Acceptable use

3.1Who this policy covers

This policy applies to every customer, every person who uses a customer's lines, and any software, script or agent that uses them. The customer is responsible for all use of its lines. This policy is part of the terms.

3.2The rule: who a line serves

A line may receive verification codes only for:

1. Aan account, service, domain or app the customer owns or operates;
2. Ba service whose operator has given the customer written permission to test it, with a copy given to Ostra;
3. Cthe number Ostra issued to the customer.

Anything else is outside what a line is for. That includes signing up a real person who agrees to it on a service the customer does not operate: the service is checking whether the number belongs to that person, and an Ostra line belongs to Ostra's customer.

Each line carries one of these bases, stated in its attestation (2.4). A site that 3.5 blocks by default opens on a line only for a service named there, once a person at Ostra approves it.

3.3Inbound only

A line receives texts and calls. It never texts or calls anyone, and Ostra offers no way to do either from a line.

The one exception is Apple’s activation message: each time iMessage is turned on or activated again, the iPhone sends Apple a registration message, which the carrier may bill. It goes to Apple, never to a person.

Calls to a line are forwarded to Ostra, which rings the Ostra iPhone app and the dashboard and keeps each call as 5.4 describes.

3.4What a line is never used for

1. 1Creating accounts on a service you don't own or operate, including on behalf of a real person who agrees to it.
2. 2Buying or selling codes, in bulk or one at a time, or using a line as a source of codes for anyone else.
3. 3One line serving more than one person or organization.
4. 4Verifying an account again after a service banned or suspended it.
5. 5Automating a carrier's website or app.
6. 6Asking Ostra for a number that "works on" a named consumer service.
7. 7Defeating a website's or carrier's fraud, bot or account-creation controls.
8. 8Spam, fake engagement or fake reviews.
9. 9Scanning, load testing or attacking systems you don't own and have no written permission to test.
10. 10Anything unlawful, including fraud, harassment and access to systems without permission.
11. 11Using a line from a place Ostra refuses (3.5), or for anyone on the US sanctions lists, or using another service to get around that refusal.
12. 12Reaching a service again after its operator told you, or told Ostra, to stop, whether through a new carrier IP, another line or another account.

3.5What Ostra blocks on every line

• Outgoing mail ports 25, 465 and 587, and ports 8100 and 9100.
• Private and internal network addresses.
• By default, the websites of major US banks and brokerages, person-to-person payment apps, federal and major state benefit and tax portals, and major ticketing platforms, each as a whole site and not only its login, payment or checkout pages. A blocked site opens on one line only when its service is named in that line’s attestation and a person at Ostra approves the exception. Never for ticketing.
• Connections to a line from places under comprehensive US sanctions: Cuba, Iran, North Korea, and in Ukraine, Crimea with Sevastopol and the Donetsk and Luhansk regions. A connection from an address Ostra cannot place is refused too. Each refusal is logged with the time, the line, the address and its country.

3.6A new carrier IP

You can ask for a new carrier IP on a line from the dashboard or the API, at most once every 5 minutes and 24 times in any 24 hours. If requests through a line are much slower after one, the next waits an hour. A request past these limits is refused with the time the next one is allowed. The phone reconnects to its carrier, which assigns the address; it can be the same one as before. Ostra never changes a line's address on a schedule.

Asking for a new carrier IP to reach a service that has blocked you or your line breaks this policy (3.4).

3.7Enforcement

Ostra may suspend a line at once when it sees use that breaks this policy, when a report gives reason to believe it does, or when a carrier or the law requires it. Serious or repeated breaches end the account. For a smaller breach Ostra warns you first. Each warning, suspension and ending is recorded.

A person at Ostra reads every notice from a service’s operator that a customer may no longer use its service. Ostra can then suspend the line, add the service to the blocked sites in 3.5, or end the account.

When a line's exit address appears on a public blocklist or abuse list, the alert reaches Ostra's abuse desk before it reaches the customer. While a case is open, Ostra keeps the line's records under a hold so scheduled deletion does not remove them.

Send copyright complaints to abuse@ostranetwork.com. A notice must include:

• your physical or electronic signature;
• the copyrighted work you say is infringed;
• the infringing material or activity, with the address you saw, the date and time, and the destination, so Ostra can find the line;
• your name, address, telephone number and email;
• a statement that you believe in good faith the use is not authorized by the copyright owner, its agent or the law;
• a statement that the notice is accurate and, under penalty of perjury, that you are the owner or are authorized to act for the owner.

Ostra ends the lines and the account of a customer who infringes copyright repeatedly.

3.8Report abuse

Email abuse@ostranetwork.com. A person at Ostra reads every report.

What to include

• The address you saw, and the port if you have it.
• The date and time, with the timezone.
• The destination: the host name or the URL.
• What happened, and any logs you can share.

Ostra matches the address and time against its connection records to find the line and its customer.

Ostra replies to a report within 1 business day, and suspends a line that is clearly abusive within 24 hours.

3.9Law enforcement

Send legal process and preservation requests to abuse@ostranetwork.com with "Legal process" in the subject. Ostra accepts process served this way.

What Ostra holds

• Sign-up records for each customer: the legal name, the US address, the verified mobile number and email, where the sign-up came from, and the sanctions screen's result.
• Connection records for each line: time, line, the address each connection came from, destination host and port, and bytes. Kept 90 days. No traffic content.
• Texts and calls received on a line, encrypted at rest and kept 30 days by default. The code Ostra reads from a text is cleared after 15 minutes.

Preservation

On a preservation request, Ostra places a hold that stops scheduled deletion of the named records until the request ends.

Disclosure

Ostra discloses customer records in response to valid legal process. In an emergency involving danger of death or serious physical injury, describe the emergency in the request; Ostra can disclose records as the law allows.

Ostra gives the content of a text or call only to the customer, or to a government agency with a warrant; a civil subpoena does not reach content. Ostra confirms an emergency request by calling the agency back at a number it finds itself.

Ostra answers a subpoena, court order or warrant that is valid and served as above. Before it discloses a customer’s records, Ostra tells the customer, unless the law or a court order forbids it. Ostra answers an emergency request from law enforcement the same day.

3.10Changes to this policy

When this policy changes, the date at the top changes and customers are told by email.