1. Purpose and scope
1.1 This Acceptable Use Policy (the "AUP") sets out the rules for using the services provided by ON DIVERSITY CLOUD EUROPE, S.L. ("DIVERSITY", "we", "us") (the "Services"). It sets out in detail the prohibited uses listed in Section 6.2 of our General Terms (/general-terms/) and forms part of the Agreement.
1.2 The AUP binds the Customer and anyone who uses the Services through the Customer, including its employees, contractors and clients ("you"). The Customer is responsible for their compliance (General Terms, Section 6.1).
1.3 Capitalised terms not defined in this AUP have the meaning given to them in the General Terms.
1.4 Precedence. If this AUP conflicts with the General Terms, the General Terms prevail. If an Order Form expressly permits an activity that this AUP restricts, the Order Form prevails for that Customer.
1.5 This AUP governs your use of the Services. It does not govern access by DIVERSITY staff to your systems during professional services, which is governed by the contract for those services.
2. General prohibitions (all Services)
You must not use the Services to create, store, transmit, publish, make available or facilitate:
(a) content or activities that are illegal under European Union law or the law of the Member State concerned, including child sexual abuse material, terrorist content, and intimate or sexual images of real people made or shared without their consent;
(b) content that infringes the intellectual property, privacy, data protection or other rights of third parties;
(c) fraud, phishing, impersonation, or the sale of illegal goods or services;
(d) malware, botnets, command-and-control infrastructure, ransomware or other malicious code, except samples kept for legitimate security research or defence in an isolated environment from which they cannot reach third parties;
(e) unsolicited communications (Sections 4 and 5);
(f) activities that breach European Union or other applicable sanctions or export control law, including making the Services available to persons or entities subject to restrictive measures;
(g) harassment, threats, or incitement to violence or hatred contrary to law.
3. Network and security (Cloud, Bare Metal, Disaster Recovery and Colocation)
3.1 Scanning and testing. You must not scan, probe, test the vulnerability of, or attempt to access systems or networks that you do not control, without the written authorisation of their owner. You may test your own systems, provided the tests do not affect other customers or our shared infrastructure. You must not scan, probe or test our own infrastructure or platform.
3.2 Denial of service. You must not launch, take part in or offer denial-of-service attacks, including "stress testing" services aimed at third parties.
3.3 Spoofing. You must not forge or spoof IP addresses, MAC addresses or other network identifiers. You may send traffic only from IP addresses that we have assigned to you or that you are authorised to use under Section 3.5.
3.4 Open services. You must not run open mail relays, open DNS resolvers, open proxies or other services that third parties can abuse, including services that can be used to amplify attacks. Services you expose must be restricted to their authorised users.
3.5 BGP sessions. Where the Services include a BGP session with us, for example for Disaster Recovery:
(a) you may announce only prefixes and autonomous system numbers, public or private, that you hold or that their holder has authorised you in writing to use;
(b) you must keep accurate route objects in an internet routing registry and RPKI route origin authorisations for every prefix you announce;
(c) you must not announce bogon prefixes, routes received from other networks, or prefixes more specific than we have agreed, unless we have agreed otherwise in writing;
(d) we filter announcements that do not meet these requirements and reject routes that are invalid under RPKI.
3.6 Anonymisation and proxy services. You must not run Tor nodes of any kind, or VPN or proxy services offered to the public. VPNs and proxies used only by your own organisation to access its systems are allowed.
4. Email (Cloud and Bare Metal)
4.1 Outbound connections on port 25 (SMTP) are blocked by default. We open them on request for a mail server that we have verified. To be verified, the mail server must have valid reverse DNS and published SPF, DKIM and DMARC records for the domains it sends from.
4.2 Bulk and marketing email may be sent only to recipients who have given the consent required by applicable law (in Spain, Article 21 of Law 34/2002, LSSI-CE). Every message must contain a working unsubscribe mechanism, and unsubscribe requests must be honoured promptly.
4.3 You must not send spam from the Services, use the Services to host websites or other resources promoted by spam sent from elsewhere, or use purchased, rented or harvested address lists.
4.4 If your sending causes our IP addresses to be listed on reputable blocklists, you must remove the cause promptly. We may block port 25 again until it has been removed.
5. Telecommunications (CloudPBX, SIP trunking, numbers and A2P messaging)
In addition to Section 6.3 of the General Terms:
(a) Caller identification. You must present only numbers and sender identifiers that you are entitled to use, and you must not falsify caller identification.
(b) Unsolicited calls and messages. You must not make automated or unsolicited calls or send unsolicited messages, including robocalls, contrary to applicable law. Commercial calls and messages require the recipient's consent or another basis permitted by law.
(c) Fraud. You must not engage in or facilitate toll fraud, artificially inflated traffic, International Revenue Share Fraud (IRSF), traffic pumping, or the bypass of interconnection routes, for example with SIM boxes.
(d) Numbers. You must use numbers only in line with the conditions attached to them under the applicable numbering plan, and give us accurate user identification and address data where the law requires it.
(e) A2P messaging. You must send messages only from sender identifiers that you are entitled to use and that are registered where the law requires it, with lawful content, and only to recipients who have agreed to receive them where the law requires their consent.
(f) Emergency calls. You must not make false calls to emergency numbers. Where the Services allow emergency calls, you must keep the location information associated with each number up to date.
