Acceptable Use Policy

1. Scope

This Acceptable Use Policy forms part of the Terms of Service of OpenWAF Cloud, operated by AI Services LLC. It applies to every customer, to their members, and to every domain, hostname and website placed behind OpenWAF.

2. Prohibited content and uses

You must not use OpenWAF, or place behind it any website or DNS zone, for:

• content or activity that is illegal under applicable law;
• child sexual abuse material, in any form;
• phishing, or impersonating other people, brands or organisations to deceive;
• distributing malware, or operating command-and-control (C2) infrastructure for malware or botnets;
• sending spam, or supporting spam campaigns;
• fraud and scams;
• infringing the intellectual property rights of others;
• harassment, threats, incitement to violence or violent extremist content, as defined by applicable law;
• DNS abuse, such as fast-flux networks or domains registered or used to commit any of the abuses in this list;
• attacking third parties, including denial-of-service attacks, unauthorised scanning or intrusion attempts;
• hiding the origin of any of the activities above, or making it harder to stop them.

3. Our infrastructure

Do not attack, overload, scan or test the security of OpenWAF’s infrastructure, or try to access other customers’ data. Security research is welcome only within the responsible-disclosure policy described on our security page and in security.txt.

4. Fair use

During early access OpenWAF is free and has no limits, and we do not announce fixed quotas. This is subject to fair use: if your usage endangers the stability or performance of the service for other customers, we may contact you, ask you to reduce it, or throttle it. We will try to talk to you first whenever possible.

5. How to report abuse

Write to [email protected]. To help us act quickly, please include:

• the affected URLs or hostnames;
• evidence of the abuse (for example, screenshots, message headers or samples);
• the date and time when you observed it, with time zone;
• your contact details, in case we need more information.

6. What we do with reports

OpenWAF is a reverse proxy and DNS provider. We do not host our customers’ websites: the content is stored on the customer’s own servers or with its hosting provider. When we receive a report, depending on the case, we may:

• forward the report to the customer responsible for the hostname, so that it can act;
• disable proxying or DNS for the affected hostname;
• suspend the customer’s account;
• preserve the relevant data and disclose it to the competent authorities when the law requires it.

We may act immediately when needed to stop serious harm, such as phishing or malware.

7. Contact for authorities

Authorities of the Member States of the European Union, the European Commission and the European Board for Digital Services can contact us, as our single point of contact under articles 11 and 12 of the Digital Services Act (Regulation (EU) 2022/2065), at [email protected] for abuse matters and at [email protected] for anything else. Users of the service can use the same addresses. We accept communications in English and Spanish.

8. Appeals

If we take action against your account or one of your hostnames, we will tell you why whenever possible. You can reply by e-mail to contest the decision and give us any information we should take into account. We will review it and tell you the result.

9. Changes

We may update this policy. Significant changes will be notified as described in the Terms of Service.