Acceptable Use Policy

Last updated: June 12, 2026

This Acceptable Use Policy ("AUP") sets the rules for what you may and may not do with DeployMill, the apps you deploy, the traffic they generate, and the way you (and your connected AI agent) use the platform itself. It is part of the Terms of Service. Violating it is a violation of your agreement with us.

We'll be candid about why this document is strict. DeployMill runs arbitrary customer containers on shared, self-operated infrastructure, and it hands an autonomous AI agent the ability to deploy to production. That combination is the product, and it's also exactly the combination an abuser would want. So the lines below are firm, and we enforce them.

Scope

This AUP applies to:

• Everything you deploy or store through the Service: apps, containers,

  databases, object storage, environment variables, and content served under deploymill.app subdomains or your custom domains.

• Everything done with your account credentials or your agent's OAuth tokens,

  by you, your team members, or any AI agent you've connected.

• Traffic into and out of your deployed apps.

It applies on every plan, free or paid.

Prohibited content

You may not deploy, store, serve, or transmit content that is:

• Illegal under applicable law, including content that violates

  export-control or sanctions rules, gambling regulations where unlicensed, or controlled-substance laws.

• Child sexual abuse material (CSAM), zero tolerance, no exceptions.

  Any account hosting, linking to, or distributing CSAM is terminated immediately and permanently, the content is preserved as required by law, and we report to the National Center for Missing & Exploited Children (NCMEC) and/or relevant law enforcement. There are no warnings for this category.

• Infringing, content that violates someone else's copyright, trademark,

  trade secret, or other intellectual-property rights, including warez, unlicensed media distribution, and pirated software.

• Malicious, malware, ransomware, spyware, browser exploits,

  drive-by-download payloads, command-and-control endpoints, or kits for building any of these.

• Deceptive, phishing pages, credential-harvesting forms, fake login

  portals, tech-support scams, brand-impersonation sites, or infrastructure for fraud (e.g. fake storefronts, money-mule recruitment).

• Violent or abusive, content that incites or threatens violence against

  people or groups, promotes terrorism, or constitutes targeted harassment, stalking, or doxxing.

• Non-consensual intimate imagery, or sexual content involving minors in

  any form (see CSAM above).

You are the operator of record for your apps. "My app's users uploaded it" is a reason to build moderation into your app, not a defense for serving it.

Prohibited activities and platform abuse

You may not use DeployMill's compute, network, or storage to:

• Mine cryptocurrency or run proof-of-work/proof-of-space workloads of any

  kind, on any plan, even "just a little."

• Run bulk compute unrelated to a web app. DeployMill is for shipping and

  operating web applications. Using deploy compute as a general batch farm (render farms, password cracking, model training, distributed computing clients, scraping fleets) is resource abuse, whether or not it's wrapped in an HTTP server to look like an app.

• Launch or facilitate attacks: denial-of-service (DoS/DDoS) attacks,

  botnet command-and-control, traffic amplification or reflection, or stress testing / "booter" services aimed at anyone, including yourself, without our prior written approval.

• Scan, probe, or attack third parties: port scanning, vulnerability

  scanning, brute-forcing, or exploiting systems you don't own or have written authorization to test. Outbound attack traffic from your container is your attack under this AUP.

• Send unsolicited bulk email or messages from deployed apps (spam, cold

  email blasts, SMS bombing, or operating an open relay or open proxy). Transactional and properly consented email from your app is fine. Bulk unsolicited anything is not.

• Evade quotas, billing, or rate limits, including creating multiple

  accounts or organizations to stack free-tier resources, manipulating usage measurement, or laundering one workload across many apps to dodge limits.

• Resell raw platform capacity as your own hosting product without an

  agreement with us. (Building a product on top of DeployMill that deploys apps for your own customers is something we're open to. Talk to us first.)

Security and platform integrity

DeployMill enforces hard per-organization tenant isolation. You must not test it from the inside without permission:

• No container or tenant escape attempts. Don't try to break out of your

  container, escalate privileges on the node, access the Kubernetes control plane, or reach infrastructure components (ingress internals, the secrets vault, other tenants' volumes or network namespaces).

