Acceptable Use Policy

We sell machines that run untrusted code, so the boundary of what is acceptable has to be explicit. This policy forms part of the Terms of Service and applies to everything you run on our infrastructure.

Last updated: 22 August 2026

The short version

Use a sandbox as a workspace for your own code, your agents' code and your users' code. Do not use it as a platform for attacking, defrauding or spamming other people, and do not use it as a cheap way to buy raw compute for something unrelated to running and testing code.

Prohibited uses

You must not use a sandbox, or the API around it, to:

• Mine cryptocurrency or run any proof-of-work, hash-rate-for-hire or similar workload whose purpose is to consume compute for token rewards. This includes browser-based miners and workloads disguised as benchmarks.
• Send spam or bulk email. Outbound SMTP is blocked at the network level on ports 25, 465 and 587, and attempting to work around that block — relays, alternative ports, third-party sending APIs used for bulk unsolicited mail — is a violation in itself.
• Attack third parties. No denial-of-service or distributed denial-of-service traffic, no traffic amplification, no brute-force attempts against remote services, no exploitation of systems you are not authorised to test.
• Scan networks you do not own. Port scanning, vulnerability scanning and mass probing of third-party hosts are prohibited, including "research" scans, unless you can show written authorisation from the owner of the target.
• Host malware or command-and-control infrastructure. No distribution of malware, ransomware, exploit kits or phishing pages; no C2 servers, no botnet controllers, no proxy or relay infrastructure used to conceal attack traffic.
• Run credential stuffing or account-takeover tooling, including checker scripts against third-party login endpoints, and the trafficking of stolen credentials, card data or personal data.
• Store or distribute illegal content, including child sexual abuse material, content that infringes someone else's intellectual property, and material prohibited by applicable sanctions or export control law. CSAM is reported to the competent authorities and results in immediate, permanent termination.
• Circumvent resource limits or quotas. Do not attempt to escape the sandbox's isolation boundary, escalate privileges, remove the resource limits applied to the sandbox user, reach the cloud metadata endpoint, access another tenant's machine or data, or create additional accounts to work around concurrency limits, timeout caps or the free credit grant.
• Resell raw compute. You may build products on top of the API, including products where your users' code runs in sandboxes. You may not repackage sandboxes as generic VPS hosting, a VPN or proxy service, a persistent hosting platform, or any offering whose substance is reselling the underlying compute.

Testing your own security tooling against your own systems is fine. Testing it against someone else's is not, regardless of your intent.

What we monitor — and what we do not

We monitor aggregate resource usage per account, sandbox lifecycle events, API error patterns and abuse reports forwarded to us by our infrastructure provider and by third parties. Those signals are how abuse is normally detected: a machine saturating a CPU for hours, a burst of outbound connection attempts, or a complaint naming one of our IP addresses.

We do not routinely inspect the contents of sandboxes. We do not read your files, and we do not scan your workspace as a matter of course. Note, however, what is stated plainly in the privacy policy: the commands you submit and the output they produce are stored in our database, and we will read those records when we are investigating a specific abuse report, a security incident, or a support request you have raised. Where we are legally compelled to preserve or disclose data, we comply.

Reporting abuse

If traffic or content originating from our infrastructure is affecting you, write to abuse@sandbox-as-a-service.com. Include the IP address, timestamps with a time zone, and log excerpts or headers where you have them — that is what lets us map traffic to an account quickly. We treat abuse reports as a priority and will confirm receipt, although we cannot promise a fixed response time.

Vulnerabilities in the service itself belong at security@sandbox-as-a-service.com instead — see the security page for how we handle those.

Consequences

Depending on severity and on whether the behaviour looks deliberate, we may:

• destroy the sandboxes involved, immediately and without notice;
• suspend the account, which stops all running sandboxes and blocks new ones;
• revoke API keys;
• terminate the account permanently, in which case any remaining prepaid credit is forfeited;
• report the matter to the relevant authorities where the conduct is criminal.

For clear-cut cases — active attacks, mining, illegal content — we act first and explain afterwards. For ambiguous cases we will normally contact you at the email address on your account and give you an opportunity to correct the problem. If you believe an enforcement action against your account was a mistake, reply to the notice or write to info@productivity-boost.com; we will look at it again.

Changes

We update this policy as new categories of abuse show up. The version in force is the one published here.