Trust and Safety Policy

1 Prohibited activity

Do not use ITSA services to commit fraud or other unlawful activity; distribute malware or stolen credentials; conduct phishing, ransomware or unauthorised access; send unlawful unsolicited messages; infringe intellectual property or privacy; publish child sexual abuse material; facilitate trafficking, terrorism or unlawful violence; threaten or unlawfully harass people; or interfere with networks and other customers. Do not conceal the source of attacks, defeat access controls or knowingly enable another person to do these things.

Security research, scanning and penetration testing require the permissions and scope described in the Service Specific Terms. Lawful investigation and criticism are not automatically abuse. A report or allegation alone does not establish a violation. ITSA must consider the content, conduct, applicable law and the role of the affected service.

2 Different services give different control

For material hosted on infrastructure ITSA controls, ITSA may be able to restrict access or remove material. For a self-managed server, the customer controls the operating system and content; ITSA may coordinate customer remediation or isolate infrastructure where justified. For domain registration, DNS, caching or a resold security product, ITSA may not host the underlying content and may need to refer a matter to the host, registrar or provider with effective control.

ITSA must not describe itself as unable to act merely because a customer administers a server. It must assess the powers it actually has under the contract, law and supplier arrangements. Its response must remain proportionate to the risk and technical control available. A public complaint is not authority to disclose private customer or registrant information.

3 How to report abuse

Send reports of cyber abuse or a vulnerability to [email protected], with the subject Abuse report or Security vulnerability. Domain or hosting operational reports may also be sent to [email protected]. For general legal notices use [email protected]. These are existing ITSA contact routes, not a promise of a separately staffed emergency hotline. For immediate danger contact the appropriate emergency or law-enforcement service directly.

Include the exact URL, domain, IP address or service identifier; a concise description; dates and times with time zone; relevant headers, non-sensitive logs or screenshots; the rule or right affected; and a contact method if you want a response. An intellectual-property complaint should identify the protected work, rights holder and authority to act. Reports should be accurate and made on a reasonable basis.

Do not send live malware, stolen datasets, passwords, graphic illegal material or child sexual abuse images by ordinary email. Provide a location and description and request a secure evidence route if needed. Do not unlawfully access a system to obtain evidence. ITSA may ask for clarification while preserving urgent action where necessary.

4 Assessment and triage

The Technical Lead must assess whether the service is associated with ITSA, what conduct is alleged, whether immediate harm is likely, what evidence is available and who can act. Priority is given to credible threats to life, child safety, active compromise, destructive attacks and binding legal directions. ITSA's handling target is acknowledgement within two business days where a return address is supplied; this is not an emergency response SLA or a guarantee of resolution in that period.

Reports are restricted to people who need them. ITSA may share the minimum necessary information with the customer, host, registrar, upstream provider or lawful authority to investigate and respond. Where lawful and practicable, avoid disclosing a reporter's identity if doing so would create a safety or retaliation risk. Confidentiality cannot be guaranteed against a lawful disclosure requirement.

5 Notice action and restoration

Possible responses include requesting information, warning the customer, requiring remediation, limiting a feature, removing specific hosted material, isolating a compromised server, suspending an affected service or terminating serious or repeated abuse. ITSA should use the least disruptive effective measure reasonably available and preserve unrelated lawful services where feasible.

Unless urgent harm or a legal restriction prevents it, ITSA must notify the customer of the concern, identify the relevant rule, allow a reasonable response and state remediation or restoration conditions. Immediate action may be needed for active compromise, serious danger or binding legal obligations. ITSA must record the reason, authorisation, scope and review date and notify the customer afterwards where lawful. Restoration requires verification that the material risk or violation has been addressed; it must not depend on agreeing to unrelated new commercial terms.

6 Review and complaints

A customer or reporter may request review at [email protected] with the subject Trust and safety review and the case reference. A request within fourteen calendar days normally helps preserve evidence, but a later request may still be considered. A person not responsible for the original decision, where practicable, must reassess the evidence and proportionality. Our target is a substantive response within ten business days or an explanation of delay.

Internal review does not remove court, regulator, registry or publisher remedies, stop a legal deadline or create a right to restore unlawful material. ITSA must correct a materially mistaken action and communicate the outcome as far as confidentiality and safety allow. Repeated abusive reporting may be restricted, but good-faith disagreement must not be punished.

7 Government requests and preservation

ITSA must verify the identity, authority, jurisdiction and scope of a government or legal request, seek clarification where needed and disclose only information it is lawfully required or permitted to disclose. Where appropriate it may seek legal advice or challenge an overbroad demand. Customer notice should be given where lawful and practicable, except where it would compromise a lawful investigation or a serious safety interest.

Preserve relevant evidence securely where legally required or reasonably necessary, with access and retention proportionate to the case. A preservation request is distinct from authority to disclose. ITSA must not promise routine monitoring of all customer content or access to encryption keys it does not hold.

8 Responsible security disclosure and accountability

Report vulnerabilities privately with reproducible details and minimal proof. Stop testing if you encounter unrelated personal information, and do not change or destroy data, disrupt services or demand payment for silence. A report does not itself authorise testing, grant immunity or create a bug-bounty payment obligation. ITSA must handle responsible good-faith reports fairly and coordinate remediation and disclosure appropriately.

The Managing Member oversees this policy, unresolved complaints and material suspensions. The Technical Lead maintains case records, escalation arrangements and operational guidance. Material incidents and patterns must inform improvements to security and service design. Privacy, whistleblowing and employment concerns may be routed under their separate policies where those offer a more appropriate process.