Acceptable Use Policy for Coffervale storage VPS

1. Scope

This policy applies to every Coffervale account and server, and to everyone who uses them. It forms part of the terms of service and covers every plan on the pricing page. You answer for what is stored and run on your server, including by anyone you give access to.

2. Applicable law

Coffervale is a brand of DomaineGoat LLC, a company registered in the Republic of Panama, and it answers only to Panamanian law; each datacenter that hosts a server is bound by the law of the country it stands in. A legal demand founded on the law of another country leads to no action by Coffervale.

3. What a storage VPS is for

Anything section 5 does not forbid is allowed. The uses we built the service for:

• off-site backups with Borg, restic, Kopia, rsync or similar tools, of your own machines or those you administer;
• self-hosted file services for yourself, your family or your team: Nextcloud, Seafile, Syncthing, SFTP;
• archives of photos, documents, projects and exports that you own or are entitled to keep;
• a private media library of content you own, streamed to yourself;
• development, testing and personal servers;
• Tor relays may run on a Coffervale server, exit relays included.

4. Copyright notices from abroad

We take no action on DMCA notices or any other foreign copyright notice: Panamanian law and the orders of Panamanian courts are the only ones Coffervale follows. That is not a licence, since our own rules still forbid publicly distributing content you hold no rights to. A notice sent under the DMCA or another foreign copyright law leads to no takedown and no suspension.

That procedure point changes nothing in section 5: storage is not a distribution platform, and publicly distributing content you hold no rights to is forbidden on every server, whoever notices it.

5. Forbidden uses

Forbidden on every server: spam or bulk mail, phishing, malware or botnet command, DDoS and other attacks, scanning or brute-forcing systems you do not own, booter or stresser services, carding and fraud, child sexual abuse material, cryptocurrency mining of any kind including proof-of-space or proof-of-capacity farming such as Chia, public seedboxes, publicly distributing films, series, music, games, books or software you hold no rights to, and any service to sanctioned people or companies.

What these rules mean in practice:

• Distribution: a server must not serve films, series, music, games, books or software to the public without the rights to do so, through a website, a file host, a tracker or any other means. Keeping your own copies for yourself is storage; handing them out to all comers is distribution.
• Seedboxes: a public seedbox, or any service that swaps files with strangers at scale, is forbidden. The traffic allowance and the shared disk arrays are sized for backups and sync.
• Mining: no mining of any coin with any software, and no proof-of-space or proof-of-capacity farming (Chia and similar), which fills shared disks for profit. A full node that only validates a blockchain is not mining and is allowed.
• Scanning: testing your own systems is allowed; scanning other people's is not.
• Mail: outgoing port 25 stays closed (section 6), and bulk mail is forbidden on every port and through every provider.
• Sanctions: Residents and companies of Cuba, Iran, North Korea, Syria, Russia, Belarus, China, Yemen and Western Sahara, and of the occupied regions of Ukraine, cannot order. Each incoming payment is screened against public sanctions lists of blockchain addresses, and money from a listed address is never credited.

6. Port 25 and email

Outgoing port 25 is shut on every server to keep spam out, permanently; mail providers stay reachable on ports 465 and 587. A mail server on Coffervale relays its messages through a mail provider on one of those ports.

7. Traffic quotas and shared disks

Each server has one IPv4 address and an IPv6 /64 on a 1 Gbit/s port, with a monthly traffic quota of 2 TB plus 2 TB per TB stored: 3 TB for Silt, 4 TB for Clay, 6 TB for Shale, 10 TB for Granite, 18 TB for Bedrock. Past the quota the port runs at 100 Mbit/s until the next period begins; nothing extra is billed. Disks are shared arrays: a workload that keeps them saturated around the clock, such as a public file mirror, slows other customers down. Support writes to you before acting, and suggests a better fit when there is one.

8. How complaints are handled

Copyright notices from abroad, DMCA included, lead to no action; Panamanian law and Panamanian court orders decide. Spam, phishing, malware, botnet command, attacks and child sexual abuse material are banned and end in suspension.

Reports about a Coffervale IP address go to [email protected]. A report is easier to act on with:

• the IP address of the server;
• when it happened, date and time, ideally in UTC;
• the type of abuse: spam, phishing, malware, botnet command, an attack, a scan or illegal content;
• proof: log excerpts, full mail headers or the URL concerned.

Foreign copyright notices sent to that address, under the DMCA or any other law, get no action.

9. Suspension

A breach of section 5 leads to suspension. A suspended server shows as such in the dashboard; write to support to learn why. A server suspended for a breach earns no credit for its remaining days, because the refund policy covers only the cases it lists.

A server stopped because its term was not renewed is a different case, covered by the terms of service: its disk is held for 7 days, then wiped.

10. Contesting a suspension

Write to [email protected]. A person answers support emails within 12 hours, seven days a week, including help with SSH keys, reinstalls and firewall rules.

• Give the order reference (ORD-…) and the server's IP address.
• Never send your account number. Nobody from our team will ever ask for your account number, your root password or your private SSH key, by email or in a chat.
• Explain what happened and what you changed, for example the compromised service you removed or the open share you closed.

11. Legal orders

Only a Panamanian court order can release records, and the privacy policy lists the only records that exist. We keep no logs: no record of connections or traffic and no IP address of a visitor or customer, whether on this website, in the dashboard or on the host machines.

12. Changes

We may update this policy; the date at the top shows the version in force, and it applies from that date to every server.