Protect the customer without exporting harm to the network.

This is a pre-launch working draft for services that may be coordinated by RENANT LIMITED under the Renant name. It is intended to apply to customers, account users, downstream resellers, affiliates where relevant, suppliers using a portal, and anyone using assigned infrastructure or Internet-number resources.

The final Acceptable Use Policy should form part of an accepted service agreement and may include provider- or country-specific rules. If an upstream provider imposes a stricter lawful restriction on a selected service, that restriction should be disclosed before order where practical and may also apply.

Do not use a Renant-coordinated service to break the law, deceive or harm another person, interfere with a network or system, evade a legitimate restriction, or create unreasonable risk for other customers, providers, address holders, or the public Internet.

A customer remains responsible for its users, software, credentials, content, traffic, and downstream customers. Lack of awareness does not remove the obligation to investigate warning signs and secure a compromised service.

The following would be prohibited unless an activity is expressly authorized in writing by the system owner and permitted by the selected provider:

• Deploying or controlling malware, ransomware, spyware, botnets, cryptominers installed without consent, exploit kits, credential stealers, or command-and-control infrastructure.
• Attempting unauthorized access, privilege escalation, password attacks, credential stuffing, token theft, interception, or security-control bypass.
• Scanning, probing, exploiting, load testing, or denial-of-service testing systems without documented authorization and a scope designed to protect uninvolved networks.
• Launching, amplifying, relaying, coordinating, selling, or threatening denial-of-service attacks.
• Hosting phishing, impersonation, malicious redirects, deceptive downloads, or infrastructure intended to obtain secrets or funds dishonestly.
• Concealing or materially misrepresenting the origin, controller, purpose, or target of abusive activity.

Good-faith security research is not automatically authorized by this policy. Obtain permission from the system owner and confirm the infrastructure provider's rules before testing.

• Do not send unsolicited bulk messages, operate spam infrastructure, harvest contact details, or use purchased or unlawfully obtained recipient lists.
• Do not forge message headers, identities, consent records, unsubscribe results, or domain authentication.
• Automated requests, scraping, crawling, and bots must respect applicable law, authorization, technical limits, and the rights of the target service.
• Open relays, open proxies, recursive resolvers, and similar services must not be left in a configuration that enables third-party abuse.

Legitimate transactional email, customer-authorized campaigns, monitoring, and automation may still be subject to rate limits, consent rules, provider policies, and evidence requirements.

A service must not be used to create, store, publish, advertise, sell, distribute, or facilitate material or conduct that is unlawful in an applicable jurisdiction. This includes content that infringes intellectual-property or privacy rights, enables fraud, facilitates exploitation, or is subject to a binding removal order.

RENANT LIMITED should not decide complex ownership or speech disputes solely from an unsupported allegation. A complete report, counter-notice or response where appropriate, and the obligations of the selected provider and applicable law should inform action.

• Do not spoof source addresses, announce a prefix or ASN without authority, leak routes, hijack routes, or publish a false route object or ROA.
• Do not create, alter, extend, or reuse a letter of authorization without the authority of the relevant resource holder and all required parties.
• Do not evade blocks or reputation controls by rapidly rotating addresses, domains, accounts, providers, or identities.
• Do not interfere with another tenant, bypass isolation, exhaust shared control-plane resources, or attack provider management systems.
• Reverse DNS, geolocation, registry, route, and abuse-contact data supplied to Renant must be accurate and kept current.

IPv4 users must also follow the draft IPv4 Leasing Policy.

A customer must remain within the resource, transfer, port, API, storage, and usage limits in its accepted order. “Unmetered” or a stated port speed should not be interpreted as permission to impair a shared network or as a guarantee of sustained throughput unless the order expressly says so.

Activities such as public proxies, VPN services, remote desktops, game servers, mass messaging, automated browsers, financial or crypto workloads, security testing, scraping, and regulated content may be legitimate but carry different provider, licensing, compliance, and abuse risks. They may require a compatible upstream provider, additional verification, or written approval; the website should not imply universal support.

A reseller must:

• Identify and authorize each customer before provisioning and maintain accurate account and abuse contacts.
• Give customers terms at least as protective as the applicable Renant and upstream rules.
• Keep tenants separated and disclose only the data needed to operate each account.
• Respond promptly to security and abuse inquiries and preserve relevant evidence lawfully.
• Not advertise ownership, certifications, capacity, locations, SLAs, or provider affiliations it cannot substantiate.

The reseller is responsible for activity it authorizes and for reasonable steps to stop repeated abuse by its customers.

Use the pre-launch infrastructure abuse intake. It records a notice for manual review but is not yet a staffed abuse desk or emergency channel. A useful report includes the affected IP address or service, precise timestamps with timezone, relevant headers or logs, the observed behavior, the reporter's relationship to the affected system, and a safe reply route.

Do not include passwords, private keys, full payment-card data, unnecessary identity documents, or unrelated personal information. Reports should be made honestly; knowingly fabricated or manipulated evidence is prohibited.

The intended response process is:

1. Record and deduplicate the report.
2. Assess source, timestamps, scope, severity, recurrence, and available provider evidence.
3. Notify the responsible account and request containment or explanation where safe and practical.
4. Apply the least disruptive measure reasonably capable of reducing the risk.
5. Escalate, restrict, suspend, preserve evidence, or terminate when urgency, repeated breach, law, or provider action requires it.
6. Record the decision and provide a review route where appropriate.

Immediate action may be necessary for active compromise, serious harm, route hijack, large-scale attack, a binding legal demand, or a provider emergency. Automated reputation signals should inform investigation but should not be the sole basis for irreversible action without an appropriate review.

Reasonable remediation may include isolating a system, rotating credentials, removing malicious material, patching software, restricting ports, correcting routes or DNS, changing an IP assignment, providing consent evidence, or completing a security plan.

Repeated or evasive violations, failure to contain a compromised system, retaliation against reporters, or movement of the same abuse between services may justify stronger action. Restoration remains dependent on safety, provider approval, outstanding charges, and the final service terms.

Investigation data should be limited to what is relevant, protected by role, retained for a justified period, and handled under the adopted Privacy Notice. Traffic content should not be inspected by default; any inspection must have authority, necessity, proportionality, and an appropriate notice or exception.

An effective policy should carry a publication date, change history, and any provider-specific schedules. Active customers should receive the notice required by their contract and applicable law before a material non-emergency change applies.

RENANT LIMITED
3906, 39/F, THE CENTER, 99
QUEEN'S ROAD, CENTRAL
HONG KONG