VPN Abuse Desk and Acceptable Use

An acceptable use policy is not a vibe. It is a list of things that get a warning, a pause, or a kill, plus a mailbox that accepts evidence. If that list is not on the live site when the first card clears, you do not have a policy. You have a founder opinion. Founder opinions do not survive a lawyer's PDF.

Write it in nouns. No scanning other people's networks. No outbound spam. No malware. No flooding. No attempts to break into systems the user does not own. No using the service to hide a crime and then asking support to 'make it go away.' Copyright: say you do not host files, you carry packets, and you still reserve the right to suspend when a pattern is tied to an account you can identify. If you cannot identify anyone, say that too. Silence here is how a journalist quotes you as 'the VPN that shrugs.'

Do not write a novel. Two screens on mobile is plenty. Link it from checkout, from the app about screen, and from the footer. Date it. Keep a copy of version one when you edit version two. The first dispute will ask what the page said on the day they paid.

Klox's consumer AUP lives under terms. Partner brands should not point paying users at that URL as if it were their contract. Your counsel, your entity, your page. If the hosted contract says the operator's network AUP also applies, say that in one sentence and link it. Two documents can exist. Two contradictory documents cannot.

Most consumer VPN exits are shared. Many users, one IPv4, overlapping sessions. A copyright notice that says 'this IP at 14:02 UTC downloaded a file' is describing a crowd. It is not describing a person. Operators who do not keep destination logs cannot magically produce a username from that tuple. Brands that pretend they can are lying. Brands that pretend the mail does not exist are also lying. The mail exists. Hosts care. Upstream cares. Your honest users on that city start hitting captchas because someone else was loud.

The operational job is triage, not detective fan fiction. Is the IP even yours this week? Was the timestamp in a window when the node was live? Is this the fiftieth notice on the same prefix this month? Is the reporter a known mill that sprays every VPN on earth? You can answer those without reading anyone's browsing. You often cannot answer 'which of our five-device accounts did it.' Say that in the AUP so you are not improvising a user hunt you cannot finish.

I have watched brands promise 'we cooperate fully with every DMCA notice' on a hosted stack where the operator cannot map the session. That sentence is a gift to a plaintiff and a lie to the user. Write the smaller truth: we review notices, we act when we can tie a pattern to an account or a dedicated address, we do not invent identities from shared IPs.

Outbound SMTP from a VPN exit is how you get the prefix listed. Port 25 should not be a consumer feature. If your AUP does not mention spam and phishing, add it. Scanning other people's SSH and RDP from a shared exit is how a university CERT finds you. The CERT does not care that your homepage said private. They care that 10,000 SYNs hit their /16 from your anycast.

You will not catch every scan if you are not the operator. You can still prohibit it. You can still disable an account that brags in a ticket that they are 'testing networks.' You can still ask the operator to filter or move a hot node. Those are different buttons. The AUP names the prohibition. The contract names who presses which button.

Do not write 'unlimited bandwidth, no questions asked' next to an AUP that bans scanning. Users can read. So can hosts. If you sell a lab SKU that allows scanning, that is a different product with a different contract and probably a dedicated IP. Do not mix it with a $2.83-style consumer plan. Klox consumer is not a pentest platform. Your white-label consumer SKU should not pretend to be one either.

WHOIS, RDNS, and the app name disagree. The prefix might point at a datacenter. The rDNS might mention the operator. The app icon says your brand. The angry mail goes wherever a human guessed. Often that is support@yourbrand because that is what Google showed. Sometimes it is the operator because that is who swiped the IP. Sometimes it is both, two hours apart, with two different stories.

Write the routing in the contract before launch. Operator receives host and prefix complaints. Brand receives user-facing reports and store reviews that allege abuse. Brand forwards technical IOCs to a named alias, not a founder WhatsApp. Operator tells the brand when a node will be filtered. If that paragraph does not exist, you will discover it when a host tickets a 24-hour deadline and both of you think the other one is handling it.

Publish an abuse@ on the brand domain even if you forward it. Empty mailboxes look like you are hiding. A page that says 'send IP, timestamp with timezone, and a short description' is how you stop getting novels. Shared IPs need precise time. Without it you cannot even check the prefix window.

This is the sentence founders skip. On hosted white-label, the brand often owns the customer record and the operator owns the packet path. Disable can mean: revoke the brand portal login, revoke the device list, or blackhole the user at the network. Those are not the same click. If only the operator can cut the tunnel, and only the brand can refund, you need both people in the runbook.

The admin API article is about making disable an idempotent job with an audit log. Read it when you wire the button. Here the policy question is who is allowed to want the button pressed. Brand: billing fraud, AUP admission, chargeback farms, store-policy violations you can see in the account. Operator: node-level harm, prefix-killing spam, court orders they receive as the network party. If both can disable, say who is source of truth when they disagree. I have seen a brand re-enable a user the operator just cut because 'they paid yearly.' The host then cut the whole node. Yearly revenue is not a prefix.

