Acceptable Use Policy

Your workflows run on shared infrastructure and send requests to other people's services. This policy is part of the Terms of Service. Last updated 23 October 2026.

Other services

Outbound requests carry your workspace's reference.

No attacks
Don't use workflows to flood, overload, or deny service to any host, or to keep hammering one that is failing.
No probing
Don't scan hosts or ports, guess credentials, or test for vulnerabilities on systems you don't own or have written permission to test.
No unauthorized access
Call only the APIs and accounts you are entitled to use, within their terms and rate limits.
No spam or phishing
Don't send unsolicited bulk messages, or messages that impersonate others or try to trick people into giving up credentials or money.

The platform

Use shiftlabs for automation, not as raw compute or a way around its limits.

No mining
No cryptocurrency mining or other compute resale. Deploys that contain mining code are refused.
No limit evasion
Don't create extra workspaces or accounts to get around plan limits, hide code from the deploy scan, or spread requests to get around the per-host rate limit.
No interference
Don't try to reach other customers' data, the platform's internals or its own hosts from a workflow, or to disrupt the service for anyone else.
Found a vulnerability?
Tell us at security@shiftlabs.org before telling anyone else, and follow the rules in Reporting a vulnerability. Don't access or change data that isn't yours while you investigate.

Content

What you store and send through shiftlabs.

Lawful only
Nothing illegal, and nothing that infringes someone else's intellectual property or privacy.
No malware
Don't host or distribute malware, or use workflows to control compromised machines.
Personal information
Handle personal information in your workflows lawfully, with the notices and permissions it needs.
No health data
No protected health information (PHI) unless we have signed a business associate agreement with you.
No card data
No payment cardholder data, such as card numbers and security codes. Use the ids and tokens your payment processor gives you instead.

Enforcement

How we find abuse and what we do about it.

Detection
Deploys are scanned, the gateway refuses requests to IP addresses, unusual ports and our own hosts, and automated checks every hour look for floods, scanning, failing targets and heavy compute.
What we do
Depending on how serious it is: warn you, lower your limits, suspend the workspace (which stops its runs), or end the account. For serious harm we act first and tell you after.
Report abuse
Email abuse@shiftlabs.org with the X-Shiftlabs-Tenant header value from the requests you received, and what happened.
The law
We cooperate with law enforcement where the law requires it.