Acceptable Use Policy

Last updated 19 August 2026. It governs what may be sent through infrastructure Infrabox provisions, and the enforcement that follows a breach.

A value shown as pending is a figure fixed in your subscription rather than published here. Infrabox would rather show you the shape of the blank than print a threshold nobody has agreed to.

1. Purpose and position

Infrabox provides email infrastructure — mailbox provisioning, domains, DNS, authentication records, monitoring and an SMTP relay. Infrabox is an infrastructure provider, not a sender. You are solely responsible for the content, the recipients and the legality of every message sent through infrastructure we provision for you.

This policy is intended to form a binding part of the Terms of Service. Violating it may result in throttling, suspension or termination under section 6.

2. Absolute prohibitions

You must not use the services to send, or to assist in sending:

1. Messages that violate the U.S. CAN-SPAM Act, including messages with false or misleading header information, deceptive subject lines, a missing or non-functional opt-out, or a missing valid physical postal address.
2. Messages to recipients in Canada without consent compliant with CASL — express, or valid implied consent. CASL has no general B2B exemption.
3. Messages to individuals in the EU/EEA without a lawful basis under the GDPR and compliance with national e-privacy rules. Where you rely on legitimate interest, you must hold a documented Legitimate Interest Assessment.
4. Messages to recipients in the UK in violation of PECR. Note that sole traders and some partnerships are treated as individuals requiring consent.
5. Messages to consumers in France without prior opt-in consent. The precise scope of this rule is scope pending and will be confirmed before this policy is finalised.
6. Content that is fraudulent, deceptive, defamatory, infringing or otherwise illegal; phishing; malware; or link laundering.
7. Messages on behalf of third parties who would themselves be barred under this policy. Reselling access to a sender we would refuse is the same violation, one step removed.

3. Lists and list hygiene

• Recipient lists must be verified within window pending before first send, using Infrabox’s pre-flight verification or a provider approved in writing.
• Lists exceeding a hard-bounce threshold (threshold pending), or with known spam-trap contamination, must not be used. Infrabox may block sending from mailboxes exhibiting these patterns, and an automatic bounce kill-switch engages at a second, higher threshold (threshold pending).
• Scraped lists of personal, non-business addresses are prohibited. B2B business-contact data is permitted only where it is lawful in the recipient’s jurisdiction — which is a question about the recipient, not about you.

4. Technical and volume rules

• Per-mailbox daily sending limits and ramp schedules published by Infrabox are hard limits. Attempting to circumvent them — unauthorised aliasing, header forgery, or rotating identities to evade a limit — is prohibited. The relay enforces its own daily cap per mailbox; see how the relay works.
• The SPF, DKIM and DMARC records Infrabox publishes for your domains must not be modified or removed. If you need them changed, ask; changing them yourself breaks the authentication chain the rest of this policy assumes.
• You must maintain a functional unsubscribe mechanism and honour opt-outs within window pending, or sooner where local law requires it.
• The infrastructure is for business email sending. Abusing provider APIs, or automating account access in violation of Google’s terms, is not permitted.

5. Your compliance warranties

You represent and warrant that:

1. you have a lawful basis for each recipient you contact;
2. your message content complies with all applicable laws in both the sending and the receiving jurisdiction;
3. you will indemnify Infrabox against claims, fines and costs arising from your sending, on terms to be set out in the Terms of Service.

6. Enforcement

Infrabox operates automated abuse monitoring. Where a trigger below is met, the corresponding action follows.

Enforcement actions are logged and retained for period pending. Abuse reports can be raised through the get started page until a dedicated address is published; the acknowledgement and action windows are windows pending.

7. Data protection

Where your use involves personal data of individuals in the EU, EEA or UK, a Data Processing Agreement under Article 28 GDPR applies. Infrabox processes such data only on your documented instructions, as processor. You are the controller of recipient data — you chose the recipients, and Infrabox has no independent relationship with them.

A standalone data processing agreement is not published here; if your compliance process needs one, ask. See the privacy policy page for what is and is not settled.