acceptable use policy

last updated 2026-08-20 · briven.tech

This policy expands Section 5 of the Terms of Service and applies to everyone who uses the briven Service, operated by flndrn Limited. The Terms remain the binding contract: nothing here adds a prohibition that is not already in Section 5, and where the wording differs, the Terms govern. What this page adds is detail — what the rules actually mean, what happens when one is broken, and what is explicitly allowed.

The principle underneath all of it: briven is shared infrastructure. Your database sits on a machine with other people’s databases, and the outbound reputation of that machine is shared too. Almost every rule below exists because breaking it damages someone who did nothing wrong.

1. Illegal content and activity

You may not store, transmit, or generate content that is illegal under EU or Belgian law, or use the Service to carry out activity that is. flndrn Limited is registered in Cyprus and operates from Flanders, Belgium, so Belgian and EU law is the standard applied regardless of where you are; content lawful in your own jurisdiction but unlawful here is still not permitted on this platform.

This includes, without limiting the general rule: content that incites violence or terrorism; the sale of goods or services whose sale is prohibited; fraud, phishing pages and credential-harvesting sites; and material subject to a valid removal order from a competent authority.

2. Spam and abusive outbound traffic

You may not use the Service to send unsolicited bulk email or messages, nor to generate abusive outbound traffic of any kind. In practice that means:

• no unsolicited bulk email, SMS or messaging, and no list you cannot show consent for;
• no scraping, credential-stuffing, brute-force or vulnerability-scanning traffic aimed at third parties;
• no high-volume automated requests to third-party services in a pattern that would be treated as an attack by the receiving side;
• no relaying or proxying of traffic to disguise its origin, and no open proxy or open relay.

This one is enforced strictly, and not out of severity for its own sake: outbound abuse gets the platform’s addresses blocklisted, and the customers who pay for it are the other tenants whose legitimate mail then bounces.

3. Intellectual property

You may not host material that infringes copyright, trademark, or other third-party intellectual property rights. You are responsible for holding the rights to everything you put in your databases and storage buckets.

Rights holders may send a notice to legal@flndrn.com identifying the work, the material complained of and enough detail to locate it, together with a statement of good-faith belief and authority to act. Where a notice is valid the Operator will act on it and will pass it to the affected customer, who may respond. Repeat infringement leads to termination.

4. Child sexual abuse material and non-consensual imagery

You may not host or transmit child sexual abuse material, content that sexualises minors, or non-consensual intimate imagery.

There is no notice, no warning, no cure period and no appeal for this category. The account is terminated immediately and the matter is reported to the appropriate authority, along with the information the Operator holds. This is the one rule on this page with no proportionality attached to it, and that is deliberate.

5. Attacks on other tenants, the platform, or anyone else

You may not probe, scan, or attempt to compromise other tenants, the host infrastructure, or any system you do not own. Concretely:

• no attempt to reach another customer’s database, storage bucket, credentials or traffic, whether by connecting, guessing, enumerating, or exploiting a flaw;
• no attempt to escape the boundary of your own database or container, escalate privileges, or reach the control plane;
• no port scanning, fuzzing or exploitation aimed at the pooler, the dashboard, the management API or the host, outside the terms of §9 below;
• no using briven as the origin of an attack on a third party, which is covered by §2 as well and is treated as the more serious of the two.

Finding a flaw by accident is not a violation — exploiting it, or looking further once you have found it, is. If you trip over something, stop and read §9.

6. Mining, distributed computation and denial-of-service tooling

You may not run cryptocurrency mining, distributed computation for hire, or denial-of-service tools on the Service. This includes proof-of-work of any kind, rented-out compute, botnet command-and-control, stress-testing or “booter” services, and workloads whose purpose is to consume capacity rather than to store and query data.

briven sells a database, not general-purpose compute. A workload that is really CPU rental wearing a database costume is out of scope regardless of how it is packaged.

7. Resale and circumvention of paid plans

You may not resell the Service, nor run a separate commercial product on a free tier in a way that circumvents paid plans where those plans apply to your usage. That includes splitting one workload across multiple free accounts to stay under a limit, creating accounts programmatically to farm free resources, and offering briven databases onward to your own customers as if they were your own hosting product.