(g) We may block calls to high-risk destinations and traffic that shows signs of fraud.
6. Resource use (all Services)
6.1 Cryptocurrency mining is prohibited on all Services. This includes mining, plotting or farming for any cryptocurrency, whether based on proof of work, proof of space or a similar mechanism.
6.2 Resources are limited to those set out in your Order Form. There are no fair-use limits beyond your plan: when you reach a limit of your plan, the affected resource may be blocked or disabled. You must not try to get around the limits of your plan.
7. AI services
7.1 You may use our AI services, including the models we run on our GPUs, only for lawful purposes. You must not use them to generate, process or distribute illegal content, including the content listed in Section 2(a).
7.2 You must not use the AI services for practices prohibited by Article 5 of Regulation (EU) 2024/1689 (AI Act). You are responsible for the obligations that the AI Act places on you as provider or deployer of an AI system built with the Services, including transparency obligations where they apply.
7.3 Where a model is provided under a third-party licence or use policy, you must comply with that licence or policy, which is presented to you, and which you must accept, before you first use the model.
7.4 If you submit personal data to the AI services, you must have a legal basis for doing so. We process that data as your processor under the DPA.
8. Colocation
8.1 Access. Only persons you have registered in advance in our access control system may access the data centre. Access to shared racks (one third or two thirds of a rack) is always escorted by our staff. Persons registered for a full rack may access it without escort, using their personal access card and PIN. Access cards and PINs are personal and must not be shared.
8.2 Site rules. In the data centre you must:
(a) follow the instructions of our staff and of the data centre facility's staff;
(b) install only equipment that is in safe working condition and complies with applicable safety standards;
(c) keep power consumption and heat output within the limits set in your contract;
(d) keep cabling tidy and labelled, and not obstruct airflow;
(e) not touch, photograph or film other customers' equipment;
(f) remove packaging and other combustible materials from the data hall, and not bring food or drink into it.
8.3 We may disconnect equipment that endangers people, the facility or other customers' equipment (Section 12.2).
9. Security of your systems
9.1 You must keep the systems you run on the Services secure, including by applying security updates, using strong authentication, changing default credentials and closing services you do not need.
9.2 If a system is compromised or misconfigured in a way that harms others, we may isolate it as an emergency measure (Section 12.2). You must fix it before it is reconnected.
9.3 You must respond to our abuse notifications promptly and within any time stated in the notification.
10. Third parties, resale and partners
10.1 Customers. You may use the Services to provide your own services to your clients, for example by hosting their websites, provided that you remain responsible for their use, bind them to terms at least as protective as this AUP, and handle abuse reports about them. You may not resell the Services as such, under our brand or as a white label, without our written agreement.
10.2 Partners. Our partner programme is referral only. Taking part in it does not give the right to resell the Services.
11. Reporting abuse
11.1 Report abuse of the Services to abuse@corp.ondiversity.eu. To help us act quickly, include:
(a) the IP address, URL, number or other identifier involved;
(b) the date, time and time zone of the events;
(c) a description of the abuse and supporting evidence, such as logs or full email headers;
(d) your contact details.
11.2 Notices of illegal content are handled under Section 6.4 of the General Terms, and our decisions on content under Section 6.5.
11.3 We may forward your report to the customer concerned so that it can act on it. Tell us in your report if you do not want your contact details to be forwarded.
12. Enforcement
12.1 Standard procedure. If we become aware of a breach of this AUP, we notify the Customer, explain the breach and give it reasonable time to remedy it, taking into account the seriousness of the breach. If the breach is not remedied in that time, we may restrict or suspend the affected Services, limited to what is necessary (General Terms, Section 8).
12.2 Emergency measures. Where a Service is actively causing serious harm, for example through an attack launched from it, malware, illegal content or a compromised system, we may restrict or suspend it immediately, limited to what is needed to stop the harm. We then notify the Customer with the reasons without delay, and restore the Service once the cause has been removed.
12.3 Termination. Serious or repeated breaches may lead to termination of the Agreement under Section 16 of the General Terms.
12.4 We apply this AUP diligently, objectively and proportionately, with due regard to the rights and legitimate interests of everyone involved (Article 14(4) of Regulation (EU) 2022/2065, Digital Services Act). Statements of reasons for decisions on content are given under Section 6.5 of the General Terms.
12.5 Authorities. We comply with lawful orders of competent authorities, including orders under Articles 9 and 10 of the Digital Services Act. We inform the competent authorities where the law requires it, including under Article 18 of the Digital Services Act when we become aware of information giving rise to a suspicion of a criminal offence involving a threat to the life or safety of persons.
12.6 Service levels. Downtime caused by a restriction or suspension under this AUP that results from your breach does not count as unavailability under the SLA.
13. Changes to this AUP
13.1 We may change this AUP by notifying the Customer at least 30 days before the change takes effect. Changes required by law or by an urgent security need may take effect sooner, and we will notify them as soon as possible.
13.2 If a change materially harms the Customer, Section 20.2 of the General Terms applies.
13.3 The current version is published at /acceptable-use-policy/ with its "Last updated" date.
14. Contact
Reports of abuse: abuse@corp.ondiversity.eu. Questions about this AUP: legal@corp.ondiversity.eu.