Acceptable Use Policy for Hostna Services

What must not be hosted or done on Hostna infrastructure, and exactly what happens when it is.

This policy is part of the contract. It applies to every plan, paid or free, and to everyone you give access to.

The short version

Do not use Hostna to attack anyone, to defraud anyone, to abuse anyone, or to host material that is a crime to possess. Do not mine cryptocurrency. Do not send unsolicited mail. Keep your own software patched, because a site you neglect becomes someone else's attack tool and is treated as one.

Where we find material depicting the sexual abuse of a child, or a non-consensual sexual act, there is no warning, no grace period and no appeal before action. The account is closed, the data is preserved for the authorities, and the matter is reported immediately.

1. Prohibited content

You may not store, publish, transmit or link to:

material depicting the sexual abuse or sexualised depiction of minors, in any form, including drawn, rendered, animated or AI-generated depictions;
depictions of rape or of any other non-consensual sexual act, and intimate imagery published without the consent of the person shown, including so-called revenge pornography and sexual deepfakes;
pornography and adult content of any kind, including paid or membership adult sites, camming, escort advertising and any content or service connected to prostitution or the facilitation of sexual services;
gambling, betting, lotteries, casino games, sweepstakes and related affiliate or payment infrastructure, whether or not licensed elsewhere;
offers of controlled substances, narcotics, prescription medicines without prescription, new psychoactive substances, and the equipment or precursors for producing them;
offers of weapons, ammunition, explosives, or instructions for producing them;
content that incites hatred or violence against a person or group, denies or trivialises the Holocaust, or uses the symbols of unconstitutional organisations, within the meaning of §§ 86, 86a, 130 StGB;
terrorist content, and material glorifying, recruiting for or financing terrorism;
material that infringes copyright, trade marks, design rights or patents, including warez, cracks, key generators, unlicensed streaming, and the redistribution of paid works;
defamatory material, doxxing, harassment campaigns, and personal data published in order to expose or endanger someone;
counterfeit goods, forged documents, forged identity papers, and services producing them;
material that is a criminal offence, or gives rise to civil liability, in Germany or in a country the content targets.

2. Prohibited activity

You may not use a Hostna service, or anything reachable from it, to:

gain or attempt to gain unauthorised access to any system, account, network or data, whether ours or anyone else's — including port scanning, vulnerability scanning, credential stuffing, brute forcing, SQL injection, and exploitation of a system you do not own or have written authorisation to test;
run, host, stage, distribute or command-and-control malware, ransomware, remote access trojans, keyloggers, stealers, rootkits, botnet nodes, loaders, droppers, exploit kits, web shells, or spyware and stalkerware in any form;
run autonomous agents, crawlers or scripted software that act against third-party systems without their authorisation, including credential-testing agents, scraping that ignores access controls, and automated account creation;
host phishing pages, fake login forms, brand impersonation sites, fake shops, fake support pages, or the AI-generated clone of any organisation's site — including on a subdomain we provide, where the trust of our certificate and our domain is precisely the thing being abused;
operate fast-flux, domain-generation or reverse-proxy infrastructure that conceals the origin of any of the above, or resell Hostna capacity as bulletproof, DMCA-ignored or abuse-tolerant hosting;
mine, farm or validate any cryptocurrency or distributed-ledger token, run mining pools or proxies for them, or run any workload whose purpose is to consume CPU, GPU or memory for token rewards — on any plan, paid or free, and whether the consumption is yours or is stolen from a visitor's browser;
send unsolicited bulk email, operate mailing lists without documented opt-in, forge headers or sender addresses, relay mail for third parties, or send from our address space material advertising a site hosted elsewhere;
launch or participate in denial-of-service attacks, amplification or reflection attacks, or operate stressers and booters;
intercept, sniff or manipulate traffic that is not yours, or attempt to escape the isolation of your account, container or virtual machine;
evade a suspension, a termination or an IP block by using another account, another identity, another payment instrument or another network;
submit false identity, address, company or payment details, or use someone else's identity or payment instrument;
hold more than one Free Hosting plan per person or household, or register additional email addresses in order to obtain further free plans;
operate a proxy, VPN, Tor exit node, anonymising relay or open resolver on shared hosting, or on any plan in a way that makes attack traffic appear to originate from Hostna;
consume resources in a way that degrades the service of other customers, including runaway processes, unbounded loops, and workloads deliberately sized to exhaust a shared host.

