Acceptable use policy

This policy applies to anybody using hosting, mail, cloud or infrastructure we provide or manage, and it applies to whoever you let use it too. It exists so that one client cannot make the platform worse for the rest, and so that when we do have to switch something off, the reason was written down before it happened rather than after.

What may not be hosted

• Anything unlawful in South Africa, or content that infringes somebody else's copyright, trade mark or other rights.
• Malware, phishing pages, credential harvesters, command and control infrastructure, or anything designed to attack a third party.
• Child sexual abuse material, content that incites violence or hatred, or material prohibited under the Films and Publications Act.
• Unsolicited bulk mail, purchased or scraped contact lists, or any marketing that breaches section 69 of POPIA or the Consumer Protection Act.
• Open relays, open proxies, and anything that lets an anonymous third party send mail or traffic through your service.
• Deliberate misrepresentation of another person or organisation, including forged mail headers and lookalike domains.

Fair use of shared resources

Shared hosting is shared. Sustained load that degrades other sites on the same infrastructure, cryptocurrency mining, distributed storage or file-dump services, and unattended jobs that run continuously all fall outside it. None of that is forbidden as such; it just needs its own infrastructure, and we will quote you for that rather than quietly throttle you.

What we expect from you

• Keep applications, plugins and themes you control patched. Where we manage patching, that is stated in your agreement and it is then our job.
• Use multi-factor authentication on every administrative account we give you.
• Do not share credentials between people. Ask us for another account instead; we do not charge for one.
• Tell us as soon as you suspect a compromise, even if you are not sure, and even if it was somebody on your side who caused it.
• Keep your mail authentication records (SPF, DKIM and DMARC) as we configured them. Changing them without telling us is the single most common cause of mail going missing.

What we do about a breach

Almost always we phone you, explain what we are seeing, and give you a reasonable period to fix it. We suspend first and talk afterwards only where the service is actively attacking somebody, is serving malware or phishing, is leaking personal information, or where the law requires it. A suspension is always followed by a written account of what we did and why, on the same day.

Repeated breaches, or a refusal to fix something that is harming others, entitle us to terminate the service on written notice. You get your data, your code and your configuration on the way out. We have never withheld a client's own material and we are not going to start.

Reporting abuse

If something we host is doing something it should not, write to info@bonangtech.com with the domain or address and what you have seen. We answer abuse reports inside one business day, and sooner where there is an active phishing page or an active attack.