Quick answer
Which uses does Velumhold allow on a hosting account?
Velumhold hosting accounts are for websites, WordPress and email on your own domain. Nine uses are banned: spam or bulk email, phishing, malware or botnet command, DDoS or other attacks, scanning or brute-forcing other people's systems, carding or fraud, child sexual abuse material, cryptocurrency mining, and any service to sanctioned people or companies. Breaking a rule leads to suspension.
1. Scope
This policy covers every Velumhold account, every website, mailbox and database on it, and every person who uses them. It belongs to the terms of service and applies whatever plan from the pricing page you use. You answer for what runs on your account, including the logins you hand to other people.
2. Which law applies?
Velumhold belongs to DomaineGoat LLC, a company incorporated in Panama that answers to Panamanian law alone. Each datacenter that houses our servers is bound by the law of the country it sits in.
3. What may run on an account?
Anything that section 5 does not prohibit may run on your account, within the limits of your plan: websites and web applications, WordPress sites, email accounts on your own domain and the databases behind them.
4. What happens to DMCA and foreign copyright notices?
DMCA notices and other foreign copyright notices get no response from us; we answer only to Panamanian law and to the orders of Panamanian courts. A copyright notice, whether it cites the DMCA or the law of another country, leads neither to a takedown nor to a suspension.
The prohibited uses of section 5 stay in force on every account.
5. Which uses are prohibited?
Forbidden: spam or bulk email, phishing, malware or botnet command, DDoS or other attacks, scanning or brute-forcing other people’s systems, carding or fraud, child sexual abuse material, cryptocurrency mining, and any service to sanctioned people or companies.
The table spells out each of the nine items. Each one applies to the account, to every site and mailbox on it and to any service you sell from it.
| Prohibited use | What it covers |
|---|---|
| Spam or bulk email | Unsolicited messages and mass mailings to people who did not ask for them, from any mailbox or script on the account. |
| Phishing | Fake pages, messages or apps dressed up as a bank, a wallet, a shop or another service in order to harvest logins, card details or recovery phrases. |
| Malware or botnet command | Hosting or spreading malicious software, and running the servers that steer infected machines. |
| DDoS or other attacks | Floods, exploit traffic or any attack sent from the account against any system. |
| Scanning or brute-forcing other people's systems | Port scans, vulnerability scans and password guessing aimed at systems that belong to other people. |
| Carding or fraud | Trying out or spending stolen card data, running fake shops or scam pages, or any other trick that takes money or goods by deceit. |
| Child sexual abuse material | Such material in any form, whether stored, shared or linked to. There is no exception. |
| Cryptocurrency mining | Mining any coin with any software on the account. |
| Service to sanctioned people or companies | Serving, in any way, a person or a company on a sanctions list, or anyone in a country or region named in section 7. |
Two points mark where a rule stops:
- Scanning: you may scan and test machines you own. Machines owned by other people are off limits.
- Email: personal and business mail on your own domain is fine. Mass mailing stays banned.
6. How does email sending work?
Email accounts on your own domain with webmail, IMAP and SMTP; outgoing mail is rate-limited to keep spam off the servers. The limit is not a quota to plan around: bulk email is banned whatever the number of messages.
7. Who cannot use Velumhold?
We cannot serve residents or companies of Cuba, Iran, North Korea, Syria, Russia, Belarus, China, Yemen or Western Sahara, or anyone in the occupied regions of Ukraine. Each incoming payment is checked against public sanctions lists of blockchain addresses, and a payment from a listed address is never credited. Nobody under 18 can hold an account.
8. How are abuse reports handled?
Foreign copyright notices are set aside; only Panamanian law and Panamanian court orders count. Spam, phishing, malware, botnet command, attacks, fraud and child sexual abuse material are banned and lead to suspension.
Reports about a Velumhold account belong at [email protected]. A report is easier to act on when it gives:
- the domain name or URL involved;
- the date and time of the activity, ideally in UTC, otherwise with its time zone;
- the type of abuse you saw, such as spam, phishing, malware, an attack or a scan;
- proof such as logs, full email headers or a screenshot.
The abuse address takes no action on copyright complaints, whether they cite the DMCA or another foreign law.
9. What does a suspension mean?
A breach of section 5 leads to suspension. The sites on the account stop. To contest it, see section 10. A suspension for a breach earns no credit for the days left, since the refund policy grants credits only in its own listed cases.
Running out of balance is different. The terms of service set out that case: the sites stop at the end of the term and the files are kept for 7 days.
10. How do I appeal a suspension?
Email [email protected]. A person answers support emails within 12 hours, seven days a week, including help with DNS records, WordPress, email accounts and moving a site in.
- Name the domain of the account.
- Do not put your account number in the email. Nobody from our team will ever ask for your account number, your control panel password or your private SSH key, by email or in a chat.
- Explain what happened and what you changed, such as the malware you removed or the script you turned off.
11. When are records handed over?
Records are handed over under a Panamanian court order, and in no other case. Each record that exists appears in the privacy policy. We keep no logs of who you are: no connection records of the dashboard and no IP addresses of customers. The web server keeps the access logs of your own sites in your account, for you, and you can switch them off.
12. Changes to this policy
This policy is dated 2 November 2026 and may be revised. The version that applies is the one dated at the top of this page, and a revision covers every account from its date.