Contract versions

Phylex Platforms Master Service Agreement

Version v7 — effective on the publication date shown in Phylex Atlas

1. Parties, scope and incorporated policies

This Master Service Agreement (the “Agreement”) is between ISPLABS LIMITED, company number 16958848, 128 City Road, London, EC1V 2NX, United Kingdom (“Phylex”, “Provider”, “we”, “us”), and the individual or entity identified by the verified Phylex Platforms account (“Customer”, “you”). It governs the account, website, billing panel, APIs, reseller facilities and every ordered service, including KVM and dedicated servers, game hosting, Storage Box, S3-compatible object storage, IP subnets, BGP-related services, DDoS protection, add-ons and support.

The current Terms of Use, Privacy/Data Protection Policy, Refund Policy, Acceptable Use and Abuse rules, order summary, plan specification, renewal price and service-specific notices displayed before purchase are incorporated into this Agreement. If documents conflict, mandatory law prevails, then the service order, this Agreement, and the incorporated policies in that order, unless a document expressly states otherwise.

2. Account authority and security

You must provide accurate identity, contact, country, tax and billing information and keep it current. An organization represents that the person accepting this Agreement has authority to bind it. You are responsible for account credentials, MFA, API keys, recovery methods, users to whom you grant service access, and activity performed through them. Credentials may not be shared publicly or used to evade account, sanctions, fraud, abuse or service limits. You must promptly report suspected compromise.

Phylex may require email verification, MFA, passkey, identity, payment-source, beneficial-owner, tax, sanctions or fraud checks before allowing a sensitive action. Automated risk signals may delay an action, but material adverse decisions may be referred to support for human review where required by law.

Where a KYC or KYB review is requested, the account may be placed in compliance read-only mode while existing paid services remain running. The customer may submit the requested information and documents, communicate with support and end sessions, but may not order, renew, transfer, reconfigure or otherwise mutate services until the review is approved or cancelled by Phylex. A failed identity check does not automatically restore write access. Identity-document and matching live-selfie checks may be processed by Stripe Identity; company, director, beneficial-owner, significant-control and banking evidence is reviewed by Phylex. KYB submissions must be made by an authorized company director and must disclose every beneficial owner holding 25% or more and every person exercising significant control.

3. Orders, provisioning and service descriptions

An order is an offer to buy the configuration shown at checkout. Acceptance occurs when Phylex records the order and begins provisioning or confirms manual acceptance. Availability, location and estimated delivery are not guaranteed until acceptance. Provider or network dependencies may require a technically equivalent change; a material reduction gives the Customer any remedy required by mandatory law.

The Customer must verify an assigned IP address, hostname, operating system, capacity, quota, route and credential promptly. “Unlimited” always remains subject to technical capacity, fair use, lawful use and the documented service specification. Beta, preview and experimental features may change or be withdrawn and are supplied without a production SLA unless expressly stated.

4. Prices, currency, tax and renewal

Services are prepaid unless an order states otherwise. The checkout and invoice identify recurring charges, one-time fees, add-ons, discounts, VAT or other tax, billing period and account currency. Currency conversion uses the platform rate applicable at the time of the transaction and may differ from a bank or card-network rate. Payment-provider charges and chargeback costs may be passed through where lawful and disclosed.

Automatic renewal, where enabled, charges the price snapshot and active recurring add-ons for the next period. Phylex may change future renewal prices on reasonable notice; the Customer may disable renewal or terminate before the new price takes effect. Failed or late payment may lead to suspension, data unavailability and eventual deletion under the lifecycle policy. Suspension does not erase amounts already due.

5. Consumer cancellation, refunds and credits

Nothing in this Agreement excludes a non-waivable consumer right. Where a statutory withdrawal right applies to a service, the Customer expressly requests performance during the withdrawal period when selecting immediate provisioning and may owe the proportionate value already supplied. Where law permits loss of the withdrawal right for immediately supplied digital content, activation requires the Customer’s prior express consent and acknowledgement.

Subject to mandatory law and the published Refund Policy, allocated computing capacity, IP resources, licenses, setup work, traffic, add-ons and immediately provisioned customized services are non-refundable after performance begins. Add-ons are charged for the selected/current period; removing or reducing an add-on does not create a prorated refund. Storage and disk capacity may be technically irreversible to shrink. Promotional, reseller and third-party charges follow the terms displayed at checkout. Approved refunds are returned to the original source or account balance as legally and operationally appropriate.

6. Service access delegation

The owner may grant another verified account granular access to a service. Available capabilities depend on the service handler and can include viewing, console, power, files, credentials or other management operations. Manual or unsupported services remain read-only. Delegated access does not transfer ownership, billing liability, contract obligations or the right to sell the service. The owner may revoke access; Phylex may revoke it upon transfer, suspension, security risk or account closure. All delegated actions may be audited.

