Legal Center

This Acceptable Use Policy ("Policy") sets out what you may not do with SinarCloud. It forms part of the Terms of Service between you and SinarCloud ("we"). Words defined in the Terms of Service, such as Organization, Balance and ZDR Model, have the same meaning here.

This Policy is published in Indonesian and English. If the two versions differ, the Indonesian version prevails.

Key points

SinarCloud's servers run on infrastructure, and its AI requests go out through Partner accounts, that all its customers share. One customer's spam, attack or banned AI use can get that infrastructure blocked for everyone, so SinarCloud may act without warning when the harm is urgent (section 9.2). The rules broken most often:

• No pornography of any kind and no gambling, on servers or through the AI API. Both are unlawful in Indonesia.
• No cryptocurrency mining on any plan.
• No bulk email from servers. Port 25 is blocked, so send email through an email service.
• No public VPN or proxy services, and no reselling of raw AI API access, without SinarCloud's written approval.
• One promotion per customer. Opening extra accounts to repeat a promotion is prohibited.
• No sensitive personal data in AI requests except to ZDR Models.

1. Scope

1.1 This Policy applies to every SinarCloud Service and to everyone who uses your Organization's account, servers or API keys, including your end users.

1.2 If you build a product or service on SinarCloud, or host websites and applications for your clients, you must impose rules at least as strict as this Policy on your users and clients, and enforce them. You are responsible for what they do with the Services.

1.3 The lists in this Policy are examples. SinarCloud judges new forms of abuse by the same standards.

2. Laws and Partner policies

2.1 You must comply with the laws of Indonesia and of every country where you operate or where your users are.

2.2 You must also follow the rules of the Partners behind the Services. Where those rules are stricter than this Policy, the stricter rule applies. They currently include:

• for servers, the AWS Acceptable Use Policy;
• for the AI API, the OpenRouter Terms of Service;
• for each AI model, the usage policy or terms of its publisher, such as the Anthropic Usage Policy, the OpenAI Usage Policies, Google's Generative AI Prohibited Use Policy, the xAI Acceptable Use Policy, the DeepSeek Terms of Use, the Z.ai Terms of Use, the MiniMax Terms of Service and the Moonshot AI (Kimi) Terms of Service. For other models, follow the terms their publisher publishes.

3. Content and activity that are unlawful in Indonesia

You may not use the Services to host, store, send, generate, promote or facilitate:

• pornography in any form, including AI-generated pornography. Sexual content involving children is reported to the authorities without notice to you;
• gambling, including online gambling and slot sites, their payment flows, affiliate pages and promotion;
• terrorism or violent extremism, including recruitment, financing and propaganda;
• hatred or incitement based on ethnicity, religion, race or inter-group relations (suku, agama, ras dan antargolongan, SARA);
• hoaxes and false information that cause public unrest or disturb public order;
• illegal financial services, such as unlicensed online lending (pinjol ilegal), unlicensed investment schemes, Ponzi or pyramid schemes and unlicensed crypto-asset trading;
• illegal drugs, weapons, explosives, protected wildlife or counterfeit goods;
• the sale, exposure or collection of personal data without a lawful basis, including doxxing;
• infringement of copyright or trademarks, such as pirated software, films or music, illegal streaming and cracked licences;
• fraud, phishing, scams or impersonation;
• threats, extortion, harassment or stalking;
• any other content or activity that is unlawful in Indonesia.

4. Security and network abuse

4.1 Malicious software. No malware, ransomware, botnets, command-and-control servers, phishing kits or credential-stealing tools, and no hosting of exploits for use against others.

4.2 Attacks. No unauthorized scanning, brute-force logins, credential stuffing, exploitation of vulnerabilities, denial-of-service attacks, traffic amplification, IP spoofing or "stress tests" against systems that you do not own or have no written permission to test.

4.3 Proxies, relays and anonymizers. No open proxies, open mail relays, open DNS resolvers or public Tor exit relays. A VPN or proxy service offered to the public needs SinarCloud's written approval first. A VPN for your own team is allowed.