Name the human. A group alias with no owner is how disables happen twice or never. Log who clicked, when, which account, which evidence ID. You do not need a SOC 2 story to keep a spreadsheet. We will not invent SOC 2 for Klox in this piece. You should not invent it for a two-week-old brand either.

A ladder that exists only in a founder's head is not a ladder. Write three rungs. Warning: first or minor, email the account, point at the AUP, ask them to stop. Suspend: access off while you look, billing may still be live depending on your choice — say which. Terminate: account dead, devices dead, tell them whether the rest of the term is refunded.

Staff the ladder. Who sends the warning? Who can suspend without a founder? Who can terminate? If the answer is 'me, when I land,' you will miss the host's deadline. Macros must match the AUP nouns. Do not warn for 'suspicious activity' if the AUP never used that phrase. Suspicious is a nothing word. Scanning is a noun. Spam is a noun.

Repeat infringers: say you may skip the warning. Child-safety and malware: skip the warning. I am not going to write a fake legal treatise. I am telling you that a ladder with no skip clause is how a botnet gets a polite email while the prefix burns.

This is the paragraph that keeps you out of fan fiction. Shared IP plus timestamp is often not an identity. No-logs, if true at the node, means you will not produce a browsing diary. You can still confirm the IP was on your network. You can still say you prohibit the conduct. You can still act on other evidence: the user told you, the dedicated IP was assigned to them, fraud on the card, a pattern the operator can see at the node without reading URLs.

Do not write 'we cannot ever suspend anyone because privacy.' That is not privacy. That is refusing to run a network. Do not write 'we will always produce the user to any email that says DMCA.' That is not cooperation. That is a bluff. Proton's public legal pages are a specimen of how a large consumer VPN talks about terms. They are not your AUP. Link them if you must as a competitor example. Do not wear them.

When lawful process arrives — a real order, not a PDF from a mill — the operator and the brand need a path that matches the privacy policy. That path is a lawyer problem. The AUP's job is to tell the user that illegal use is still illegal through a tunnel. Cloudflare and Wikipedia will not save you from that sentence. Write it.

A dedicated address is an allowlist tool and a reputation object. It is not extra encryption. When abuse mail names that address, the buyer and the brand both think of a person. The operator can often say which account held the assignment at that time. That is a different evidence quality than a shared city.

Your AUP should mention dedicated IPs if you sell them. Faster disable. Possible replacement of the address if the destination already blocklisted it. No refund theater that pretends the IP was 'anonymous.' It was the opposite. The dedicated-IP SLA article is the SKU physics. Here: the abuse desk gets sharper mail and needs a sharper button.

If you reassign a dirty IP to the next customer, you donated them last month's enemies. Ask the operator how they warm and retire addresses. Confirm with sales. Do not put a cleanliness claim in the AUP you cannot check.

Klox consumer money-back is seven days for Klox consumers. Your brand may copy that number or pick another. Abuse complicates it. If you disable on day two for a botnet, do you refund? If you disable on day 200 of a yearly plan, do you pro-rate? Write the rule. Silence is how chargebacks appear with the story 'they stole my year.'

My bias: fraud and AUP kills inside the money-back window can still be a refund if you want fewer bank fights, or a denial if you want a spine. Pick one and print it. After the window, I would not refund a terminate for spam. I would refund a mistaken disable. Mistakes happen. The audit log is how you know which is which.

Do not mix 'erase my data' with 'give me money back' with 'you caught me scanning.' Those are three buttons. The privacy-policy article covers deletion versus invoices. This article covers whether a disabled abuser gets a courtesy credit. Invoices can still exist after a kill. Tax does not vanish because you are angry.

Before ads: abuse@ exists and forwards. AUP is live and linked from checkout. A one-page runbook: who acknowledges, who talks to the operator, who can disable, what the user email looks like. A test: send a fake notice to the alias and see who wakes up. If nobody wakes up, you do not have a desk. You have a string in WHOIS.

Macros: reporter received, user warned, user suspended, user terminated, operator forwarded. Each macro quotes the AUP URL. None of them claim SOC 2, military-grade review, or a 15-minute SLA you cannot staff. The 14-day launch checklist should include this as a legal-page item, not as a nice-to-have.

First real notice: file it. Even if it is junk. You want a folder that proves you had a process before the serious one. Process that starts on the day of the lawsuit looks like theater.

Consumer giants publish long terms because they have counsel on retainer and a network they actually operate. Your hosted brand is smaller. Copy-pasting Proton's legal page — or anyone's — does not make you them. It makes you a brand that claimed jurisdictions and programs you do not run. Read a competitor page as a specimen of tone. Then write shorter sentences you can enforce.

Match the AUP to the product. Five devices. WireGuard, OpenVPN, OpenConnect, and Shadowsocks. A refund window you chose. A hosted operator you named in the privacy policy. If you do not operate nodes, do not write 'our global backbone will null-route attackers in seconds.' You do not have a backbone. You have a contract.

I would rather you ship an ugly one-pager that a night-shift agent can apply than a beautiful PDF that contradicts the admin panel. Ugly and true is the whole job.