7. Irreversible service transfer

An eligible owner may offer an entire service to another existing verified account. Transfer requires valid contracts and active/unblocked accounts, no blocking support/compliance condition, zero active Abuse & Risk score for both parties, no unresolved abuse or compliance case affecting eligibility, an eligible active service, and no administrator transfer restriction. Phylex may disable transfer for a particular service without hiding the transfer entry point and will display the restriction when attempted.

The sender enters the recipient email, completes anti-bot verification and confirms a time-limited code delivered to the sender’s verified email. Three invalid code attempts impose a 24-hour account-wide transfer lock and trigger a security notice. A verified offer expires if not accepted. The recipient must authenticate as the exact invited account and explicitly accept the detailed offer.

The offer identifies the sender, service type and configuration, recurring price, comment and linked items. Acceptance transfers the root service and its linked add-ons and ancillary services, including attached DDoS protection or IP subnet where recorded. Existing delegated access is revoked. For audit provenance, Phylex keeps the sender’s original billing records and creates marked evidentiary copies of the latest related invoice, order and transaction for the recipient; those copies are not new charges or proof that the recipient made the historical payment.

Transfer is final and not a cancellation mechanism. The sender must remove personal data and credentials not intended for the recipient before offering the service. The recipient assumes future charges, renewal and operational responsibility upon acceptance. Phylex does not promise to reverse a completed transfer, but may correct fraud, technical error or a result required by law or competent authority.

8. IP subnet attachment and setup

An IP subnet order must state whether it will attach to an owned service inside Phylex Platforms or external infrastructure. Internal attachment requires selecting the exact eligible owned service and may receive a disclosed setup-fee waiver. External routing may require technical validation, documentation, LOA/RPKI/routing work and the one-time setup fee configured for the plan. Acceptance is not a guarantee that every external network can support the requested route. IP resources remain subject to registry, upstream and abuse rules and are not sold as property.

9. Storage Box and S3

Storage Box and S3 quotas are enforced at the allocated service boundary. Protocols, hostnames and credentials may be rotated for security. Storage Box sub-users are confined to configured virtual roots and quotas; the owner remains responsible for them. S3 compatibility does not mean compatibility with every vendor-specific extension.

Ingress may be free where stated. Egress, operations or storage overage may be included, measured, limited or charged as shown in the plan. Usage accounting can be delayed and reconciled from provider records. Node-wide traffic and capacity safety limits may cause throttling or temporary provisioning controls. RAID, snapshots or redundancy are not backups unless the plan expressly includes a separate backup product. Customers must maintain independent tested backups and verify restoration.

10. Fair Use for unlimited-traffic KVM lines

Phylex advertises unlimited traffic on the following shared-network KVM tariff lines: EPC (Germany, AMD EPYC 9414P), RXD (Germany, AMD Ryzen 9 7950X3D), RZX (Germany, AMD Ryzen 9 9950X), AER (Netherlands, AMD EPYC 7402P), AXV (Netherlands, Intel Xeon E5), and NLX (Netherlands, Intel Xeon Gold 6134). “Unlimited traffic” means that ordinary compliant use is not billed per gigabyte; it does not provide dedicated or unbounded network capacity and remains subject to this Fair Use section, the purchased port speed, technical capacity and lawful use.

Operating public or private proxy, VPN, tunnelling, relay, traffic-forwarding or similar software is permitted only to the extent that it does not materially degrade shared network capacity or service quality for other customers. Phylex may apply proportionate per-service speed shaping or other network controls when such software, sustained throughput, connection volume or traffic pattern causes or is reasonably likely to cause that degradation.

Where a service consumes extreme or persistently disproportionate traffic, Phylex may replace unlimited traffic for that service with an applicable hard allowance of 500 GB or 1 TB, as identified for the plan or in the notice issued to the Customer. Phylex will provide notice where reasonably practicable. After the allowance is reached, traffic may remain restricted until the next measurement period or until the Customer purchases additional traffic. Each additional 1 TB costs EUR 2, subject to the checkout price and applicable tax. Additional traffic is purchased expressly; it is not charged retroactively without authorization.

This policy protects shared network quality and prevents proxy, VPN and other unusually traffic-intensive workloads from impairing other customers. Phylex will apply controls proportionately to the affected service and may review or remove them when the traffic pattern no longer creates the relevant risk.

11. Acceptable use, abuse and risk score

The Customer may not use services for unlawful content or conduct, malware, credential theft, unsolicited bulk messaging, attacks, unauthorized scanning, child sexual abuse material, intellectual-property infringement, sanctions evasion, fraud, resource theft, harmful proxying or activity that threatens Phylex, an upstream provider or another person. The Customer must respond promptly to abuse and compliance notices.

