# Acceptable Use Policy

> Ironatoll acceptable use policy for offshore dedicated servers paid in crypto: Tor exit relays allowed, ten banned uses, DMCA ignored, port 25 shut. No KYC.

- URL: https://ironatoll.com/acceptable-use/
- Last updated: 2026-11-02
- Publisher: Ironatoll (https://ironatoll.com)

What an Ironatoll dedicated server may run, the ten prohibited uses one by one, what the abuse desk does with a report, and how a suspension is appealed.

**Quick answer — Which uses does Ironatoll allow on a dedicated server?**

An **Ironatoll** dedicated server can carry websites, your own VPN, Tor relays with exits among them, Proxmox VE virtual machines, game servers and full Bitcoin or Monero nodes. A DMCA notice changes nothing, since Panamanian law and Panamanian courts are the only ones that apply. Ten uses are banned: spam, phishing, malware and botnets, attacks, scanning, booters, carding and fraud, child sexual abuse material, mining, and serving sanctioned people. Port 25 is shut for outgoing mail, and any breach ends in suspension.

## 1. Scope

This policy covers every Ironatoll account and dedicated server, every virtual machine running on one, and every person who uses them. It forms part of the [Ironatoll terms of service](https://ironatoll.com/terms/ "Ironatoll terms of service, governed by the law of Panama") and covers every plan on the [pricing page](https://ironatoll.com/pricing/ "Ironatoll dedicated server plans and prices per 30 days") alike. Anything that runs on your server is on you, and so are the machines and logins you give to other people.

## 2. Which law applies?

Ironatoll is run by DomaineGoat LLC, a company registered in Panama, and answers only to Panamanian law. Each server’s datacenter, for its part, is bound by the law of the country it stands in. Ironatoll does not act on a legal demand founded on another country's law.

## 3. What may run on a server?

Your server may run anything that section 6 leaves off its list. Some uses Ironatoll names explicitly as fine:

- sites, web apps, APIs and services you host for yourself;
- your own VPN with WireGuard or OpenVPN (see [should I use a dedicated server for my own VPN](https://ironatoll.com/dedicated-server-for-vpn/ "Running your own VPN on a rented dedicated server"));
- Tor relays of every kind (section 4);
- virtual machines under Proxmox VE (see [how do I install Proxmox on a dedicated server](https://ironatoll.com/install-proxmox-on-dedicated-server/ "Proxmox VE on a rented dedicated server, step by step"));
- game servers (see [can I host game servers on a rented dedicated server](https://ironatoll.com/dedicated-server-for-game-servers/ "Game servers on a rented bare-metal machine"));
- full Bitcoin or Monero nodes (see [can I run a Bitcoin or Monero node on a dedicated server](https://ironatoll.com/dedicated-server-for-bitcoin-node/ "Bitcoin and Monero full nodes on a dedicated server"));
- language models on the processor (see [can I run an LLM on a dedicated server without a GPU](https://ironatoll.com/run-llm-on-dedicated-server/ "CPU inference on a rented dedicated server"));
- a mail server that hands its outgoing mail to a relay provider on port 465 or 587 (section 7);
- storage, backup targets, and machines for development or testing.

## 4. Are Tor relays allowed?

Yes. Tor exit relays may run on our servers, and so may middle relays and bridges. Port 25 is shut for outgoing traffic on all servers, so no exit relay can pass SMTP on that port.

[Running a Tor exit relay on a dedicated server](https://ironatoll.com/tor-exit-relay-dedicated-server/ "Exit relay on a rented dedicated server, step by step") walks through the setup, and [is it legal to run a Tor exit node](https://ironatoll.com/is-it-legal-to-run-a-tor-exit-node/ "Tor exit relays and the law, by country") covers the legal side.

## 5. What happens to DMCA and foreign copyright notices?

DMCA ignored: no DMCA notice, and no other foreign copyright notice, leads to any action on our side. Panamanian law and the orders of Panamanian courts are the only authority we answer to. A notice under the DMCA, or under any other foreign country's copyright law, brings no takedown and no suspension.

Ignoring copyright notices does not lift the bans of section 6, which hold on every server. [What does "DMCA ignored" mean for a dedicated server](https://ironatoll.com/what-does-dmca-ignored-mean/ "DMCA ignored as a rule of jurisdiction, for a rented dedicated server") explains the reasoning, which is about jurisdiction.

## 6. Which uses are prohibited?

Spam and bulk email, phishing, malware and botnet control, DDoS and other attacks, scanning or brute-forcing systems that belong to others, booter and stresser services, carding and fraud, child sexual abuse material, cryptocurrency mining and any service to sanctioned people or companies are all forbidden.

