Last Revised: 2026-08-17 23:28

ACCEPTABLE USE POLICY (AUP)

Article 1: Introduction, Scope & Legal Validity

1.1. Purpose: This Acceptable Use Policy (hereinafter "AUP" or "Policy") sets forth the binding rules, prohibitions, and operational limitations governing the use of all infrastructure, servers, networks, systems, and hosting services provided by Prootzos Online (hereinafter "Provider"). The objective of this Policy is to safeguard the security, integrity, availability, IP reputation, and regulatory compliance of the Provider's infrastructure.

1.2. Company Identity & Operational Model:

Trade Name: Prootzos Online
Legal Representative (CEO): Prountzos Nikos
Tax Headquarters & Postal Address: 46 Karkavitsa Str., 27131, Pyrgos Ilia, Greece (Tax Office: Pyrgos | VAT ID: EL 047648274).
Operational Model: Remote-First. The physical headquarters operates strictly as a registered tax and postal address. There is no physical retail store or walk-in customer support facility.
Official Communication Channels: Telephone: +30 2621 121 373 | Email: contact@prootzos.com | Electronic Support Tickets via the Client Area.

1.3. Scope & Acceptance: This Policy is binding upon any natural or legal person entering into a service agreement with the Provider ("Client"), as well as any third-party end user accessing or utilizing the services through the Client. Utilizing any service constitutes full, explicit, and unconditional acceptance of this AUP.

1.4. Hierarchy & Document Interoperability: This Policy is incorporated into and constitutes an integral part of the General Terms of Service (DOC-001). All defined terms are interpreted strictly pursuant to the Common Definitions Registry (DOC-002). Threat detection mechanisms, firewalls (L1–L4), and abuse mitigation run strictly at the server level (server-side) and are independent of client-side tracking technologies, which are regulated strictly via Google Consent Mode v2 and the Cookie Policy (DOC-006). On technical security matters, this Policy is supplemented by the Infrastructure Constraints & Security Baseline (DOC-012).

Article 2: Prohibited Activities & Unlawful Content

The use of the Provider's systems, servers, IP addresses, and networks for any of the following purposes or activities is strictly prohibited:

2.1. Malicious Software & Cyberattacks:

Hosting, distributing, transmitting, or linking to malicious software (malware, ransomware, viruses, worms, trojans, rootkits, keyloggers).
Operating Command & Control (C2) nodes for botnets.
Hosting deceptive pages (phishing / spear-phishing) and credential or financial harvesting mechanisms.
Executing or participating in Denial of Service (DoS / DDoS) attacks, whether as a source (outbound amplification/flooding) or as an intentional target.
Port scanning, vulnerability probing/scanning, and brute-force attacks against any system without prior express written authorization.

2.2. Cryptocurrency Mining:

The execution of any software, script, or process for cryptocurrency mining is strictly prohibited, whether operating as standalone executable binaries, web-embedded scripts (e.g., JavaScript miners), or participation in mining pools.

2.3. Infringement of Rights & Illegal Content:

Storing, publishing, or distributing material that infringes intellectual property rights, trademarks, patents, or trade secrets of third parties (warez, torrent trackers, unauthorized streams, pirated software).
Hosting or distributing Child Sexual Abuse Material (CSAM) — an act resulting in immediate, permanent service termination and direct referral to law enforcement authorities.
Promoting terrorist activities, hate speech, illegal weapons trading, narcotics trafficking, or unapproved pharmaceuticals.

2.4. Security Breaches & Privilege Escalation Attempts:

Attempts to bypass the Provider’s defense layers (L1 Datacenter Firewall, L2 Proxmox Firewall, L3 fail2ban, L4 ufw).
Attempts to gain unauthorized access to neighboring hosting accounts, underlying virtualization layers (hypervisor breakout), or unauthorized filesystems.
Privilege escalation attempts to obtain root/superuser permissions.
Network header forgery, IP spoofing, and manipulation of routing systems.

Article 3: Email Policy & Abuse Mitigation (Zero Tolerance Spam)

3.1. Prohibition of Unsolicited Communications:

The transmission of Unsolicited Bulk Email (UBE / Spam), commercial messages without prior explicit consent (opt-in), cold outreach lists, and messages with forged headers is strictly prohibited.
The use of purchased, rented, or harvested (scraped) recipient lists is prohibited.
Shared and managed email hosting infrastructure is not designed for bulk marketing or newsletter delivery. Bulk transmissions, even with full opt-in consent, require an external SMTP relay service or a dedicated architecture with a Dedicated Mail Node (DOC-009).

3.2. Technical Limits & Mail Queue Monitoring:

Strict outbound rate limits are enforced per mailbox and per domain.
If the outbound mail queue (Postfix mail queue) exceeds the safety threshold (burst > 1,000 messages per hour) or exhibits an abnormally high failure rate (bounce rate > 15%), the system automatically freezes outbound queues and temporarily suspends SMTP authentication credentials.
The collection, analysis, and retention of email logs and traffic metadata for abuse mitigation is based on the Provider's legitimate interest in network and information security (GDPR Article 6(1)(f) and Recital 49).

