Acceptable use & fair use

About this policy

This Acceptable Use Policy ("AUP") sets out what you may and may not do with services provided by [Registered company name] ("VirtualCloud", "we", "us"). It is part of our Terms of service and applies to everything you host, run or send on our network, and to your end users: the visitors, staff and, if you resell our services, the customers who use what you've built.

As a hosting provider we are an intermediary under the Information Technology Act, 2000. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require us to tell you what content may not be hosted, and to act when we learn of unlawful content. This policy does that in plain language. The law always applies in full, even where this page doesn't mention a specific rule.

Content you may not host or send

You may not use our services to store, publish, transmit or link to content that:

• belongs to someone else and that you have no right to use, such as pirated software, films, music or books, cracked licences or stolen data;
• is obscene or sexually exploitative, including intimate images shared without the consent of the person shown, or invades another person's privacy;
• harms children in any way;
• harasses, threatens or defames anyone, or promotes enmity between groups on grounds of religion, caste, race, language or region, or incites violence;
• impersonates a person, company or government body, or is designed to deceive, including phishing pages, fake login pages and fake government or bank websites;
• contains malicious code, such as viruses, ransomware, spyware, exploit kits or botnet command-and-control software;
• threatens the unity, integrity, defence, security or sovereignty of India, its friendly relations with other countries, or public order;
• offers unlawful goods or services, including online money games and betting prohibited under the Promotion and Regulation of Online Gaming Act, 2025, narcotic drugs, illegal weapons, counterfeit goods, and deposit or investment schemes banned under Indian law; or
• a court or the Government has ordered to be removed.

Activities that aren't allowed

• Spam and other email that breaks the email rules below.
• Attacks on other systems: denial-of-service attacks, flooding, IP spoofing, intercepting traffic that isn't addressed to you, or scanning or probing systems you don't own.
• Unauthorised access: breaking into accounts or systems, brute-force or credential-stuffing attacks, and distributing stolen passwords or personal data.
• Open services others can abuse: public or open proxies, open mail relays, open DNS resolvers and Tor exit nodes.
• Harming the platform: anything that degrades the service for other customers, interferes with our monitoring or limits, or tries to get around them.
• Evading enforcement: opening new accounts to get around a suspension, a fair-use limit or an unpaid invoice.
• Reselling shared hosting from a web or WordPress hosting plan. Use reseller hosting, a VPS or a dedicated server to host for other people.
• Crypto mining on shared hosting or a VPS. It's allowed on dedicated servers, where the hardware is yours alone.

What's allowed on each kind of service

Some uses are fine on a server of your own but not on shared hosting, where many accounts share one machine. "Shared hosting" here means web, WordPress and reseller hosting.

Email and anti-spam rules

Email sent from our network shares IP addresses and reputation with other customers, so one careless campaign can get everyone's mail rejected. Whatever service you send from:

• send marketing email only to people who asked to receive it. Bought, rented, shared or scraped lists aren't allowed;
• include a working unsubscribe link in every marketing email, and honour unsubscribe requests promptly;
• identify yourself clearly, with accurate From and Reply-To addresses and subject lines that aren't misleading;
• publish SPF, DKIM and DMARC records for every domain you send from, which large mailbox providers now expect; and
• remove addresses that bounce, and stop mailing anyone who marks your messages as spam.

Sending limits

Mail over an hourly limit is held back and retried later rather than lost. For newsletters and other bulk campaigns, use a dedicated email marketing service; we're happy to help you add its SPF and DKIM records to your domain. If mail from your service gets one of our IP addresses blocklisted, we may pause outgoing mail on that service until the cause is fixed.

Security testing

• Your own services. You may scan and test the websites, applications and servers you run with us. On shared hosting, keep to lightweight scans of your own site; load and stress tests aren't allowed there.
• Load tests on a VPS or dedicated server. Open a ticket at least 48 hours before, with the dates, times and expected traffic, so our network team doesn't mistake your test for an attack.
• Not allowed without our written permission: testing other customers' services, our client area, control panels, billing system or network equipment; denial-of-service testing of any kind; and social engineering of our staff.
• Found a vulnerability in our platform? Please report it to security@virtualcloud.in. Our disclosure policy explains how we work with good-faith researchers.

Fair use: what "unlimited" and "unmetered" mean

Some plans have no fixed cap on one resource, so you don't have to count it. Every plan still has fixed limits on the resources that are shared on a server, and is meant for the kind of use the product is built for.

Unmetered bandwidth

On web, WordPress and reseller hosting we don't count or charge for the data your visitors download. On dedicated servers you can use the port at its full speed without counting terabytes. Either way, there is no monthly transfer bill or overage charge.

Unlimited sites

The Universe plan has no fixed cap on the number of websites in the account.

Unlimited mailboxes

Galaxy and Universe have no fixed cap on the number of email accounts.

What is always limited

NVMe storage, CPU, memory (RAM), entry processes and inodes. These are fixed for each plan and shown before you buy.

Web hosting limits by plan

Unlike the cPanel web hosting plans above, WordPress plans have their own limits, listed in the WordPress plan comparison. On reseller hosting the limits apply to each cPanel account you create, and are listed in the reseller limits table. You can see your live usage at any time in cPanel's resource usage panel.

