Acceptable Use Policy

Last Updated: 21 October 2026
Version: 1.0.0

1. The short version

This policy is short on purpose. It applies to every instance, every plan, and every person who uses NairaCloud. If you break it, we may stop the offending site or instance, and we will tell you why by email. Serious violations can end your account without notice. That consequence is stated once, here.

You are responsible for everything that runs on your instance and for everyone you give access to.

2. What you may do

Run any lawful workload. These are all fine:

• Websites and APIs -- a Laravel portfolio, a Django store, a Next.js SaaS, a FastAPI service.
• Webhooks and bots -- a Paystack webhook listener, a WhatsApp bot, a Telegram bot, a Discord bot.
• Game servers -- Minecraft, Valheim, or a private game server for your community.
• Chat and realtime -- a WebSocket notification service, a live auction, a small chat app.
• Databases, caches, and workers -- PostgreSQL, MySQL, Redis, a Celery worker, a queue consumer.
• Development, staging, and production on one instance -- separate them with site labels or ports.
• Personal and commercial projects -- your side project, your registered business, your client's app.

You own your instance. Configure it, reboot it, reinstall the OS image, and run Docker inside it, within the limits of your plan.

3. What you may not do

Do not use NairaCloud for any of the following.

Prohibited	Examples
Illegal activity	Fraud, "419" advance-fee schemes, money laundering, selling controlled or illegal goods, human trafficking.
Child sexual abuse material	Any sexual content involving minors, in any form. We suspend immediately, preserve evidence, and report to the authorities.
Malware and ransomware	Botnets, command-and-control servers, credential stealers, exploit kits, ransomware, malware distribution.
Phishing and fraud	Fake login pages, credential harvesting, fake payment pages, investment scams, business email compromise.
Spam and bulk mail	Unsolicited email, purchased lists, open relays, cold outreach through port 25.
Attacks on others	DDoS, amplification, brute force, credential stuffing, exploiting vulnerabilities, scanning ports you do not own.
Unlawful content in Nigeria	Material whose distribution is criminalised by Nigerian law. We act on valid notices and preserve evidence.
Unlicensed gambling	Sports betting, casinos, or lotteries without the licence required in the relevant jurisdiction.
Unlicensed financial services	Deposit-taking, FX trading, or payment processing without the required licence.
Copyright infringement	Pirated films, music, software, games, or other protected works.
Proxy, VPN, Tor, or anonymiser abuse	Public proxies, Tor exit nodes, open resolvers, or reselling our network without a written reseller agreement.
Crypto mining	Any cryptocurrency mining, staking, validator, or mining pool. This is a capacity and abuse issue, so it is not allowed on shared plans.
Resource abuse	Sustained CPU, RAM, disk, or network use that degrades the node for other customers, or creating accounts to bypass limits.
Security evasion	Disabling the AppArmor profile, breaking out of the container, accessing the host or another tenant, or hiding abusive processes.

If you are unsure whether a workload is allowed, email support@nairacloud.xyz before you run it. Asking first is always cheaper than being suspended.

4. Email

Port 25 (SMTP) is blocked on every instance. Your app can send transactional email -- password resets, receipts, notifications your users asked for -- through a provider such as Postmark, SendGrid, Mailgun, or Amazon SES.

You may not use NairaCloud to send bulk marketing, cold outreach, or purchased-list email. Use a dedicated email provider and follow its acceptable-use rules.

5. Scanning and security research

• Do not scan the platform's shared IP, the node, or another customer's published ports. Ordinary health checks of your own site are fine.
• We do not scan your instance or offer vulnerability scanning as a product without your explicit consent.
• If you find a vulnerability in NairaCloud itself, we want to hear about it. Email security@nairacloud.xyz with enough detail to reproduce it. We will acknowledge good-faith reports within two business days, work with you on a fix, and will not take legal action against research conducted in good faith under this policy.
• Safe harbour does not cover testing against other customers, data exfiltration, denial of service, or anything that damages the platform.

6. Enforcement

We investigate reports before acting where the situation allows it. We may rate-limit, restrict, suspend a site, suspend an instance, or terminate an account.

Non-severe violations -- for example a misconfigured crawler or a first resource-abuse incident -- get an email explaining the problem and 48 hours to fix it.

Severe violations get immediate action, with notice as soon as it is safe to send one. Severe includes child sexual abuse material, active attacks, malware, phishing at scale, a container breakout, or a valid court order. For child sexual abuse material we do not notify the account before reporting to the authorities.

When we suspend an instance, we preserve evidence as required by law. Suspended time is not refunded. We keep the audit record of what we did, why, and who approved it.

7. Appeals and quarantine

• General enforcement appeals: email appeals@nairacloud.xyz within 14 days of the action. Include your account ID, the action, and the evidence you want us to review. A person independent of the original decision reviews it.
• Security quarantine: if the runtime monitor auto-contains an instance after a suspected breakout, the notice includes a 2-day appeal window. Reply to the notice or open a support ticket before the deadline. If we receive no appeal, the case is closed and the suspended period is not refunded.

8. Reporting abuse

Email abuse@nairacloud.xyz with:

• your contact details;
• the target IP, hostname, URL, or instance;
• the time in UTC;
• what you observed;
• logs, headers, screenshots, or packet captures if you have them.

We acknowledge reports on this schedule:

Severity	Examples	Acknowledgment	Target action
Critical	Child sexual abuse material, active DDoS, active breach	1 hour	Immediate mitigation
High	Malware, phishing, spam	4 hours	Within 24 hours
Medium	Scanning, policy violation	24 hours	Within 72 hours
Low	General complaint	48 hours	Within 7 days

Knowingly false abuse reports can lead to account termination.

9. Law enforcement and legal requests

Send legal process to legal@nairacloud.xyz. We verify the authority, jurisdiction, and scope of every request before disclosing anything. We produce only the records within scope, preserve evidence where required, and publish an annual transparency summary of requests received and how we responded.

10. Changes and contact

We post changes on this page and update the date above. Material changes get 14 days' notice by email and in the dashboard. Continued use after the effective date means you accept the updated policy.

Abuse: abuse@nairacloud.xyz
Appeals: appeals@nairacloud.xyz
Legal: legal@nairacloud.xyz
Security research: security@nairacloud.xyz
Support: support@nairacloud.xyz