Building a product on briven is exactly what the platform is for, and is not resale. Reselling briven itself is. If your model sits somewhere between the two, write to support@flndrn.com and ask — asking first has never gone badly for anyone.

8. Resource limits, and why they are protections

Every database role is provisioned with three brakes. They are not punishments and they are not a hidden tier — they are what stops one tenant’s accident from becoming everyone’s outage on shared infrastructure:

• A statement is stopped after 30 seconds. A query that has run for half a minute is almost always a missing index or a runaway join, and left alone it holds locks and memory that the rest of the machine needs.
• A transaction left open is closed after 60 seconds. An idle open transaction blocks vacuum and holds locks indefinitely; this is the single most common way a healthy database is brought down by an application bug rather than by load.
• A connection limit of 20 per role. Connections are the scarcest resource in PostgreSQL. The pooler in front of your database is what turns twenty into the concurrency your application actually needs.

Hitting a limit is not a policy violation and nothing happens to your account. Deliberately working around them — splitting one long job into a loop designed to defeat the timeout, or opening roles purely to multiply the connection allowance — is a violation, because at that point the protection has been removed from the neighbours it exists for. If your legitimate workload genuinely needs more headroom, write to support@flndrn.com rather than engineering around it.

9. Security research

Security research on briven is welcome. Someone who finds a flaw and tells us is doing the platform a favour, and this policy is written so that person is not deterred by §5.

The conditions are short and they are not negotiable:

• Write to security@flndrn.com first, before you begin, describing what you intend to test. Coordinated testing is in scope; unannounced testing is indistinguishable from an attack and will be treated as one.
• Test only against your own account and your own data. Never against another tenant, another tenant’s database, or anyone else’s data. There is no finding valuable enough to justify reaching another customer’s rows to prove it.
• Do not degrade the Service. No load testing, no denial-of-service, no automated scanning at volume, and no persistence.
• Stop at proof. Demonstrate the flaw and stop — do not pivot, escalate further, exfiltrate data, or read anything you did not need to prove the point. If you encounter another customer’s data, stop immediately and say so in the report.
• Give us time. Report privately and give a reasonable window to fix before disclosing publicly.

Research conducted within those conditions will not be treated as a violation of this policy or of the Terms, and the Operator will not pursue action over it. There is no paid bug bounty programme today; credit is offered, and the report is answered by a person. See the security page for what is already known and documented — including the gaps, which are published deliberately and do not need reporting.

10. Enforcement

Enforcement is proportionate, and the difference turns on whether waiting causes harm that cannot be undone.

• Immediate suspension, without notice. Reserved for the severe cases: child sexual abuse material or content sexualising minors; an active outbound attack or live spam run; and a binding legal demand from a competent authority. In those cases the Operator acts first and informs you after, because the harm continues for as long as the Service is up.
• Notice and a chance to fix, everywhere else. For every other breach the Operator will contact the email on the account, describe the problem specifically enough to act on, and give reasonable time to cure. Most issues are misconfigurations and end there.
• Escalation. Where a breach is not cured, or recurs, the Operator may remove the offending content, restrict features, suspend the account, or terminate it under Section 10 of the Terms. Where possible, termination comes with an export window; your data is standard PostgreSQL, so a pg_dump over your own connection is a complete copy.
• Disagreement. If you believe an action was wrong, reply to the notice or write to legal@flndrn.com. A human reads it, and a suspension that turns out to be a mistake is reversed.

11. Reporting abuse

To report content or activity on briven that breaches this policy, email legal@flndrn.com. For anything involving a security flaw, an active attack, or exposed credentials, email security@flndrn.com instead, which is monitored for exactly that.

Please include, as far as you can:

• what you observed, and where — a URL, hostname, IP address or bucket;
• when it happened, with timestamps and a time zone;
• evidence you can share safely, such as log lines or mail headers — and please do not attach unlawful material itself, only enough to locate it;
• how we can reach you for follow-up.

Reports are read by a person, not a queue robot, and are acknowledged. Reports concerning child sexual abuse material are handled ahead of everything else. Please do not use these addresses for support questions about your own account — support@flndrn.com is faster for that.

12. Changes to this policy

This policy may be updated as the platform changes or as new categories of abuse appear. Material changes are posted here with a new “last updated” date, and the underlying obligations in Section 5 of the Terms of Service change only through the process in Section 14 of the Terms.