The immutable Abuse & Risk ledger may receive case-linked or authorized administrative entries. The effective score is bounded from 0 to 10. At score 10, all eligible account services may be suspended and the account becomes read-only: the Customer cannot purchase, renew, transfer or mutate services and must contact support. Resolution or reversal entries preserve audit history and may restore service only after safety checks. Risk entries are operational controls, not liquidated damages.

12. Suspension, termination and data deletion

### Support queue status and discretionary benefits

Every account has a support queue status. Basic is the standard status. Phylex may manually assign low-priority status for repeated duplicate or spam tickets, abusive, harassing or threatening communications, knowingly false or fabricated claims that materially disrupt support, attempts to bypass queues or misuse support channels, or repeated violations of this Agreement or incorporated policies. Good-faith complaints, substantiated negative feedback, appeals, payment disputes and constructive criticism are not by themselves grounds for low-priority status. The Customer is notified when the status changes and may request a review through support.

Low-priority status affects the order in which future non-urgent support requests are handled. It may also make the account ineligible for a specific discretionary promotion, promo code, certificate, coupon or event when that campaign expressly excludes low-priority accounts. It does not prevent service cancellation, access to legally required support or remedies, security reporting, abuse reporting, or emergency handling based on the actual severity of an incident.

Priority status is a limited discretionary benefit assigned manually to selected accounts with a sustained positive service history. Phylex may consider the number and duration of active services, payment history, absence of unresolved abuse complaints, compliance with the Agreement and constructive use of support. It is not purchased, guaranteed or owed to any Customer and may be reviewed or removed. A campaign may be restricted to priority accounts when its published eligibility rules say so. Basic status is normal and does not indicate lesser customer standing.

Phylex may proportionately restrict an affected service or the account for payment failure, abuse, security threat, legal process, sanctions, fraud, material breach or urgent infrastructure risk. Immediate action is permitted where delay would cause harm. Where reasonable and lawful, notice and an opportunity to cure will be provided. Termination and privacy closure follow the retention and deletion lifecycle; billing, security, abuse, contract and legal records may be retained where required or justified.

The Customer must export data before expiry or termination. Phylex has no obligation to recover deleted data unless a paid backup or mandatory law expressly provides otherwise. Closing an account does not automatically cancel an independently binding unpaid balance, dispute or legal hold.

13. Reseller and white-label services

Approved resellers may offer eligible Phylex services through a branded storefront and set a disclosed markup or customer-facing name. The reseller must accurately identify the contracting parties, prices, support route, privacy information and refund terms and may not weaken Phylex security, abuse or legal controls. Platform promotions do not automatically apply to reseller orders. Reseller API keys and customer relationships are scoped and auditable. Suspension of a reseller does not transfer ownership of its customers’ credentials to unrelated parties.

14. Customer content, licenses and intellectual property

The Customer retains rights in Customer content and grants Phylex and its subprocessors a limited license to host, transmit, reproduce, back up, scan where legally permitted, and otherwise process it solely to deliver, secure and comply with the service. The Customer warrants that it has the rights and lawful basis needed for that content and processing. Phylex retains all rights in the platform, software, branding, documentation and aggregate/de-identified operational information.

15. Privacy, telemetry and monitoring

Phylex processes account identity, contact, authentication, contract, payment, tax, support, abuse, service configuration, IP, security, audit and usage data for contract performance, security, legal compliance and legitimate interests as described in the Privacy/Data Protection Policy. Required processors may include datacenter, network, DNS/CDN, payment, email, monitoring and support providers.

Compliance evidence may include a bank statement issued within the preceding 90 days, company registration and registry documents, director authority and ownership/control records. Customer-uploaded compliance documents are stored in restricted private object storage, are not published through public URLs, and are retained by default as part of the compliance record unless Phylex applies a configured deletion policy or deletion is required by applicable law. Access and manual decisions are auditable.

Production error monitoring is configured to avoid default PII and scrub request bodies, credentials, headers, query strings, user identity and tenant context. Security and operational logs may still record necessary account/service references, source IPs, actions and timestamps. Data-subject requests remain subject to identity verification, third-party rights, fraud prevention, accounting and legal-retention exceptions.

16. Security and vulnerability reporting

Phylex uses technical and organizational safeguards but no Internet service is risk-free. The Customer must patch managed-by-customer systems, restrict administrative access, use MFA, rotate exposed credentials and maintain backups. Security testing is allowed only under an express written authorization or published vulnerability-disclosure program and must not access customer data, degrade production, evade limits or create provider charges.