4.4 Security testing. You may test the security of your own servers and applications. Testing SinarCloud's systems, or other customers' systems, needs SinarCloud's written permission. Section 11 explains how to report a vulnerability in SinarCloud.

5. Email and messaging

5.1 No unsolicited bulk email, SMS or WhatsApp messages, and no use of purchased, rented or scraped contact lists. Every bulk message must identify the sender and include a working way to unsubscribe, and unsubscribe requests must be honoured.

5.2 Outbound email on port 25 is blocked on SinarCloud servers. Send email through an email delivery service on port 587 or 465. SinarCloud may ask its Partner to lift the block for a specific server, case by case, and the Partner may refuse.

6. Resource use

6.1 No mining of cryptocurrency and no other proof-of-work or proof-of-space workloads, on any plan.

6.2 No getting around data transfer allowances, capacity or per-Organization limits, request concurrency limits or rate limits, including by spreading load across several Organizations or API keys.

6.3 No load or stress testing of the AI API, the console or other SinarCloud systems without written approval, and no automated traffic that slows the Services for others.

7. Payments, promotions and the platform

7.1 One promotion per customer. You may not create or use several accounts or Organizations, false identities or automated sign-ups to obtain promotions, gifts, coupons, referral rewards or introductory prices more than once. SinarCloud may remove the reward, charge the normal price for what was used and close the accounts involved.

7.2 Payment abuse. You may not pay with bank or e-wallet accounts that you are not authorized to use, or use top-ups to launder money or to pass value to others.

7.3 Errors. If you find a pricing or billing error, report it to support@sinarcloud.com and do not exploit it. Value obtained through an obvious error can be reversed.

7.4 API keys and resale. API keys must not be shared with, or sold to, anyone outside your Organization. You may build products on the AI API for your own end users, and host your clients' websites and applications on your servers. Reselling raw access to the AI API, such as a gateway that sells SinarCloud API access as such, needs SinarCloud's written approval.

7.5 Probing and tampering. You may not reverse engineer, probe or scrape the console or the APIs beyond normal use, get around security checks, interfere with monitoring or metering, or tamper with the management agent on servers or use its credentials for anything other than its purpose.

8. AI API rules

8.1 Publisher policies. Each model publisher's policy (section 2.2) applies to every request you send to that model, whichever Partner serves it.

8.2 Prohibited uses. You may not use the AI API to create or support:

• sexual content involving children, intimate images of real people without their consent, or pornographic content of any kind;
• deepfakes or impersonation of real people without their consent, election manipulation or political disinformation;
• weapons capable of mass casualties (chemical, biological, radiological, nuclear or explosive), malware, or attacks on computer systems;
• fraud, scams, phishing, spam or fake reviews;
• harassment, threats, or hatred based on SARA;
• content that encourages suicide or self-harm;
• the promotion of gambling or illegal financial services;
• surveillance, profiling or facial recognition of individuals without a lawful basis;
• decisions with legal or similarly significant effects on people (such as on credit, employment, insurance, housing or legal status) made by AI without human review.

8.3 Transparency. Tell people when they are interacting with an AI system, or reading or viewing AI-generated content, wherever they could otherwise be misled.

8.4 No circumvention or extraction. You may not systematically try to defeat a model's safety measures, try to extract other customers' data or SinarCloud's configuration through the API, or use outputs to train models that compete with a model's publisher where its terms forbid it.

8.5 Sensitive data. Do not send passwords, secrets or specific personal data (health, biometric, genetic, criminal record, children's or personal financial data) to any model other than a ZDR Model, and send it to a ZDR Model only with a lawful basis. Section 8.2 of the Terms of Service explains why.

8.6 Professional advice. Medical, legal, financial and other professional outputs must be reviewed by a qualified person before they reach your end users.

8.7 Your safeguards. SinarCloud does not store or screen your requests, so you are responsible for what you and your users send and generate. If you offer AI features to your own users, put safeguards in place that suit your use, such as content filtering, abuse monitoring and a way for users to report problems. SinarCloud acts on reports and on flags from its Partners.

