Acceptable Use Policy

1. Purpose and scope

This Acceptable Use Policy (the “AUP”) sets out what is and is not permitted when using the services provided by Maxinodes Ltd (“Maxinodes”, “we”, “us” or “our”), a private company limited by shares registered in Ireland, with its registered office at 1 Ballycoolin Road, Dublin 15, Ireland. In this AUP, “you”, “your” and the “Customer” mean the person or entity that orders the Services.

This AUP applies to all of our Services — both our Self-Managed Services (the self-managed plans Lite, Plus and Pro) and our Managed Services (the operated plans Starter, Growth, Business and Enterprise), including the Hosted Mailboxes that come with them — and to the Managed Email mailboxes we administer, to the extent set out in this policy. It applies regardless of which plan you are on.

The AUP applies not only to you, but to anyone you permit to use the Services, including your employees, contractors, agents, clients and end users, and to anyone who uses the Services through your account whether or not you authorised them. You are responsible for the acts and omissions of everyone who uses the Services through your account, and for ensuring they comply with this AUP.

This AUP is incorporated into, and forms part of, our Terms of Service, available at https://www.maxinodes.com/en/legal/terms. Capitalised terms used but not defined here have the meaning given to them in the Terms. Where the Terms and this AUP conflict on a matter of acceptable use, this AUP prevails. By placing an Order or using the Services, you agree to comply with this AUP.

The purpose of this AUP is straightforward: to protect our Customers, the people who rely on the content and applications they host with us, the wider internet, and the integrity, security and performance of our platform. The rules below exist so that the Services stay lawful, safe and fast for everyone who shares the platform.

Nothing in this AUP affects your mandatory statutory rights as a Consumer. Where you are a Consumer, your rights under Irish and EU consumer-protection law continue to apply and are not limited by anything in this policy.

2. Prohibited content

You must not use the Services to store, host, publish, transmit, link to or otherwise make available any of the following. This list describes categories of Content and Customer Data that are never acceptable on our platform:

2.1 Illegal material

Any Content that is illegal under the laws of Ireland or the European Union, or that promotes, facilitates or instructs others in unlawful activity. This includes Content that breaches sanctions or export-control law, and Content whose mere possession or distribution is a criminal offence.

2.2 Child sexual abuse material — zero tolerance

Child sexual abuse material (“CSAM”) and any content that sexually exploits or endangers a minor is met with zero tolerance. There is no warning, no remediation period and no graduated process for CSAM. Where we identify or are credibly notified of such material, we will remove it, suspend or terminate the account, preserve relevant evidence as required by law, and report the matter to An Garda Síochána and any other competent authority. This applies regardless of your plan and regardless of whether you are a Consumer or a Business Customer.

2.3 Intellectual-property infringement

Content that infringes the copyright, trademark, patent, trade-secret, database, design or other intellectual-property or proprietary rights of any third party, including pirated software, media, counterfeit goods, and tools whose primary purpose is to circumvent technical protection measures. You must hold all rights, licences and permissions necessary for the Content you host.

2.4 Incitement to violence or hatred

Content that incites, threatens, glorifies or promotes violence, terrorism or self-harm, or that incites hatred or discrimination against a person or group on grounds such as race, ethnicity, nationality, religion, disability, age, sex, sexual orientation or gender identity.

2.5 Fraud, phishing and deceptive material

Content designed to defraud or deceive, including phishing pages, fake login or payment forms, spoofed or impersonating websites, fraudulent “get rich quick” or investment schemes, pyramid or Ponzi schemes, and any material engineered to harvest credentials, payment-card details or other sensitive information from third parties.

3. Prohibited activities

Independently of the Content you host, you must not use the Services to carry out, attempt, assist, commission or participate in any of the following activities:

3.1 Malware

Creating, hosting, distributing, deploying or controlling malware, including viruses, worms, trojans, ransomware, spyware, keyloggers, rootkits, exploit kits, command-and-control infrastructure or botnets.

3.2 Unauthorised access and vulnerability testing

Accessing, or attempting to access, any system, account, network or data without authorisation; defeating or circumventing authentication, authorisation or security controls; or conducting penetration testing, vulnerability scanning or security probing against any system you do not own, unless you hold the prior written authorisation of the system owner and, where the testing involves our infrastructure, our prior written authorisation as well.