Below, each of the ten bans is defined. Every ban covers the server, all virtual machines running on it and any service you resell from it.

| Banned use | What falls under it |
| --- | --- |
| Spam and bulk email | Mass mailings and messages nobody asked for, whatever the port and whatever the mail provider. |
| Phishing | Anything that impersonates a bank, wallet, shop or other service, whether a page, a message or an app, in order to harvest logins, card numbers or recovery phrases. |
| Malware and botnet control | Storing or distributing malicious software, and running command-and-control servers for compromised machines. |
| DDoS and other attacks | Any flood, exploit traffic or other attack aimed at any system from the server or from a machine running on it. |
| Scanning and brute-forcing | Scanning ports or vulnerabilities, or guessing passwords, on systems you do not own. |
| Booter and stresser services | Operating or selling a flood-on-demand service under any label, "stress testing" among them. |
| Carding and fraud | Checking or using stolen card data, fake shops, scam pages, or any other trick for getting money or goods by deception. |
| Child sexual abuse material | Storing, sharing or linking to such material, in whatever form. No exception exists. |
| Cryptocurrency mining | Mining of any coin, with any software, directly on the server or in one of its virtual machines. |
| Serving sanctioned people or companies | Accounts or services for anyone on a sanctions list, person or company, or for anyone in a country or region named in section 8. |

Where three of the rules end:

- **Nodes versus mining:** a full node verifies a blockchain without mining anything, so Bitcoin and Monero nodes are permitted.
- **Scanning your own machines:** testing and scanning hardware you own is fine; hardware owned by anyone else is not.
- **Normal mail:** personal or business mail from your own server is allowed once a relay provider takes it on port 465 or 587. Mass mailing remains banned on any port, through any provider.

## 7. Why is port 25 closed?

Port 25 (SMTP) is blocked for outgoing traffic on every server as an anti-spam measure, and the block is permanent. Outgoing connections to mail providers on ports 465 and 587 work normally. That is why a mail server at Ironatoll sends its outgoing mail through a relay provider on 465 or 587. How to set it up: [can I host a mail server on an offshore dedicated server](https://ironatoll.com/mail-server-on-dedicated-server/ "Mail servers on a dedicated server with port 25 closed").

## 8. Who cannot use Ironatoll?

We turn away people and companies located in Cuba, Iran, North Korea, Syria, Russia, Belarus, China, Yemen or Western Sahara, or in the occupied regions of Ukraine. Wherever the blockchain shows the sending address, which it does for every coin we take except Monero, we match the payment against public sanctions lists of blockchain addresses, and a payment sent from a listed address is never added to a balance. Only people who have turned 18 can open or hold an account.

## 9. How are abuse reports handled?

Foreign copyright notices, DMCA ones included, are set aside: we act only under Panamanian law or on a Panamanian court order. Spam, phishing, malware, botnet control, attacks and child sexual abuse material are banned, and any one of them gets the server suspended.

Send reports about any Ironatoll IP address to abuse@ironatoll.com. A report gets handled sooner when it contains:

- the Ironatoll IP address concerned;
- when it happened: date and time, preferably UTC, or local time with the zone named;
- the type of abuse, such as spam, phishing, malware, an attack or a scan;
- evidence: logs, complete email headers or the URL at fault.

Copyright complaints get no action from the abuse desk, whether they invoke the DMCA or some other foreign law.

## 10. What does a suspension mean?

Breaking a rule of section 6 gets the server suspended. The dashboard then shows it as suspended, and support will tell you why if you email them. Days left on a server suspended for a breach are not credited, because the [refund policy](https://ironatoll.com/refunds/ "When Ironatoll credits days back, with worked cases") gives credits in its listed cases and no others.

A server whose paid days have simply run out is a separate case, governed by the terms of service: its disks are held for 7 days and then wiped.

## 11. How do I appeal a suspension?

Email support@ironatoll.com. A person answers support emails within 12 hours, seven days a week, including help with SSH keys, RAID, reinstalls and firewall rules.

- Quote the server's IP address together with its order reference (ORD-…).
- Do not include your account number. Nobody from our team will ever ask for your account number, your root password or your private SSH key, by email or in a chat.
- Describe what went wrong and what you have fixed since: malware removed, an open mail relay closed, a virtual machine shut down.

## 12. When are records handed over?

Nothing is handed over without an order from a Panamanian court. The full list of records is in the [privacy policy](https://ironatoll.com/privacy/ "What Ironatoll stores, and the logs it never keeps"). No logs: we keep no connection logs, no traffic logs and no IP addresses of visitors or customers, on the website, the dashboard or the servers.

## 13. Changes to this policy

This version of the policy is dated 30 October 2026. It may be revised; the date at the top shows which version is in force, and a revision applies to every server from that date.

---

Ironatoll: Ironatoll rents offshore dedicated servers (bare metal) in Amsterdam, Reykjavik, Zurich and Bucharest, paid in crypto with no KYC: no ID, no selfie, no documents. Each server is a whole physical machine for one customer, with root access over SSH. It is run by DomaineGoat LLC, a company registered in Panama that ignores DMCA notices, answers only to Panamanian law, allows Tor exit relays and keeps no logs. On the 30-day term, each plan is priced at least 25% under a named comparable dedicated server from 17 no-KYC crypto hosts, read on 30 October 2026.