Acceptable use policy

This policy is part of the terms of service. It applies to you, your team and every end user or agent you let run code on Dormo. You are responsible for what runs in your VMs, including code written or executed by AI agents.

1. Prohibited activities

Resource abuse

• Cryptocurrency mining of any kind, including proof-of-work, proof-of-space and "testing" miners, and mining pools or proxies. This applies on every plan, including paid plans.
• Creating multiple accounts, or rotating free allowances, to get more free compute.
• Deliberately circumventing billing, auto-pause accounting, rate limits or concurrency limits.
• Reselling raw VMs as a general-purpose hosting or VPS product without a written agreement with us. (Building an agent product on top of Dormo that gives your users their own VM is exactly what the service is for.)

Network abuse

• Sending spam or other unsolicited bulk messages (email, SMS, social media, comment or form spam), or operating open mail relays.
• Scanning networks or hosts you do not own or have written permission to test, including port scans, vulnerability scans and credential stuffing.
• Denial-of-service attacks, traffic amplification, or stress-testing third-party systems without authorisation.
• Running open proxies, open resolvers or anonymisation exit nodes reachable by the public.
• Accessing or attempting to access other customers' VMs, our host systems or our internal network, or attempting to escape VM isolation, except under our responsible disclosure rules.

Harmful or illegal content and activity

• Storing, distributing or generating illegal content, including child sexual abuse material (which we report to the competent authorities), content that infringes intellectual property rights, and content that violates applicable sanctions.
• Malware distribution, command-and-control servers, ransomware, phishing pages or credential harvesting.
• Fraud, impersonation, or automated account creation and abuse on third-party services in breach of their terms.
• Harassment, threats or doxxing, and processing personal data without a lawful basis.

2. Allowed, with care

• Security testing of systems you own or are authorised to test, including scanning your own Dormo VMs from other Dormo VMs.
• Web scraping and browser automation that respects target sites' terms, robots rules and rate limits.
• Running untrusted or AI-generated code: that is the point of a sandbox. If an agent you run breaks these rules, you are still responsible, so use egress limits and spend limits.

If in doubt, ask abuse@dormo.dev before you start.

3. Enforcement

We monitor aggregate signals such as sustained CPU patterns typical of mining, outbound connection rates, mail traffic and abuse reports. We do not inspect the contents of your VMs as a routine matter. [Legal review: align monitoring description with privacy notice and DPA.]

Depending on severity, we may:

1. contact you and ask you to stop, with a deadline;
2. throttle, block specific outbound traffic or pause the affected VMs;
3. suspend API keys or the account, immediately and without notice where activity harms or threatens others (mining, attacks, spam, malware, illegal content);
4. terminate the account for serious or repeated violations;
5. preserve relevant data and report to law enforcement where required by law.

Usage from prohibited activity is still billable, and free or promotional credit used for it may be revoked. If you think we got it wrong, reply to the notice or write to abuse@dormo.dev; a person will review it.

4. Reporting abuse

To report abuse originating from Dormo IP addresses, email abuse@dormo.dev with the source IP, timestamps with time zone, and logs or headers. For vulnerabilities in Dormo itself, use security@dormo.dev.