3.3 Network abuse

Activities that disrupt, degrade or interfere with the network, the platform or other Customers, including traffic floods, amplification techniques, resource exhaustion and any conduct that destabilises shared infrastructure.

3.4 Spoofing and forged headers

Spoofing IP addresses, forging TCP/IP packet headers, forging email headers or otherwise falsifying, disguising or obscuring the true origin of any traffic, message or communication you send through or from the Services.

3.5 Port scanning and probing of foreign networks

Port scanning, network mapping, enumeration or probing of any network, host or service that you do not own or are not expressly authorised in writing to test.

3.6 Open relays and open proxies

Operating an open SMTP relay, an open mail relay, an open proxy, an open recursive resolver or any similar service that can be abused by third parties to launder traffic, send mail or conceal the source of malicious activity.

3.7 Denial-of-service attacks

Launching, sourcing, scripting, commissioning, hosting tooling for, or otherwise participating in any denial-of-service (DoS) or distributed denial-of-service (DDoS) attack against any target, whether on our network or elsewhere.

3.8 Unauthorised cryptocurrency mining

Unauthorised or undisclosed cryptocurrency mining, including mining carried out without your knowledge as a result of a compromised account, and any high-intensity mining that consumes resources beyond those allocated to your plan or that degrades the platform for others.

3.9 Uncontrolled load testing

Running load tests, stress tests or benchmarks against the Services or any third-party system without prior coordination. Any load testing of your own services on our platform must be scheduled with us in advance through support@maxinodes.com so that it does not affect other Customers.

4. Email and zero-tolerance spam policy

We operate a zero-tolerance spam policy. For the purposes of this AUP, spam means unsolicited bulk email or unsolicited bulk commercial messages, and any equivalent abuse across other messaging channels.

4.1 What is required

If you send bulk or commercial email through, or originating from, applications hosted on the Services, you must:

• send only to recipients who have given genuine, verifiable opt-in consent to receive your messages, in line with the ePrivacy regime and the General Data Protection Regulation;
• identify yourself accurately as the sender, with truthful headers, a genuine subject line and a valid, monitored reply address;
• provide a clear, working and honoured way to unsubscribe in every commercial message; and
• keep records sufficient to demonstrate consent where required.

4.2 What is prohibited

You must not send spam, harvest or scrape email addresses, use purchased or rented lists, forge or disguise the origin of messages, or maintain infrastructure (such as mailing scripts or list-management tools) whose purpose is to send unsolicited bulk messages. Nor may you use email forwarding or automatic replies in a way that passes spam on to third parties.

4.3 Outbound spam from your mailboxes, websites and Managed Email

This policy covers spam sent from your Hosted Mailboxes and from applications you host on the Services, including where your mailboxes are Managed Email living in your own Microsoft 365 or Google Workspace tenant. Email sent from Hosted Mailboxes and from websites on our servers leaves through our outbound relay, which filters it and may hold back or refuse messages it identifies as spam. Managed Email mailboxes are not on our infrastructure, but the web applications, scripts, forms and connectors that generate outbound mail often are — and that activity is within the scope of this AUP. Sending spam through Managed Email mailboxes also remains subject to Microsoft’s or Google’s own terms and acceptable-use rules.

4.4 Consequences

We act on complaints about email sent from your account, whether they come from its recipients, from other mail providers or from our outbound relay. A pattern of complaints is treated as a sign of a breach of this section, and we may ask you for the consent records described in section 4.1. Because spam damages our network reputation and harms every other Customer who shares our mail-sending capacity, breaches of this section are treated seriously. We may immediately throttle or block outbound mail, suspend the offending service, and, for repeated or egregious abuse, terminate the account. Where you are a Consumer, we will give proportionate, notice-based treatment wherever practicable, but we may act without prior notice where the abuse is ongoing or threatens the platform or third parties.

4.5 Hosted Mailboxes are for your own correspondence

The Hosted Mailboxes that come with your plan are for the correspondence of you, your business and the people who use them: messages written to particular people, and replies. You must not send newsletters, marketing campaigns or other bulk email — the same or a similar message sent to many recipients — through our servers, whether from Hosted Mailboxes or from scripts and applications on your hosting account (such as newsletter or mailing-list plugins), even to recipients who have opted in. Our capacity for sending email is shared by every Customer on the platform, and bulk sending through it harms everyone else’s email. If you send bulk email, use a dedicated email-sending service built for it; your website may hand bulk email to such a service directly, for example through its API. Section 4.1 still applies to that email. Messages that your website sends one at a time because of something a user did, such as order confirmations, password resets and contact-form notifications, are not bulk email and are allowed within the limits in section 4.6.