3. Security hygiene is part of acceptable use

A neglected site is not a victimless problem. An outdated plugin becomes a web shell, the web shell becomes a phishing page, and the phishing page gets our address space blocklisted — which breaks mail delivery for every other customer on it.

You are therefore required to keep the software you install patched, to remove what you no longer use, to protect administrative access with strong and unique credentials and with two-factor authentication where the application offers it, and to act without delay when we notify you that something on your account is compromised.

Where a compromised service is actively harming third parties and you do not respond, we may disable the affected content or suspend the service to stop the harm, and will tell you what we did and why. This is containment, not a security service — see the Shared Responsibility policy.

4. Reporting and investigation

Anyone can report suspected abuse. The route, what to include, and how quickly we respond are set out in the Abuse and Notice-and-Action policy. Reports go to abuse@hostna.com.

Detection is not only reactive. We also run automated technical checks — network-flow anomalies, spam and phishing telemetry, malware signatures and hash-matching against known child sexual abuse material — alongside human review. An automated finding is reviewed by a person before any account-level measure is taken; content-level blocks of confirmed malware or CSAM may be immediate.

To investigate a report we may inspect account metadata, access logs, mail logs, process activity and, where necessary and proportionate, the files stored on the affected service. We do this only to the extent needed to establish whether this policy or the law has been breached, and we log that we did it.

During an investigation we may require identity or address verification under section 16 of the Terms of Service. Credit balances on the account are frozen while the investigation is open, and are released — or set off against damages — when it closes. Where the established conduct is criminal, we report it to the competent German authorities and, where it is criminal there too, to the competent authorities of the account holder's country of residence.

5. Enforcement

Our response is proportionate to what we find. For a first, minor and non-deliberate breach we normally ask you to fix it within a stated period. For anything serious, deliberate or ongoing, we act first and inform you afterwards. The measures available to us are, in escalating order:

removing or disabling the specific content, file or process;
suspending the affected service;
terminating every service on the account without notice, and closing the account;
refusing any further contract with the same person, household or business, and refusing orders placed from the same payment instrument, address, device or network to circumvent that refusal;
blocking the IP addresses and address ranges used, at the network edge;
preserving logs, files and account records as evidence;
reporting the matter to the competent German authorities, and where the material is child sexual abuse material, reporting it to the Bundeskriminalamt immediately and, where identifiable, to the competent authority in the account holder's country of residence;
bringing a civil claim for damages, covering investigation and remediation costs, legal costs, the loss caused by blocklisting of our address space, and reputational harm.

Fees already paid are not refunded when a service is terminated under this policy, and the remaining term stays due as damages unless you show that no loss, or a substantially smaller loss, was incurred.

An account closed under this policy is not reopened, and the decision is not reversed by paying again. Opening a further account in order to obtain a service that has been refused or withdrawn — under another name, another email address, another payment instrument, another address, or through another person or company acting for you — is itself a breach of this policy and of section 12 of the Terms of Service. Such an account is closed on discovery, without notice and without refund of anything paid into it.

To make that refusal work at all we have to be able to recognise a repeat attempt, so we keep the minimum needed to do so, for a limited time and for that purpose only. What is kept, on what legal basis, for how long, and how to object to it is in section 12 of the Privacy Policy.

6. Disputing a decision

If you believe a measure was taken in error, write to abuse@hostna.com from the email address on the account with the reference number in our notice. We review the decision, and where a suspension was wrong we lift it and credit the affected time.

There is no review process for child sexual abuse material. That decision is final and the matter is with the authorities.

7. Statement of reasons

Where we restrict content or an account under this policy, you receive a statement of reasons under Art. 17 of the Digital Services Act: what was restricted, the ground for it, the facts relied on, whether automated means were used, and how to contest it.