Acceptable Use Policy for Windows RDP servers

1. Who this policy applies to

This acceptable use policy applies to every Onyxpane account and every Windows server, and to anyone who uses them. It is part of the terms of service, and it covers every plan on the pricing page. You are responsible for what runs on your server. You are also responsible for anyone you give a Windows login or the Administrator password.

2. Which law applies

Onyxpane is run by DomaineGoat LLC, a company registered in Panama, and answers only to Panamanian law. The datacenter that houses each server is in its own country and follows that country’s law. A legal demand based on the law of another country gets no action from Onyxpane.

3. What an Onyxpane server is

Each Onyxpane server is a new Windows Server VPS, created for your order at a datacenter provider, with the Windows license included. It is a rented server: not a hacked computer, and not access to someone else's machine. You receive the Administrator account with a temporary password, and you change it at your first login.

Using a server to reach, sell or share access to computers that are not yours is prohibited (section 6). The page on is buying a Windows RDP legal explains how a rented Windows VPS differs from a hacked one.

4. What is allowed

You can run any software on your server that section 6 does not prohibit. Uses that Onyxpane allows by name:

• trading platforms such as MetaTrader 4 and 5, expert advisors and trading bots, as in what is the best Windows VPS for MT4 and MT5;
• remote work, office software and web browsing, as in can I use a Windows VPS for remote work and browsing;
• AI agents and automation on your own accounts, as in can I run an AI agent on a Windows VPS;
• websites, web apps, APIs and self-hosted services;
• mail software that sends through a mail provider on port 465 or 587 (section 7);
• development, testing and personal servers.

5. DMCA and foreign copyright notices

DMCA ignored: we do not act on DMCA notices or other foreign copyright notices. We answer only to Panamanian law and to orders of Panamanian courts. A notice under the DMCA or under another foreign copyright law leads to no takedown and no suspension.

Ignored notices do not change the rest of this policy: the prohibited uses of section 6 apply to every server.

6. Prohibited uses

No carding or payment fraud, no use of stolen accounts or identities, no credential stuffing or brute-forcing of other people’s systems, no spam or bulk email, no phishing, no malware or botnet control, no DDoS or other attacks, no booter or stresser services, no child sexual abuse material, no cryptocurrency mining, and no service to sanctioned people or companies.

These points make the list precise for a Windows server:

• Carding and payment fraud: no use of card numbers or payment accounts that are not yours, and no checking or testing of card numbers.
• Stolen accounts or identities: no logging in to accounts, Remote Desktop servers or computers that are not yours. No buying, selling or sharing of their logins, session cookies or identity documents.
• Credential stuffing and brute force: no automated login attempts with lists of usernames and passwords, against any website, app, Remote Desktop or SSH server. Scanning and testing your own systems is allowed; other people's systems are not.
• Spam: outgoing port 25 is closed on every server (section 7). Bulk email is prohibited on every port and through every provider.
• Phishing, malware and botnets: no phishing pages, no hosting, building or spreading of malware, and no botnet control panels.
• Attacks: no DDoS, no booter or stresser service, and no attack on any network or system.
• Mining: no mining of any coin, with any software. Running a trading bot or a wallet is not mining.
• Sanctions: Not available to people or companies in Cuba, Iran, North Korea, Syria, Russia, Belarus, China, Yemen or Western Sahara, or in the occupied regions of Ukraine. Incoming payments are checked against public sanctions lists of blockchain addresses; a payment from a listed address is not credited.

7. Port 25 and email

Outgoing port 25 (SMTP) is closed on every server to stop spam, and it stays closed. Ports 465 and 587 to mail providers stay open. Mail software on an Onyxpane server sends its mail through a mail provider on one of those ports.

8. Securing your server

You are responsible for the security of your server after delivery. Change the temporary Administrator password at your first login, install Windows updates and limit Remote Desktop where you can. A server used for a prohibited use is suspended, whoever started that use. The guide on how to secure Remote Desktop on a Windows VPS shows each step.

9. How abuse reports are handled

DMCA and foreign copyright notices are ignored; only Panamanian law and Panamanian court orders apply. Carding and payment fraud, credential stuffing and brute-force attacks, spam, phishing, malware, botnet control, other attacks and child sexual abuse material are not allowed and lead to suspension.

Send reports about an Onyxpane IP address to [email protected]. A report is easier to act on when it includes:

• the IP address of the server;
• the date and time of the activity, with the time zone (UTC is easiest);
• the type of abuse: carding or fraud, credential stuffing or brute force, spam, phishing, malware, botnet control or an attack;
• evidence, such as log lines, failed-login records, mail headers or a URL.

Copyright notices sent to this address, under the DMCA or any other foreign law, get no action.

10. Suspension

A breach of section 6 leads to suspension. A suspended server shows as suspended in your dashboard; write to support to learn why. A server suspended for a breach gets no credit for its remaining days, because the refund policy covers only the cases it lists.

Suspension at the end of an unpaid period is a different case. The terms of service describe it: the disk is kept for 7 days, then deleted.

11. Appeals

To appeal a suspension, write to [email protected]. A person answers support emails within 12 hours, seven days a week, including help with Remote Desktop connections, reinstalls and Windows Firewall rules.

• Give the order reference (ORD-…) and the IP address of the server.
• Never send your account number or your Administrator password. Nobody from our team will ever ask for your account number or your Administrator password, by email or in a chat.
• Say what happened and what you changed, for example the malware you removed or the password you replaced.

12. Legal orders

Records are handed over only on an order of a Panamanian court. The privacy policy lists the records that exist. No logs: we keep no connection logs, no traffic logs and no IP addresses of visitors or customers, on the website, the dashboard or the server.

13. Changes to this policy

We can update this policy. The date at the top shows the version in force, and a change applies from that date to every server.