4.6 Sending limits

Each domain on a hosting plan may send up to the number of email messages per hour shown below. The limit counts all email the domain sends from our servers: from its Hosted Mailboxes and from websites, scripts and scheduled tasks on your hosting account.

If a domain goes over its hourly limit, further messages are queued and retried later, up to 125% of the limit; beyond that, messages are refused and the sender receives a bounce message. In addition, a single message may be up to 50 MB in size, attachments included, and may be addressed to up to 50 recipients. These per-message limits are our current ones and may change; our Help Centre always shows the current figures. The limits in this section are technical safeguards, not an allowance: staying within them does not make bulk email acceptable under section 4.5.

4.7 Compromised mailboxes and accounts

If a Hosted Mailbox, a website or a hosting account appears to be compromised — for example because a password has been guessed or leaked and it is being used to send spam or phishing — we may immediately stop the mailbox or the domain from sending, or reset the mailbox password, to protect the platform and other Customers. We will tell you what we did and why as soon as we reasonably can, and help you secure it and send normally again. You are responsible for using strong, unique passwords for your mailboxes and for keeping secure the devices and applications that use them.

5. Resource and fair use

The Services run on shared infrastructure. Even on plans with generous allocations, your use sits alongside that of other Customers, and you must not consume resources or behave in a way that degrades performance, stability or availability for others.

5.1 Resources are tied to your plan

The compute, memory, storage, bandwidth and other resources available to you are those allocated to the plan you have ordered, as described at https://www.maxinodes.com/en/pricing. This includes the number of Hosted Mailboxes and the maximum size of each mailbox. Mailboxes have no storage allowance of their own: the mail in them shares, and counts towards, your plan’s storage, and a mailbox that is full refuses new messages until space is freed. You must not attempt to exceed, circumvent or pool those allocations across accounts to obtain more than your plan provides.

5.2 Fair use on shared Self-Managed tiers

Our entry-level Self-Managed Services tiers (in particular Lite and Plus) are shared and carry a fair-use expectation: they are intended for ordinary websites, applications and workloads, not for sustained, resource-saturating use that crowds out neighbouring Customers. By way of example, the following are not acceptable uses of an entry Self-Managed tier:

• bulk media distribution or video/audio streaming and download hubs;
• using the plan’s storage as an archival dumping ground or general-purpose backup target unrelated to a hosted site or application;
• operating file-sharing, file-mirroring or large-file-locker hubs; and
• any sustained workload that consistently saturates CPU, memory, disk I/O or network beyond what the tier is designed for.

If your workload outgrows a tier, the right answer is to move to a higher Self-Managed tier or to a Managed plan. We will tell you when usage looks out of line with fair use and, wherever practicable, give you the chance to upgrade or adjust before we take any restrictive action. Managed Services are sized to the workload agreed with you; if your usage materially exceeds the agreed scope, we will discuss an appropriate plan with you.

6. AI and automated systems

If you use the Services to run, train, fine-tune, serve or interact with artificial-intelligence or other automated systems, the rest of this AUP applies in full, and the following additional rules apply:

• You must not use the Services to generate, host, store or distribute child sexual abuse material, non-consensual intimate imagery, or deceptive synthetic media (“deepfakes”) created to deceive, defraud, defame or impersonate. This prohibition is absolute and is enforced under the zero-tolerance approach in section 2.2 where it concerns minors.
• You must not use the Services to circumvent, disable, jailbreak or defeat the safety features, content filters or usage policies of any AI system, whether ours, a third party’s or your own as deployed for end users.
• You must not use the Services to conduct high-volume automated abuse, including automated scraping in breach of a target’s terms, automated account creation, credential stuffing, automated spam generation, or any large-scale automated activity that harms third parties or the platform.

7. How Self-Managed and Managed Services differ

Responsibility for security and configuration depends on the type of Service you use.