• No probing other tenants. Don't scan, enumerate, fingerprint, or attempt

  to access other customers' apps, databases, buckets, or previews, even "just to see if you can."

• No attacking DeployMill itself (the control plane, the dashboard, the

  MCP endpoint, the build system, or deploymill.com/deploymill.app infrastructure).

• No interfering with the service for other tenants, e.g. deliberately

  exhausting shared resources, abusing the build pipeline, or filling shared queues.

• No reverse-engineering the platform or circumventing its technical

  controls, except to the extent a law expressly gives you that right despite this term.

Security researchers: we genuinely want to hear from you, through the front door. If you've found a vulnerability in DeployMill, follow the Vulnerability Disclosure Policy, which describes what testing is authorized and how to report safely. Good-faith research under that policy is not an AUP violation. Freelance exploitation of production tenants is.

AI-agent responsibilities

DeployMill is built to let an AI agent operate your account. That changes nothing about accountability:

• **The human account owner is accountable for everything their connected

  agent does.** "The agent did it" is not a defense. If your agent deploys prohibited content, attacks a third party, or abuses resources, that is your violation of this AUP, enforced against your account.

• Don't wire an agent to violate this policy. Prompting, instructing, or

  configuring an agent to deploy prohibited content or perform prohibited activities is itself a violation, including building automated pipelines that deploy content nobody reviews for legality.

• Supervise autonomy proportionally. The more autonomy you give an agent

  over production, the more you should use the platform's guardrails (previews, dry-run plans, the audit trail) and actually review what shipped. We attribute every action in the audit trail. We will use it when investigating abuse.

• Don't use the agent surface to attack the platform, e.g. crafting tool

  inputs to bypass tenancy checks or quotas. That's covered by the security section above, and the audit trail makes it very easy to attribute.

Prohibited categories at a glance

When a category isn't listed and you're unsure, ask first: [email protected].

Enforcement

We enforce this AUP proportionally, but we do enforce it:

1. Notice and cure. For most first-time, lower-severity issues (e.g. a

   resource-abuse pattern, an infringing page) we'll notify the account owner, describe the violation, and give a deadline to fix it.

2. Takedown of the offending app. We may stop a specific app or preview,

   detach its domains, or block specific traffic while leaving the rest of your account running.

3. Suspension. Repeated or unresolved violations lead to suspension of

   the organization (running apps stopped, deploys blocked) until resolved.

4. Termination. Serious or repeat violations end the account. The effect

   on your apps and data is described in the Terms of Service and the Data Retention & Deletion policy.

We skip straight to immediate action (without prior notice) for severe violations: CSAM, active attacks in progress (DoS, live phishing campaigns, malware distribution), imminent harm to people, threats to platform or tenant security, or where a court order or legal demand requires it. In those cases we act first and notify you afterward where the law allows. We may also preserve and disclose content and account records to law enforcement when legally required, and we report CSAM as described above.

We may suspend first and investigate in parallel when an app is actively harming third parties. Stopping the harm takes priority over process.

If you believe we made an enforcement mistake, reply to the enforcement notice or write to [email protected]. A human will review it.

Reporting abuse

If you see a DeployMill–hosted app (anything under deploymill.app, or a custom domain you believe we host) violating this policy, report it to [email protected]. Please include:

• The full URL(s) of the offending content or app.
• What you observed and why you believe it violates this policy.
• Timestamps and, where relevant, evidence (screenshots, email headers for

  spam reports, packet captures or logs for attack reports).

• Your contact information if you're willing to answer follow-up questions

  (anonymous reports are accepted).

For suspected CSAM, report it to [email protected] immediately and do not download, store, or redistribute the material yourself.

Security vulnerabilities in DeployMill itself go to the Vulnerability Disclosure Policy, not the abuse address. General questions go to [email protected].

Changes to this policy

We may update this AUP as the platform and the abuse landscape evolve. Material changes are announced per the Terms of Service. The "Last updated" date above always reflects the current version. Continued use after a change takes effect constitutes acceptance.