Entry processes and inodes

• Entry processes are the number of PHP requests your account can run at the same moment. Pages served from LiteSpeed Cache don't use one, so a plan with 30 entry processes serves far more than 30 visitors at once.
• Inodes are the number of files and folders in your account, including every email, cache file and plugin file.

What happens when you reach a limit

Each account has its own ceilings, enforced by CloudLinux, so one busy site can't slow down its neighbours. Reaching a ceiling slows your account down; it doesn't take your site offline for good or cost you anything extra.

• At the CPU or memory limit, your scripts run more slowly until demand drops.
• At the entry-process limit, new PHP requests wait, and some visitors may see a "508 Resource Limit Is Reached" page until a running request finishes.
• At the inode or storage limit, no new files can be created, which can also stop new email being delivered to your mailboxes.

What counts as normal use

Shared hosting is for websites and the email that goes with them. It isn't meant for file storage or backup archives that no website uses, video or large-file downloads, public file sharing, mirrors of other sites, or serving as the origin for another service's traffic. Business email mailboxes are for the people and roles in your organisation, not for bulk sending or for storing files.

Sustained overuse

If an account keeps running at its limits or uses a shared server in a way that affects other customers, we contact you first with the usage data. We suggest fixes, such as caching, scheduling heavy tasks or removing plugins that run constantly, or a plan that fits better, such as a larger plan or a VPS. We give you a reasonable time to act, normally 7 days, before we restrict anything, unless the account is harming other customers right now. We never delete your data because of a fair-use issue.

VPS and dedicated servers

• VPS. Memory and disk are reserved for your VPS. vCPUs are scheduled on a shared host, so CPU time is shared fairly: running every vCPU at full load around the clock is a job for a dedicated server. Each plan includes a monthly data transfer allowance, from 2 TB on VC-1 to 16 TB on VC-32. If a VPS goes past it, we tell you before doing anything; you can move to a larger plan, or we may reduce its port speed until the next billing month. We don't send surprise overage bills.
• Dedicated servers. Bandwidth is unmetered at the port speed you chose, 1 Gbps or 10 Gbps. Using the port at full speed for your own workloads is fine. What we act on is traffic that harms our network or other customers, such as attacks or amplification.

If you resell our services

• You're responsible for your customers' use of our services and for their compliance with this policy. Your terms with them must be at least as strict as this AUP.
• We send abuse notices about your customers' accounts to you, and you must act on them within the time the notice gives.
• Where there's an immediate risk, such as live phishing or malware, we may restrict a customer's account directly and tell you straight after.

Reporting abuse and legal notices

To report spam, phishing, malware, copyright infringement or other abuse coming from our network, use the report abuse form or write to abuse@virtualcloud.in. Include the URLs, IP addresses, full email headers and times (with time zone) that show the problem. We review every report and prioritise phishing, malware and other urgent harm.

• Copyright. We act on written notices under section 52(1)(c) of the Copyright Act, 1957 and the Copyright Rules, 2013. Access to the material is disabled for 21 days while the complainant obtains a court order, and may be restored if no order is produced in that time.
• Court and government orders. Under rule 3(1)(d) of the IT Rules, 2021, we remove or disable access to unlawful content no later than 36 hours after receiving a court order or a notice from the appropriate government or its agency, and preserve the related records for 180 days for investigation.
• Cyber security incidents. We report the incidents the CERT-In Directions of 28 April 2022 cover to CERT-In within 6 hours of noticing them, and cooperate with lawful requests from Indian authorities.

How we enforce this policy

Most problems are accidents: an outdated plugin that was hacked, a contact form that's being abused. We'd rather help you fix them than switch anything off, so we act in steps:

1. NoticeWe email you what we found, the evidence and what needs to happen, with a deadline that reflects how serious the problem is.
2. RestrictionIf the problem continues, we limit only the part that's causing harm: for example, pausing outgoing mail, disabling one script or site, or limiting traffic.
3. SuspensionIf that isn't enough, or the deadline passes, we suspend the service. Your data is kept, and we restore the service once the problem is fixed.
4. TerminationFor serious or repeated breaches, we end the service. Services terminated for a breach aren't refundable, as our Refund policy explains.

We act straight away, and tell you immediately after, when there's child sexual abuse material, live phishing or malware, an attack coming from your service, a court or government order, or an immediate risk to our network or other customers. We terminate the accounts of repeat copyright infringers.

If you think we've made a mistake, reply to our notice and we'll review it. If you're still not satisfied, you can write to our Grievance Officer.

Changes to this policy

We may update this policy as the law, new kinds of abuse and our services change. The current version is always on this page with its "Last updated" date. If a change materially restricts how you can use a service you already have, we'll email you at least 30 days before it applies to you, unless the law requires it sooner.

Contact us

Abuse reports: abuse@virtualcloud.in or the report abuse page. Questions about fair use or your plan's limits: support@virtualcloud.in. Vulnerabilities: security@virtualcloud.in. Legal notices: legal@virtualcloud.in, or by post to [Registered company name], [Registered office address], India.