Acceptable Use Policy

Version 1.0 · Last updated: 1 October 2026

This policy applies to everyone who uses Brova Cloud: our clients and anyone using
their sites or applications. It is part of our Terms of Service.

1. Not allowed

You may not use Brova Cloud to:

1. Break the law. Host, distribute or promote content or activities that are
   illegal under the law applicable to you or to us, including content that
   infringes copyright, trademarks or other rights.
2. Harm children. Any child sexual abuse material. We report it to the
   authorities.
3. Spread malware. Host or distribute viruses, ransomware, trojans, exploit
   kits or other malicious code, except inert samples in a controlled research
   setting agreed with us in advance.
4. Phish or steal credentials. Imitate another organisation's login, payment or
   support pages, or collect passwords, card data or identity data by deception.
5. Spam. Send unsolicited bulk email or messages, or host sites advertised that
   way. Email you send must have a lawful basis and a working unsubscribe where
   required.
6. Attack others. Carry out or support denial-of-service attacks, run botnets or
   command-and-control servers, break into systems, or scan third-party networks
   for vulnerabilities without the owner's permission.
7. Abuse our resources. Mine cryptocurrency, run public proxies, VPN exit nodes or
   file-sharing trackers, or use resources in a way that significantly degrades the
   service for others.
8. Get around our controls. Bypass resource limits, access other clients' data or
   systems, or interfere with our monitoring and security measures.
9. Hide your identity to cause harm. Give false information to open or keep a
   service, or use it to harass, threaten or incite violence against people.

2. Security testing is allowed, within limits

You may test the security of your own sites and applications on Brova Cloud,
for example with vulnerability scanners or penetration tests, if:

• you tell us beforehand at underattack@brova.cloud (what, from where, when);
• the tests target only your own services, not our servers, network or other
  clients;
• they don't include denial-of-service or load tests beyond your plan's limits
  unless we agree in advance.

Testing our infrastructure, or anything that isn't yours, is not allowed without our
written permission. If you find a vulnerability in our systems, please report it to
underattack@brova.cloud; we won't take action against good-faith reports.

3. What we do about breaches

• Investigation. When we learn of a possible breach, we look into it. We may ask
  you for information.
• Proportionate steps. Depending on the case: asking you to fix it within a
  deadline; removing or blocking specific content; suspending a site, a mailbox or
  an account; and, for serious or repeated breaches, terminating the contract (see
  the Terms). We act immediately without notice where there is an acute risk to
  people, our systems or third parties, and inform you straight after.
• Human decision. A person makes every decision to restrict content or a
  service. We don't use automated tools to decide about content.
• Reasons. When we restrict content or a service, we tell you what we did, why,
  on what basis (law or this policy), and how to contest it, as required by Art. 17
  of the Digital Services Act. Reply to that notice if you disagree; we review it
  again.
• Authorities. We cooperate with authorities where the law requires it. If we
  become aware of information suggesting a criminal offence that threatens a
  person's life or safety, we inform the competent authorities (Art. 18 DSA).
• Costs. Reasonable costs of dealing with a breach you are responsible for may be
  charged to you.

4. Reporting illegal content or abuse

Anyone can report content or activity on a Brova Cloud service that they believe is
illegal or breaches this policy:

contact@brova.cloud (subject: "Abuse report")

To help us act, include:

1. the exact location (full URL, IP address or email headers);
2. an explanation of why you believe it is illegal or breaches this policy;
3. your name and email address (not required for reports of child sexual abuse
   material);
4. a statement that you believe in good faith that the information in your report is
   accurate and complete.

We confirm receipt, handle reports promptly and without bias, and tell you what we
decided. If the content is on a client's site, we may forward your report to the
client, without your contact details unless you agree or the law requires.

Security incidents affecting a Brova Cloud client (a hacked site, an attack in
progress) go to /under-attack or underattack@brova.cloud.

5. Contact points

For authorities and users (Articles 11 and 12 of the Digital Services Act):
contact@brova.cloud. Languages: English, German, Spanish.