7.1 Self-Managed Services

On Self-Managed Services, you control the configuration of your environment — the operating system, software stack, applications, accounts, credentials and security settings. You are responsible for keeping that environment secure and up to date, applying patches, choosing strong authentication, and ensuring that what you run does not breach this AUP. Self-Managed Services are provided on a best-effort basis with no SLA; we maintain the underlying platform, network and facilities, but the configuration sitting on top of it is yours to secure.

7.2 Managed Services

On Managed Services, we administer the platform on your behalf, including the elements covered by the SLA. That does not relieve you of responsibility for the Content and Customer Data you place on the Services, for the lawfulness of how you use them, or for the conduct of anyone you permit to use them; all of section 2 through section 6 of this AUP continues to apply to you.

Across both Service types, our infrastructure is operated from enterprise data centres in the Netherlands, with backups stored within the EU/EEA and encrypted at rest (AES-256) by the storage provider; the sites you host with us are served directly from those data centres, and the mail in your Hosted Mailboxes is stored there and included in those backups. Our helpdesk provider, the edge network in front of our own websites and the relay that delivers email sent from our servers are outside the EEA and are named, with the transfer safeguards relied on, in our Privacy Policy and on our Subprocessors page. Managed Email mailboxes are a separate case: they live in your own tenant, are not on Maxinodes infrastructure, are not covered by the SLA, are not within our EU/EEA backup commitment, and are governed by Microsoft’s or Google’s own terms, data-processing agreements and service levels.

8. Monitoring and enforcement

No one at Maxinodes reads or browses the Content you host, and we do not review it for editorial or commercial purposes. We respect the privacy of your Customer Data and we do not go looking through it. Automated security scanning does run continuously on our shared hosting platform, inspecting files as they are written and on a schedule, to detect malware and compromised files; we do that on the basis of our legitimate interest in keeping the platform secure. That scanning runs on our own servers: customer file content is not uploaded to the scanning vendor for analysis, although the scanning software does send its own diagnostic and error telemetry to its vendor. Email is filtered automatically as well: connections from known spam sources are refused after a check of the sending server’s IP address against blocklists; incoming mail is scored for spam on our own servers and filed into the Junk folder when it looks like spam; and outgoing mail is checked for spam on our servers and again by our outbound relay, and counted against the sending limits in section 4.6. We also act on credible reports of abuse, on information we receive from third parties or authorities, and on issues that come to our attention through routine operation of the platform (for example, automated alerts about outbound spam or resource abuse).

8.1 A graduated, proportionate response

Where we can, we respond to suspected breaches with a proportionate, graduated ladder, escalating only as far as the circumstances require:

1. Notice — we tell you what we have identified and why it concerns us.
2. Request to remedy — we ask you to fix or remove the issue within a reasonable period.
3. Content removal — we remove or disable access to the specific offending Content.
4. Suspension — we suspend the affected service or account while the matter is resolved.
5. Termination — we terminate the affected service or account.
6. Referral to authorities — where the law requires it or the conduct warrants it, we refer the matter to the relevant authorities.

8.2 Immediate action

We may act immediately, and without prior notice, where the Content or activity is unlawful, where there is a credible threat to the security, integrity or performance of the platform or to other Customers or third parties, where we are required to do so by law or a competent authority, or where prior notice would be impractical or would frustrate the protective purpose of the action. CSAM is always dealt with under section 2.2 and never through the graduated ladder.

8.3 Consumers and proportionality

Where you are a Consumer, we will give you proportionate, notice-based treatment wherever practicable, and we will limit any suspension or removal to what is necessary to address the issue. Nothing in this section overrides your mandatory statutory rights as a Consumer.

8.4 Business Customers

Where you are a Business Customer, you indemnify us against third-party claims, fines and reasonable costs arising from your breach of this AUP, and you accept that, given the operational risk that misuse poses to a shared platform, we may exercise the suspension and termination rights in this section more readily. This paragraph does not apply to Consumers.

8.5 Effect of enforcement

Action we take under this AUP to address a breach is not a breach of our agreement with you, and does not entitle you to a refund or service credit for the period affected by your own misuse. Where we have acted on a report that proves unfounded, we will restore the affected Content or service as promptly as we reasonably can.

9. Reporting abuse

If you become aware of Content or activity on our network that breaches this AUP, please report it to abuse@maxinodes.com. To help us act quickly and accurately, please include, where you can:

• the URL, IP address, domain or other identifier of the offending resource;
• a clear description of the issue and which part of this AUP you believe it breaches;
• any supporting evidence, such as logs, message headers, timestamps (with time zone) or screenshots; and
• your contact details, so we can follow up if we need more information.

