UMBREN's prior written agreement. Unannounced tests are indistinguishable from attacks and affect infrastructure that other customers rely on.

5. Use of the dashboard, API and agent

You must not:

• access, or attempt to access, the data of another organization;
• share credentials between individuals, or let an API credential be used outside your organization;
• evade rate limits, plan allowances or other technical limits;
• use an API credential, automation or any other means to bypass a step that requires a person, including the authorization of activation;
• present simulated or demo data as evidence that infrastructure is protected;
• reverse engineer, modify or redistribute the verification agent or any other part of the service, except where the law gives you a right to do so that cannot be excluded;
• configure a notification channel that delivers to a destination you do not control or are not authorized to use.

6. If you serve customers of your own

VPN operators, game server operators and hosting providers use UMBREN to protect services that their own customers use. If you are one of them:

• you remain responsible for what your customers and end users do with your service;
• you must have, and enforce, terms that prohibit the conduct described in sections 3 and 4;
• you must maintain a working way to receive abuse reports, and act on them within a reasonable time;
• you must not register infrastructure on behalf of a customer unless you operate it or are authorized to register it, and you must verify ownership of it in the same way as any other endpoint.

UMBREN has no relationship with your customers and does not handle their accounts, keys or communications.

7. Reporting abuse

If you believe that a service protected by UMBREN breaches this Policy, or that your infrastructure has been registered without your authorization, report it to [Abuse contact email — to be completed]. Include the address and port concerned, the time of the conduct, and any evidence you hold.

[Abuse handling procedure and response commitments — to be completed]

8. Investigation and enforcement

UMBREN may investigate a suspected breach of this Policy. In doing so it may:

• ask you for information or evidence, including renewed proof of ownership;
• place an administrative hold on an endpoint or on an organization;
• withdraw protection from an endpoint and release its upstream reservation;
• revoke credentials;
• terminate the agreement, as the Terms of Service provide;
• report unlawful conduct to the competent authorities, and cooperate with them where the law requires it.

UMBREN will act in proportion to the breach and will give notice where that is practicable and lawful. Where the breach is serious, for example an attack launched through the service or infrastructure registered without authorization, UMBREN may act immediately and without notice.

When a hold is lifted, an endpoint returns to an earlier stage of onboarding. An endpoint that was active does not resume automatically and must be authorized again. Actions that UMBREN staff take on an organization are recorded in that organization's audit log.

9. Changes to this Policy

UMBREN may update this Policy as the service and the threats it faces change. The current version is published on this page. [How customers are notified of material changes — to be completed]

10. Contact

Questions about this Policy can be sent through the contact page. Legal notices must be sent to [Contact email for legal notices — to be completed]. The data processed when a report is investigated is described in the Privacy Policy.