Acceptable Use Policy

Last updated 4 November 2026

This policy is part of the Tonbo Terms of Service. It covers every Tonbo product: Streams, Databases, Pi Durable, Yield, Machines and Volumes, the Management API, the CLI, and anything else we provide under the Terms. If this policy and the Terms conflict, the Terms control.

The rule behind every list below: don’t use Tonbo in a way that hurts Tonbo, our other customers, or anyone on the internet. The lists are examples, not a complete catalogue.

1. Your account covers your users and your agents

Whatever happens through your account, your organizations or your API keys is your responsibility. That includes code you deploy, code your own customers run through a product you built on Tonbo, and anything an AI agent, script or tool does with credentials you gave it. We treat an agent’s actions as yours.

If your product lets other people or agents run code on Tonbo, put your own abuse safeguards in place. When something goes wrong, the safeguards you had are part of how we decide what to do.

2. Prohibited uses

Illegal and harmful content. Don’t use Tonbo to store, send or serve:

  • child sexual abuse material, or any content that sexualizes or exploits minors (we report it to the authorities as the law requires);
  • intimate images of a person shared without their consent, real or synthetic;
  • threats of violence, incitement to violence or terrorism, or content used to harass, dox or stalk someone;
  • material that infringes copyright, trademark or other rights, including pirated software and media;
  • anything else that is illegal where you or we operate.

Fraud and deception. No phishing pages or credential harvesting, scams, payment or card fraud, card testing, storage of stolen card data, or impersonation of a person or organization.

Attacks on other systems. You may not:

  • distribute malware, or run botnets or command-and-control servers;
  • get into accounts, systems or data without permission, including another Tonbo customer’s;
  • scan, probe or test the security of systems that aren’t yours and that you haven’t been authorized to test;
  • run denial-of-service attacks or traffic floods against anything, including as a “test”;
  • falsify the source of packets, email or other traffic;
  • run credential-stuffing or password-cracking attacks against systems you don’t own.

Security research. Authorized security work is welcome on Tonbo. You may test systems you own or have written permission to test. Write to contact@tonbo.io before you run broad or internet-wide scans, or red-team, phishing or malware simulations, and wait for our reply.

Network services that attract abuse. Don’t run anything that lets strangers route traffic through Tonbo: open proxies, open DNS resolvers or mail relays, Tor relays or exit nodes, or VPN and anonymizing services for other people. Don’t install residential-proxy or bandwidth-sharing software, and don’t sell or share your network access.

Spam and manipulation. No unsolicited bulk messages on any channel. No ad, click or engagement fraud, fake reviews, stars or followers, and no mass sign-ups on other services. Don’t offer CAPTCHA solving, and don’t use Tonbo to evade another service’s login walls, rate limits or anti-bot measures.

Misuse of Tonbo. You may not:

  • use Tonbo resources to earn cryptocurrency or tokens: no mining of any kind, no staking or validating, and no nodes or workers that are paid in tokens for compute, storage or bandwidth. Writing and testing blockchain software, using a devnet or testnet, and calling blockchain APIs are allowed;
  • work around quotas, rate limits, isolation, network restrictions, verification or billing;
  • open, buy or share accounts to collect more free allowance or capacity, or to come back after a suspension;
  • resell raw Tonbo capacity as a substitute for Tonbo itself (a product built on Tonbo that your users use is fine);
  • interfere with Tonbo’s systems or other customers, or put an unreasonable load on them;
  • test Tonbo’s own security beyond what it takes to find a vulnerability and report it to contact@tonbo.io (section 5). Never read or change another customer’s data, or disrupt the Service, while you do.

Sanctions. Don’t use Tonbo in breach of sanctions or export-control law, or give sanctioned people or entities access to it.

3. Machines

A Machine runs code you choose and can reach the internet, so these points matter most there.

  • How traffic reaches a Machine. A Machine has no public IP address of its own. Inbound traffic arrives only through Tonbo’s edge, over HTTPS or SSH at the Machine’s tonbo.sh names. A port you make public can be opened by anyone on the internet, and a request to it wakes a sleeping Machine. Don’t serve phishing pages, malware downloads or anything else this policy prohibits on a public port.
  • Shared outbound address. A Machine’s outbound IPv4 traffic leaves from one address shared by every Machine in its region. If one Machine gets that address blocklisted, every Machine in the region suffers, so we treat outbound abuse as urgent.
  • No outbound email ports. Outbound connections to ports 25, 465 and 587 are blocked on every Machine. Send email through a provider’s HTTPS API, and don’t try to route around the block.
  • Mining. The cryptocurrency and token ban in section 2 applies to every Machine, whether it runs on the free allowance or on credit you bought.
  • Agents. An agent you run in a Machine is held to this policy as you are. For example, it may not scrape a site against that site’s terms or defeat its anti-bot measures.
  • Sleep doesn’t reset anything. A stop, block or restriction we place on a Machine or an account stays in effect while the Machine sleeps and applies again when it wakes.
  • Traffic caps count outbound data only. Where an account’s traffic is capped, only what its Machines send out counts toward the cap. Data they receive does not. The caps themselves are on the Machines limits page.

4. Enforcement

We investigate abuse reports and other signs of abuse. When we find a problem we use the smallest step that stops it. We may:

  • cut off a Machine’s or an account’s outbound internet access;
  • stop a Machine, or refuse to wake it;
  • remove content or disable access to it;
  • limit what new resources an account can create, or suspend the account;
  • terminate the account, for serious or repeated violations.

Notice. When a problem is harming others or Tonbo right now, for example an attack, spam, phishing, malware or mining, we act first and tell you afterwards. In other cases we email you first and give you a chance to fix it. Either way, we tell you what we did and why.

Appeals. If you believe we made a mistake, answer the notice or write to contact@tonbo.io. Give your account ID and explain what happened or what you have changed. Every appeal is read by a person. If we were wrong, we restore access. If you have fixed the cause, we will consider reinstating you.

Credit and charges. If we suspend or terminate an account for a violation, we refund the credit it bought and has not used, minus the costs the abuse caused, such as usage not yet billed and the cost of dealing with it. The free monthly allowance has no cash value and is never refunded.

We may also report illegal activity to law enforcement, and share information with it where the law allows or requires.

5. Reporting abuse

If you see abuse that originates from Tonbo, email contact@tonbo.io. Please include the source IP address or hostname, the time in UTC, the destination, and any logs you have. Machines in a region share one outbound address, so a precise time is what lets us find the Machine responsible.

Send copyright notices and security vulnerabilities in Tonbo to the same address, contact@tonbo.io.

6. Changes

We may update this policy. If a change materially restricts what you can do, we will give you notice before it takes effect, as the Terms describe.