9. Enforcement

9.1 Usual steps. When SinarCloud finds a breach, it normally:

1. tells you what is wrong and gives you a deadline to fix it;
2. restricts the affected resource, for example by stopping a server, closing ports, or limiting or revoking an API key;
3. suspends the affected Services or your account;
4. terminates your account.

SinarCloud may skip steps when a breach is serious or repeated.

9.2 Immediate action. SinarCloud may act at once, without prior notice, when:

• a server or API key is being used for an active attack, malware, phishing or spam;
• content involves the sexual abuse of children;
• an authority orders urgent action;
• a Partner requires it; or
• waiting would put the Services, other customers or third parties at risk.

SinarCloud then tells you what it did and why, unless the law forbids it.

9.3 Measures. Measures can include stopping a server and preventing it from starting, blocking traffic or ports, revoking API keys, blocking your Organization's access to the AI API, disabling sign-in, removing Promotional Credit and Token Credits, reversing referral rewards, charging the normal price for promotions obtained through abuse, preserving evidence and reporting to the authorities.

9.4 Your paid Balance. Enforcement never forfeits money you paid. If SinarCloud terminates your account, it refunds your unused paid Balance under section 6.6 of the Terms of Service, after deducting any debt and any documented losses caused by the breach. Promotional Credit and Token Credits are removed.

9.5 Appeals. You can respond to a notice, or appeal a measure, within 7 days by replying to the notice or writing to abuse@sinarcloud.com. SinarCloud reviews your response and tells you its decision. If its decision was wrong, SinarCloud restores the Service and credits your Balance for the time you lost.

9.6 Compromised resources. If your server or API key is compromised and used for abuse, you must secure it promptly, and SinarCloud may stop it in the meantime. Requests made with a key before it was revoked are still charged (Terms of Service, section 3.7).

10. Reporting abuse

10.1 Anyone can report abuse of the Services to abuse@sinarcloud.com. Include the date and time with the time zone, the IP addresses or URLs involved, a description of the problem and evidence such as logs or message headers.

10.2 SinarCloud aims to acknowledge reports within one working day and handles them in order of severity, with active attacks and child sexual abuse material first.

10.3 A copyright or trademark owner can send a notice that identifies the work, the infringing material and where it is, and the owner's contact details, with a statement that the notice is accurate and that the sender is authorized to act. SinarCloud passes the notice to the customer and may disable access to the material. The customer can reply with a counter-notice through SinarCloud.

10.4 Unlawful content can also be reported to the Ministry of Communication and Digital Affairs (Komdigi) through aduankonten.id.

11. Security research

11.1 Report vulnerabilities in SinarCloud to security@sinarcloud.com, with enough detail to reproduce them. SinarCloud aims to acknowledge reports within 3 working days.

11.2 SinarCloud will not take legal action against good-faith security research that:

• tests only your own account and resources;
• does not access, change or delete other people's data, and stops as soon as it reaches any;
• does not degrade the Services, and uses no denial-of-service attacks, spam or social engineering;
• gives SinarCloud reasonable time to fix the issue before anything is disclosed.

12. Lawful orders and Partner reports

12.1 SinarCloud complies with lawful orders from courts, law enforcement and Komdigi, including orders to take down content within the legal deadlines of 1×24 hours, or 4 hours for urgent content. When an order concerns your content, SinarCloud tells you and, where the legal deadline allows, gives you time to remove it yourself. If it is not removed in time, SinarCloud may block access to it or stop the server.

12.2 When a Partner forwards an abuse report about your server or your API use, SinarCloud passes it on to you with a deadline. If the issue is not fixed by then, SinarCloud may stop the server or restrict the API key to protect other customers.

13. Changes to this Policy

SinarCloud may change this Policy in the same way as the Terms of Service (section 18 of the Terms of Service). Changes needed to comply with the law or to address new forms of abuse can take effect sooner.

Version history

Version	Date	Changes
2.0	1 November 2026	Renamed from "Acceptable Policy". Adds rules from Indonesian law, AI rules, email and port 25, promotions, the enforcement steps, appeals, abuse reporting and security research. Indonesian version added.
1.0	15 May 2025	First published version.