3.3. Mail Filtering (Rspamd & Greylisting):

Antispam management is executed via Rspamd. The Client may select predefined spam filtering policies/sensitivity levels exclusively through the Controller interface.
Custom regex or LUA spam rules cannot be injected by the Client into Rspamd.
Greylisting is enforced system-wide and parameterized per domain/user within the Controller.

3.4. IP Reputation Protection & RBL Blacklisting:

If the Provider's IP addresses are listed on Real-time Blackhole Lists (RBLs) due to the Client's actions, omissions, or compromised scripts/accounts, the Provider reserves the right to immediately suspend outbound email services.
Delisting procedures, RBL remediation, and IP reputation restoration arising from Client-generated spam constitute Billable Professional Services (Mail Deliverability Consulting) under DOC-009 and are not included in core hosting subscriptions.

Article 4: System Resource Fair Use & Isolation (cgroups & Quotas)

4.1. cgroups Isolation Mechanism (Noisy Neighbor Prevention):

In all Shared Hosting environments, resource allocation and throttling (CPU, RAM, Disk I/O, maximum process count - Nproc) are strictly enforced at the Linux kernel level via cgroups v2.
Noisy Neighbor Policy: Sustained excessive resource consumption that degrades performance for other hosted clients is prohibited. Processes that maintain 100% of allowed burst limits for longer than ninety (90) seconds are automatically deprioritized (nice/ionice) or terminated immediately by the Out-Of-Memory (OOM) Killer.
The Client has visibility within the Controller exclusively over Storage Quota and Traffic Quota metrics.

4.2. Storage Quota, Traffic & Backup Consumption:

Storage Quota: Reaching 100% of the allocated disk quota automatically suspends write operations, database modifications, and incoming email reception.
Backup Quota Interaction: Backups generated through the Controller (files, databases, mailboxes) count directly against the account's total Storage Quota. When the quota is full, automated backups are halted (DOC-010).
Traffic Quota & Prorated Billing: Exceeding the monthly bandwidth allocation results in automated website suspension with an HTTP 509 error (Bandwidth Limit Exceeded). Service restoration is accomplished exclusively by upgrading the hosting package via the Client Area, billed automatically on a Prorated Billing basis for the remainder of the active billing cycle pursuant to DOC-011.

4.3. Database Resource Limits:

Relational databases (MariaDB, MySQL, PostgreSQL) may be used exclusively for the operational requirements of hosted applications.
Database user accounts do not possess SUPER, GRANT OPTION, or administrative root privileges.
Continuous, unindexed slow queries causing daemon lockups, as well as the use of databases as binary file repositories (BLOB storage exceeding 50MB per record), are strictly prohibited.
Direct remote database connections on external ports (e.g., TCP 3306/5432) are prohibited without an encrypted SSH/SSL tunnel. This prohibition does not restrict access via the embedded phpMyAdmin/phpPgAdmin tools within the Controller.

4.4. Access Limitations, Shell & Virtualization Constraints:

File Access: Access is restricted to chrooted FTP and jailed sFTP/SSH strictly within the /var/www/clients/clientX/webY document root.
Shell Restrictions: Full interactive root shells, sudo privileges, and on-the-fly system package installations are strictly unavailable.
Scheduled Tasks (Cron Jobs): Cron jobs may only be scheduled via the Controller with a minimum execution interval of five (5) minutes. Background daemons, IRC bots, proxy servers, scraping bots, and torrent clients are prohibited.
Virtualization Management (Managed VMs): For Managed VMs, lifecycle operations (Start, Stop, Reboot, Usage Stats) are executed exclusively through the integrated module within the Controller. Access to the Proxmox Web UI, VNC Console, custom ISO uploads, or virtual network/VLAN configuration is not provided.

Article 5: Web Server Configuration Rules & vHost Options Tab

5.1. Shared Hosting (Locked Options Tab):

In Shared Hosting environments, web server (Apache/Nginx) and PHP configurations are standardized. The Options tab in the Controller is locked and disabled for the Client.

5.2. Managed VM & Managed Dedicated Servers (Active Options Tab):

In Managed VM and Managed Dedicated Server environments, the Options tab in the Controller is enabled, allowing the Client to insert custom directives (Custom Apache Directives, Custom Nginx Directives, Custom PHP Directives / php.ini snippets).

5.3. Liability Allocation & Billable Crash Recovery (Scope Creep Protection):

The Client bears sole and exclusive technical responsibility for the syntactic correctness, security, and compatibility of all custom directives entered into the Options tab.
Any web server malfunction, syntax error, daemon failure, or complete web stack crash resulting from Client directives does not constitute a Provider infrastructure failure and is not covered under Core Managed Services.
The Provider disclaims all liability for any direct, indirect, incidental, or consequential damages, loss of revenue, business interruption, loss of data, or lost profits arising from misconfigured custom directives in the Options tab.
Investigation, debugging, and recovery of the web server stack is executed exclusively as an Emergency Professional Service with a minimum charge of one (1) billable hour, regardless of whether the technical resolution requires less time (DOC-009, DOC-012).

