Acceptable Use Policy

Version: 1.0 · Effective date: 1-11-2026 · Last updated: 1-11-2026

A. Purpose and scope

This Acceptable Use Policy (“Policy”) sets out how the services of GRN.CLOUD B.V. (“GRN.CLOUD”, “we”, “us”) may and may not be used. It protects our customers, the people who rely on their services, the wider internet and our platform.

This Policy applies to all GRN.CLOUD services, including:

Public Cloud, Virtual Private Cloud and Dedicated Private Cloud;
virtual machines, containers, and managed Kubernetes, OpenShift and OKD clusters;
networking functions such as private networks, firewall policies, load balancers, VPN and public IP addresses;
block, file and object storage, backups and snapshots;
GPU and AI services, including model-serving endpoints;
managed databases and other managed services;
applications deployed from the GRN.CLOUD marketplace;
the console, APIs, command-line access and support channels.

This Policy applies to:

every customer that has an agreement with GRN.CLOUD (“Customer”);
every person or system that uses the services through a Customer’s account, including employees, contractors, and sub-users or tenants created by the Customer (“Users”);
resellers, managed service providers and other partners that provide services to their own clients on GRN.CLOUD (“Partners”), and those clients.

The Customer is responsible to GRN.CLOUD for compliance with this Policy by everyone who uses the services through its account.

B. Permitted use

You may use the services for any lawful and legitimate purpose that is consistent with your agreement with us, this Policy, and the technical limits of the service you have ordered. Examples include running production applications, development and test environments, data processing, AI training and inference, backup, and hosting services for your own clients.

Some activities are allowed only with our prior written consent or under specific conditions. These are described in section C.

C. Prohibited activities

You must not use the services, or allow them to be used, for any of the activities below. This applies whether the activity is carried out directly, through automation, or by a compromised system that you are responsible for.

C.1 Illegal and fraudulent activity

Any activity that is unlawful under the law that applies to you, to GRN.CLOUD, or to the services. This includes Dutch and EU law.
Fraud, scams, money laundering, the financing of terrorism, and fraudulent payment or transactions.
Creating accounts with false identity or payment details, or using another person’s payment method without authorisation.

C.2 Phishing, credential theft and impersonation

Hosting or sending phishing pages, phishing messages or fake login portals.
Collecting, storing or trading stolen credentials, payment card data or session tokens.
Impersonating a person, company, brand or public authority in a misleading way.

C.3 Malicious software

Creating, hosting, distributing or controlling malware, ransomware, spyware, trojans, worms or exploit kits for use against systems you are not authorised to test.
Operating botnets, command-and-control servers, or infrastructure that supports them.

Security researchers may store malware samples and analysis tooling for legitimate defensive research if they keep them isolated and never use them against third parties. If your work involves this, tell us in advance at info@grn.cloud.

C.4 Unauthorised access and scanning

Accessing, or attempting to access, any system, network, account or data without the owner’s permission.
Probing, scanning or testing the vulnerability of systems you do not own or are not authorised to test.
Brute-force or credential-stuffing attacks.
Intercepting or monitoring traffic or data that is not yours.

Authorised security testing is allowed. You may run penetration tests and vulnerability scans against your own workloads and tenancy, or against a third party’s systems with that party’s written authorisation. Before testing your workloads on GRN.CLOUD, agree the scope and dates with us in writing via info@grn.cloud, so that the test is not treated as a live incident. The testing must:

stay within the agreed scope and your own resources;
not target GRN.CLOUD’s shared platform components, control plane or other tenants, which are out of scope;
not degrade the platform or other customers’ services;
be stopped immediately if it causes unintended impact.

Testing of GRN.CLOUD’s shared platform itself is only allowed with our prior written approval. If you find a vulnerability in our platform, report it to info@grn.cloud. We will not take action under this Policy against anyone who reports a vulnerability in good faith, avoids harm to others and our customers, and gives us reasonable time to fix the issue before disclosing it.

C.5 Network attacks and harmful traffic

Denial-of-service (DoS/DDoS) attacks, or offering “stresser” or “booter” services.
Forging packet headers, spoofing IP addresses, or using IP addresses that have not been assigned to you.
Running open resolvers, open relays or open proxies that are used for abuse, after we have told you about the problem.

