acceptable use policy
the short version
your sub is a real computer on the real internet, and you have root. build whatever you like. don't use it to hurt other people, and don't do things that get every other customer's box shut off along with yours.
this policy exists because all subs share the same providers. one box sending phishing pages or attacking someone else can get the whole account suspended, which takes every customer down. so we enforce this quickly.
you may not use sub to
- send spam or unsolicited bulk email or messages of any kind, or run open relays or mail services designed for it. (outbound port 25 is blocked on every box for this reason; use an email api for legitimate mail.)
- phish or defraud: host fake login pages, impersonate other sites or organisations, or run scams.
- host or distribute malware, or run command-and-control for it.
- attack other systems: port scanning, vulnerability scanning, brute forcing, denial of service, or any unauthorised access attempt against anything you don't own or have written permission to test.
- mine cryptocurrency or run similar sustained proof-of-work loads. it wrecks the box for you and gets us flagged by the provider.
- host content that's illegal where you are or where we are, including child sexual abuse material (which we report), content that incites violence, or content that violates sanctions.
- infringe other people's rights: pirated software, media, or other content you don't have the right to distribute. we respond to valid dmca notices.
- invade privacy: collect or publish other people's personal data without a legal basis, or run stalkerware or surveillance tools against people who haven't consented.
- resell your box or offer hosting to third parties from it as a service of your own.
- abuse the shared network: tor exit nodes, open proxies, or traffic patterns that get the ip range blocklisted.
- interfere with sub itself: probing or attacking the control plane, other customers' boxes, or trying to get around limits.
things that are fine
almost everything else. web apps, apis, databases, cron jobs, bots that follow the rules of the services they talk to, security testing of things you own, game servers, personal tools, weird experiments. running hot cpu for a build or a batch job is fine; running it flat out forever isn't. if you're not sure whether something's ok, ask support@sub.software first.
how we enforce this
- for phishing, malware, attacks, and illegal content we stop the box immediately, preserve a snapshot as evidence, and then email you. repeat offences end the account.
- for mining, spam, and resource abuse we warn you first and stop the box on a second occurrence.
- for copyright complaints we forward the notice and give you 48 hours to remove the material before we remove it ourselves. repeat infringers lose their account.
- if a box appears to have been compromised rather than misused, we'll stop it, help you restore to a clean snapshot, and tell you what we saw.
a stopped box keeps its disk. we don't delete your data as an enforcement step unless the law requires it.
reporting abuse
if something hosted on sub is being used against you, email abuse@sub.software with the domain or ip and what you saw. a human reads it.