Article 6: Immediate Suspension, Isolation & Abuse Containment (Quarantine Protocol)

6.1. Right to Immediate Suspension / Quarantine: The Provider reserves the explicit right to execute immediate quarantine, technical suspension, or network null-routing of any service, account, vHost, or virtual machine without prior notice, subject to immediate ex-post notification via a security ticket in the Client Area, upon detecting:

Outbound malicious activity (Outbound DDoS, Brute-Force, Port Scanning).
Outbound spam outbreaks or compromised mailboxes.
Active malicious content (Phishing pages, Malware distribution, C2 endpoints).
Cryptocurrency mining operations.
Critical threats to the integrity, availability, or regulatory compliance of the Provider’s or third-party networks.

6.2. Technical Execution of Quarantine:

In Shared Hosting, quarantine isolates the specific infected vHost or mailbox via the Controller (chmod 000 / site disabled) without disrupting overall server operations.
In Managed VM or Dedicated Server environments, network null-routing (L1/L2 Firewall) is applied to the server's IP address in cases of massive outbound attacks.
Forensic log collection and retention is conducted under the Provider’s legitimate interest in infrastructure security (GDPR Article 6(1)(f) and Recital 49).

6.3. Incident Handling & Malware Remediation:

Core technical support is strictly limited to providing automated detection logs and notification details.
Quarantine removal occurs only after the root cause has been fully resolved by the Client.
Any manual code analysis, deep file investigation, or database cleaning performed by the Provider is conducted exclusively as a prepaid Professional Service (Malware Cleanup & Securing) under DOC-009.

6.4. Financial Impact, Forfeiture of Fees & Evidence Retention:

Service downtime resulting from abuse suspensions is strictly excluded from SLA uptime calculations (DOC-004).
In the event of suspension or termination due to AUP violations, the Client forfeits all rights to refunds or Account Credits. All prepaid subscription fees and non-refundable Setup Fees for Managed VPS and Dedicated Servers are forfeited in full as a contractual penalty clause.
Evidence Retention: In cases of termination for severe unlawful activities (CSAM, fraud, distributed malware), digital evidence, forensic logs, and account identity records are exempted from automated pruning cycles in the Client Area (WHMCS Data Retention Automation) and retained securely for up to five (5) years to establish, exercise, or defend legal claims and assist law enforcement (GDPR Article 17(3)(e)).

6.5. Separation of Suspension Mechanisms (Billing vs Abuse): Service suspensions are strictly distinguished into:

Billing Suspension: Automated by the Client Area due to overdue invoices (DOC-011), preserving underlying data and vHost configurations intact.
Abuse Quarantine: Enforced immediately at the network level (L1–L4 Firewalls / Null-Route) or system level (Controller vHost lock / permissions lock) for security and operational defense.

Article 7: Abuse Reports, NIS2 Incident Timelines & GDPR Alignment

7.1. Submission of Abuse Reports:

Abuse reports must be submitted electronically to contact@prootzos.com or via a support ticket in the Client Area.
Reports must include complete technical evidence (target IP, full URL, complete email headers, relevant log extracts, and UTC timestamps).

7.2. NIS2 Infrastructure Timelines vs GDPR Data Breach Notifications:

Infrastructure Incidents (NIS2): Incident handling timelines apply exclusively to Significant Cyber Incidents impacting the Provider’s core infrastructure under Directive (EU) 2022/2555 (NIS2) and DOC-012:
$T_0$ (Detection): Automated detection by monitoring stacks and immediate initiation of containment protocols.
$T_0 + 24\text{ Hours}$ (Early Warning): Notification to competent supervisory authorities (CSIRT/EETT) and affected clients in severe impact events.
$T_0 + 72\text{ Hours}$ (Incident Notification): Submission of detailed severity assessments, mitigation steps, and incident metrics.
$T_0 + 1\text{ Month}$ (Final Report): Delivery of the comprehensive Root Cause Analysis (RCA) report.
Client Application Data Breaches (GDPR): In the event of a personal data breach occurring within the Client's application or database (CMS compromise), the Client remains solely responsible as the Data Controller under Articles 33 and 34 of the GDPR. The Provider assists as a Data Processor by supplying relevant server logs pursuant to the Data Processing Agreement (DOC-007).

Article 8: Final Provisions, Amendments & Jurisdiction

8.1. Amendments: The Provider reserves the right to amend this Policy in accordance with the Governance Framework (DOC-001). Major modifications will be communicated thirty (30) days prior to their effective date via the Client Area or email.

8.2. Jurisdiction & Governing Law: This Policy is governed by Greek Law and applicable European Union regulations. Any disputes arising from the interpretation or execution of this Policy shall be subject to the exclusive jurisdiction of the competent Courts of Pyrgos, Ilia, Greece.