C.6 Spam and unsolicited communications

Sending unsolicited bulk or commercial email or messages, or messages that break applicable rules on electronic communications, such as the consent rules in the Dutch Telecommunications Act and the ePrivacy rules.
Hosting websites or services that are advertised through spam.
Using purchased or harvested address lists, or hiding the sender’s identity.

C.7 Intellectual property infringement

Storing, distributing or making available material that infringes copyright, trademarks, trade secrets or other rights. This includes pirated software and unlicensed media.
Running software on the services without the licences it requires.

C.8 Unlawful and harmful content

Child sexual abuse material. We will remove or disable access to it and report it to the competent authorities as required or permitted by law.
Terrorist content as defined in EU law, and content that incites violence or hatred against people because of protected characteristics.
Non-consensual intimate images, and personal data that you process without a lawful basis.
Any other content that is unlawful in the Netherlands or the EU.

C.9 Resource abuse and platform interference

Using the services in a way that significantly degrades performance for other customers, or that goes beyond the limits of your service.
Cryptocurrency mining that uses proof-of-work, unless we have agreed to it in writing.
Trying to get around quotas, billing, metering, tenant isolation or other security controls.
Accessing other customers’ namespaces, networks, storage or data, or trying to escape a container or virtual machine into the host.
Reverse engineering or tampering with GRN.CLOUD’s platform, except where the law or an open-source licence permits it.

C.10 Other restricted activities

Using the services to support a person, entity or country that is subject to EU or Dutch sanctions (see section D).
Operating critical systems where a service failure could directly cause death, personal injury or serious environmental damage, such as life-support or weapons control, unless we have agreed to it in writing.

D. Legal and regulatory compliance

You are responsible for making sure that your use of the services, and the content and applications you run, comply with all laws that apply to you and your users. This includes data protection law (such as the GDPR), consumer and e-commerce law, electronic-communications law, and intellectual-property law. If you process personal data on our services, you are the controller, or the processor for your own client, and you are responsible for having a lawful basis for that processing.

Sanctions and export control. You must comply with the sanctions and export-control rules that apply to you and to GRN.CLOUD, including EU restrictive measures and Dutch sanctions law. You confirm that you are not, and are not owned or controlled by, a person or entity subject to those sanctions. You must not make the services available to such persons or entities, or to sanctioned destinations, in breach of those rules. Some technology and software, including certain AI models, GPUs and encryption tools, may be subject to export controls. You are responsible for checking them before you use or distribute them. If we are legally prohibited from continuing to provide the services, we may stop doing so.

E. Customer responsibilities

You are responsible for:

Accounts and credentials: keeping login details, API tokens, kubeconfig files and SSH keys secure; using multi-factor authentication where available; and removing access for people who no longer need it.
Workloads and configuration: securing everything you deploy and control, such as operating systems, container images, applications, firewall and NetworkPolicy rules, exposed ports, and access granted to your users. Under our shared-responsibility model, GRN.CLOUD operates the underlying platform and you operate your workloads. The split depends on the service you have chosen, as set out in your agreement and the service documentation.
Patching and vulnerabilities: keeping your software up to date and acting promptly when we tell you about a vulnerable or compromised resource.
Data and backups: the lawfulness of the data you store and the backup arrangements you choose, as set out in your agreement.
Users: making sure everyone who uses the services through your account knows about and follows this Policy. Activity carried out through your account counts as your activity.
Cooperation: responding within a reasonable time to our questions about suspected misuse, and fixing problems we report to you.

Resellers and MSPs. If you provide services to your own clients on GRN.CLOUD, you must:

include terms in your client agreements that are at least as protective as this Policy;
act on abuse involving your clients;
keep contact details with which we can reach you quickly about abuse.

We will normally contact you, not your client, about an issue. However, we may act directly on a resource where section I allows it.

F. Third-party software and marketplace applications

The marketplace and the platform make third-party software available, including open-source software and vendor images. When you deploy third-party software, you are responsible for:

accepting and complying with its licence terms;
configuring and securing it;
the content and data you put into it;
using it lawfully.

GRN.CLOUD does not read the content you store in these applications as a matter of course. A marketplace listing does not mean that an application is suitable for your purpose. Where GRN.CLOUD operates an application for you as a managed add-on, the division of responsibilities in your service agreement applies. You remain responsible for how the application is used and for its content.