We treat abuse reports seriously and investigate them promptly. We may need to share elements of a report with the relevant Customer or with authorities in order to act on it; we handle any personal data in such reports in accordance with our Privacy Policy. Reports of CSAM are escalated immediately under section 2.2.

9.1 Where your report goes

Mail sent to abuse@maxinodes.com reaches our own Microsoft 365 tenant in the EU and is then forwarded into our helpdesk platform, operated by Zendesk, Inc. (United States). The report, everything attached to it and our correspondence about it are stored there, and the sender becomes a contact record. That means the report is processed outside the EEA — and it usually contains personal data about people other than the sender: the person being reported, and anyone who happens to appear in the logs, message headers or screenshots supplied. We would rather say so plainly than let a reporter assume the report stops with us. Our Privacy Policy and our Subprocessors page name the recipient, say where it processes data and set out the transfer safeguards relied on.

9.2 What to keep off that route

Please do not send us passwords or other credentials, copies of identity documents, or special categories of personal data such as health information, whether they are yours or someone else’s. And where a report is an allegation that an identified person has committed a criminal offence — including CSAM, and including any formal law-enforcement or legal-process correspondence — please use a route that does not pass through a third-party helpdesk: write to us by post at Maxinodes Ltd, 1 Ballycoolin Road, Dublin 15, Ireland, or email billing@maxinodes.com, which despite its name is the one published address that reaches us directly. Say what the message concerns and we will pick it up. If a matter involves an immediate risk to a person, contact An Garda Síochána first; we will act on any report we receive, but we are not an emergency service.

10. Changes to this policy

We may update this AUP from time to time — for example, to address new forms of abuse, to reflect changes in law, or to clarify our expectations. The version in force is always the one published at this URL, identified by the version label and date shown below. Where a change materially reduces your rights or imposes significant new obligations, we will give you reasonable advance notice through the Client Area or by email before it takes effect. Your continued use of the Services after a change takes effect constitutes acceptance of the updated AUP. This AUP should be read together with our Terms of Service, our SLA and our Privacy Policy.

What changed in this version. Version 1.3, published on September 19, 2026, covers the mailboxes that come with every hosting plan (Hosted Mailboxes, described in clause 8.1 of the Terms). Section 4 is now “Email and zero-tolerance spam policy”. It adds that Hosted Mailboxes are for your own correspondence and that newsletters, marketing campaigns and other bulk email, whether from mailboxes or from scripts on your hosting account, must go through a dedicated sending service (4.5); the hourly sending limit per domain for each plan and the current per-message limits (4.6); and what we may do when a mailbox or account is compromised (4.7). Sections 4.2 to 4.4 now also cover forwarded spam, outbound filtering and spam complaints. Section 1 brings Hosted Mailboxes within the scope of this policy; section 5.1 explains that mail shares your plan’s storage; section 7.2 adds the outbound email relay to the providers outside the EEA and now says that backups are encrypted at rest (AES-256) by the storage provider, where it used to say they were encrypted on our own hardware before leaving it; and section 8 describes automated email filtering. Version 1.2, published on August 31, 2026, renames Resold Email to Managed Email throughout and restates what it covers: the Microsoft 365 or Google Workspace subscription is taken out in your own name and we administer it for you, rather than being resold by us. Nothing about what this policy prohibits has changed. The previous version was published on August 7, 2026 to record four infrastructure changes and the transfers that follow from them: authoritative DNS for customer domains moved to an EU provider on July 26, 2026; our own websites and the Client Area were placed behind Microsoft’s global edge network and our corporate DNS moved to Azure DNS on August 4, 2026; and support moved from our own self-hosted helpdesk to Zendesk, Inc. in the United States on August 6, 2026. Customer websites were not affected by any of them and are still served directly from our servers in the Netherlands. The full record is in the change history on our Subprocessors page.

Contact

Report a violation, or ask about this policy: abuse@maxinodes.com.

By post: Maxinodes Ltd, 1 Ballycoolin Road, Dublin 15, Ireland.

Version 1.3 · Last updated September 19, 2026. We may update this document from time to time; the version in force is always the one published at this URL.