17. Availability, maintenance and force majeure

Only an expressly published SLA applies. Planned maintenance, emergency security work, upstream failures, DDoS mitigation, Internet routing, customer configuration, force majeure and suspended/expired service may be excluded from SLA calculations where lawful. Phylex will use reasonable efforts to restore service and communicate material incidents.

18. Warranties and statutory conformity

Phylex warrants that paid services will materially conform to the accepted order and any mandatory digital-service conformity rules. Except for mandatory rights and express warranties, services are supplied on an “as available” basis and Phylex disclaims implied warranties to the maximum lawful extent. Support guidance does not replace the Customer’s system administration, legal, tax or security advice.

19. Liability

Neither party excludes liability that cannot lawfully be excluded, including liability for fraud, fraudulent misrepresentation, death or personal injury caused by negligence where applicable, or mandatory consumer/data-protection rights. Subject to that rule, Phylex is not liable for indirect or consequential loss, lost profit, lost opportunity or loss of data that independent tested backups would have prevented.

For claims arising in any rolling twelve-month period, Phylex’s aggregate contractual liability is limited to the fees paid for the affected service during that period, unless mandatory law requires a higher amount. The limitation reflects the service price and does not apply to deliberate misconduct or any category that applicable law forbids limiting.

20. Indemnity for business customers

To the extent lawful, a Customer acting in business indemnifies Phylex against third-party claims, penalties and reasonable costs caused by its unlawful content, infringement, abuse, misuse, breach of authority or violation of this Agreement. This clause does not apply to the extent the loss was caused by Phylex or would impermissibly restrict consumer rights.

21. Notices, customer monitoring duties and evidence

The Atlas Notification Center is the primary operational notice channel for account, billing, renewal, expiry, suspension, maintenance, abuse, security and service-lifecycle information. Email, status pages and other channels may also be used, but email is a secondary convenience channel and successful delivery is not guaranteed. Receiving providers may reject, defer, quarantine or place messages in spam. This can particularly affect Microsoft-operated services such as Outlook, Hotmail and Live, Atomic Mail, and other providers that apply independent filtering or blocking. Phylex actively works to maintain and restore deliverability but does not control a recipient provider or promise that any email will arrive, arrive on time or appear in the inbox.

The Customer must maintain a working verified email address and must review the Atlas Notification Center, service dashboard, balances, invoices, renewal settings and expiry dates regularly and at least once each calendar day while the account or any service remains active. The Customer remains responsible for each service it orders or controls, including payment, renewal decisions, configuration, security, monitoring, backups, data export and action before expiry, suspension or deletion deadlines. Missing, delayed, filtered or rejected email does not by itself extend a payment deadline, renewal date, grace period, suspension date or deletion date shown in Atlas or established by the applicable lifecycle policy.

To the maximum extent permitted by law, Phylex is not responsible for loss caused solely by the Customer's failure to review information made available in Atlas or to act before a displayed or contractually applicable deadline because a secondary email notice was not received. This allocation does not exclude any notice that mandatory law requires Phylex to deliver by a particular method, any non-waivable consumer right, or liability that cannot lawfully be excluded. The Customer should contact support promptly if Atlas information appears inconsistent or inaccessible.

Phylex may change operational policies for security, law, providers or product evolution. A material contractual change requires a new version and acceptance or notice as required by law. Prior signed versions, acceptance timestamps, audit events and document hashes remain retained as evidence; publishing a new version archives rather than deletes them.

Electronic records, service references, immutable ledgers, provider receipts and marked transfer copies are admissible business records to the extent permitted by law, but do not prevent either party from proving an error.

22. Governing law and disputes

This Agreement is governed by the law of England and Wales, without depriving a consumer of mandatory protections of the law of the country in which that consumer habitually resides. The courts of England and Wales have jurisdiction for business disputes, subject to any mandatory consumer forum. Before litigation, the parties should attempt resolution through support and preserve relevant evidence. Nothing limits a right to complain to a regulator or use a mandatory alternative-dispute mechanism.

23. General terms

The Customer may not assign the account or Agreement except through an approved service-transfer mechanism or with written consent. Phylex may assign the Agreement as part of a reorganization or transfer of the relevant business while preserving mandatory rights. If a provision is unenforceable, it is narrowed or severed without invalidating the rest. Failure to enforce is not a waiver. This Agreement and incorporated documents form the entire agreement for the services.

24. Electronic acceptance

By checking the acceptance box during onboarding, contract restoration or version renewal, the Customer confirms that the full text and linked policies were available, requests any selected immediate performance, and electronically signs version v7. The platform records the accepted version and time. The Customer should download or retain a copy.