G. Abuse reports and investigations

Anyone can report suspected abuse of GRN.CLOUD services, whether or not they are a customer.

Abuse reports: info@grn.cloud
Security vulnerabilities in our platform: info@grn.cloud
Requests from authorities: info@grn.cloud

To help us act quickly, include:

the IP address, hostname or URL concerned;
the date, time and time zone;
a description of the activity;
supporting evidence such as log excerpts or email headers;
your contact details.

Notices about unlawful content should also explain why you believe the content is unlawful.

When we receive a report, we:

confirm receipt where contact details are provided;
assess the report and identify the customer and resource concerned;
normally inform the customer and ask them to investigate and fix the issue within a stated period;
take the further steps in section I if the issue is serious, urgent or not fixed;
inform the reporter of the outcome where appropriate and lawful.

We may not be able to share details of our investigation or of our customers with the reporter.

H. Monitoring, privacy and evidence

We do not read customer workloads or data as a matter of course. Our platform engineers hold administrative access to the infrastructure in order to operate it. That access is role-based and logged, and access for support purposes is requested and recorded.

To operate and protect the platform, we process operational information about the services, such as resource usage metrics, API audit logs, security events from runtime detection tooling, account activity. We use this information to keep the services running, to bill accurately, and to detect and investigate threats to the platform and abuse.

When we investigate a suspected breach of this Policy, we limit our review to what is necessary and proportionate. We look at operational information and at what is publicly reachable, such as a reported URL. We do not access the contents of your workloads or stored data unless one of the following applies:

you ask or authorise us to, for example in a support request;
your agreement or Data Processing Agreement allows it;
it is necessary to stop an immediate threat described in section I;
the law or a binding order from a competent authority requires it. Such requests are handled under Dutch and EU law.

Where we process personal data in this context, we do so in line with our Privacy Policy and, where applicable, the Data Processing Agreement. We may keep relevant records as evidence for as long as necessary to handle the matter, meet legal obligations, or establish or defend legal claims. We share information with authorities only where the law requires it or where we are entitled to do so under the law.

I. Enforcement

If we reasonably believe this Policy has been breached, we act in proportion to the seriousness, the risk to others and the customer’s response. Possible steps include:

Notification: we contact you, explain the issue and ask you to fix it within a reasonable period.
Targeted restriction: we limit the affected resource only, for example by blocking a port, isolating an IP address, or rate-limiting traffic.
Suspension: we suspend the affected resource or service, or your account if the problem cannot be isolated.
Termination: we end the affected service or the agreement, in line with the Terms & Conditions.
Removal or blocking of access to specific content, where we are legally required to do so or the content is clearly unlawful.
Reporting: we report suspected criminal activity to the competent authorities.

Urgent situations. If an activity poses an immediate threat to our platform, to other customers, or to third parties, we may restrict or suspend the affected resources immediately without prior notice. Examples include an active attack, an actively spreading compromise, or clearly unlawful content of the most serious kind. We will tell you what we did and why as soon as reasonably possible. We will also tell you how to restore service. We act on the smallest scope that removes the threat.

A suspension does not in itself delete your data . Charges during a suspension are governed by the Terms & Conditions and your order. If you think we acted in error, contact info@grn.cloud and we will review the decision.

J. Relationship with other documents

This Policy forms part of your agreement with GRN.CLOUD and is incorporated into our Terms & Conditions. Other documents may also apply:

the Terms & Conditions, which govern the contract, payment, liability, suspension and termination, and governing law;
any service-specific terms, order or written agreement;
the Privacy Policy, which explains how we process personal data as a controller;
the Data Processing Agreement, which governs our processing of personal data on your behalf;
any Service Level Agreement that applies to your service.

If this Policy conflicts with a written agreement signed by both parties, the signed agreement prevails.

K. Changes and contact

We may update this Policy to reflect changes in the law, our services or the threats we see. We will publish the new version on this page with a new version number and date. Material changes will be announced to customers at least 30 days before they take effect, unless a change is needed sooner to comply with the law or to address a security risk.

GRN.CLOUD B.V.
Keurenplein 4, Unit D8884, 1069 CD Amsterdam, the Netherlands
KvK 98015540
Abuse: info@grn.cloud
Security: info@grn.cloud
Legal: info@grn.cloud
General: info@grn.cloud · +31 85 004 5900