This policy explains how to report abuse, copyright infringement or unlawful content hosted on infrastructure operated by Xenax Cloud India Private Limited ("Xenax Cloud", "we", "us", "our"), and exactly what we will do when you do. It forms part of our Terms of Service and should be read with our Acceptable Use Policy and Privacy Policy.
Report abuse to abuse@xenaxcloud.com. We acknowledge every report within 24 hours and tell you the outcome.
We are an infrastructure provider. We do not create, select, review or edit what our customers host. That shapes what we can do about a complaint, and Section 2 sets out those limits.
Send everything to abuse@xenaxcloud.com. We do not operate a separate form, and a plain email is fine. Please include:
| What | Why we need it |
|---|---|
| Exact URL or IP address | Not a domain, not a range. We have to be able to find the specific thing you are complaining about, and we will not go looking through a customer's account for it. |
| Date and time, with timezone | Our logs are in IST. Without a timestamp we often cannot match a network complaint to an event. |
| Evidence | Full message headers for email abuse; log extracts for network abuse; screenshots or archived copies for content, since content changes. |
| What you say is wrong | Tell us which law, or which part of our Acceptable Use Policy, you say is being broken. |
| Your name and contact details | Acting on a report means taking a paying customer's service down. We must be able to stand behind that decision, and to come back to you with questions. |
Two exceptions to the identity requirement. We act on reports of child sexual abuse material, and of non-consensual intimate imagery, nudity, a sexual act or impersonation including morphed or artificially generated images, whether or not you tell us who you are, and whether you are the person depicted or someone acting on their behalf. Rule 3(2)(b) of the IT Rules, 2021 gives us 2 hours to act on the second category, running from receipt of the complaint. Reports in these two categories are not treated as incomplete for want of any of the items listed above.
We provide servers, storage and network capacity. We do not select, review, edit or endorse what our customers put on them, and we do not routinely look. We are an intermediary under Section 2(1)(w) of the Information Technology Act, 2000, and our protection from liability for what our customers do comes from Section 79 of that Act, conditional on the due diligence required by the IT Rules, 2021.
Four consequences follow:
Before reporting, please check that the content is actually hosted on our network, a WHOIS or reverse-DNS lookup usually settles it. A great many reports reach us about domains for which we are only the DNS provider or the registrar's reseller, and not the host.
If we are not hosting the content, we will tell you so and, where we can identify it, point you to the provider who is. We will not ordinarily suspend a domain or remove DNS records to take down content hosted elsewhere, that is a disproportionate remedy which takes an entire business offline over one page, and it is not ours to apply. Domain-level action is otherwise taken only on an order of a competent Indian court, or of the relevant registry or registrar under its own dispute policy.
Two exceptions. Where we are the registrar's reseller or the DNS provider for a domain and the content it resolves to is child sexual abuse material or an active phishing operation, we will act at the domain or DNS level even though the hosting is elsewhere. Our duty to report child sexual abuse material under the Protection of Children from Sexual Offences Act, 2012 does not stop at the boundary of our own servers, and continuing to resolve a live phishing domain is a form of assistance we are not prepared to give.
Indian copyright law provides a notice-and-takedown procedure in the proviso to Section 52(1)(c) of the Copyright Act, 1957, read with Rule 75 of the Copyright Rules, 2013. That procedure is framed around transient or incidental storage, and whether it applies of its own force to persistent web hosting has not been settled by the Indian courts; our protection as a host rests on Section 79 of the Information Technology Act, 2000 and the due diligence in the IT Rules, 2021.
We apply the Rule 75 procedure to copyright complaints as a matter of policy. It is the framework Indian law provides, it gives a rights holder a fast interim remedy, and it gives our customer a defined route back.
Rule 75 requires a complaint to set out, in writing:
Please also give your name, address and contact details, and state that the information is accurate.
The 21 days is a maximum, not a minimum. Rule 75(3) requires us to refrain from facilitating access for 21 days or until a court order arrives, whichever is earlier, and Rule 75(5) is permissive.
So where our customer produces clear evidence that the complaint is unfounded, a licence or assignment covering the work, proof that they are the author, or proof that the complainant is neither the owner nor an exclusive licensee, we may restore access before the 21 days expire. We will tell the complainant when we do, and why. We do not do this on assertion; we do it on documents.
If you give the undertaking and then do not file, Rule 75(6) relieves us of any obligation to respond to a further notice from you concerning the same work at the same location, and we will rely on it. Repeated use of the procedure without ever going to court is treated under Section 14 as bad-faith reporting.
Most complaints we receive are not in Rule 75 form, most often because they are drafted for United States law and omit the 21-day undertaking, the ownership particulars, or both. In that case:
The Digital Millennium Copyright Act is United States legislation and it does not govern us. We are an Indian company, our infrastructure is in India, and the statute that applies to copyright complaints about content stored here is the Copyright Act, 1957.
We accept notices in DMCA form as a courtesy, because many rights holders and their agents work from DMCA templates. A DMCA notice is handled under Section 4.6 above, not Section 4.3.
Adding the 21-day undertaking to a DMCA notice gets you closer, but it does not by itself make the notice Rule 75-compliant: Rule 75 also requires the ownership particulars in Section 4.2(2) and the statement in 4.2(3) that no permitted use applies, neither of which appears in a standard DMCA notice. Tell us you want the Rule 75 procedure and we will tell you exactly what is still missing.
Nothing in this policy is a representation that we operate a DMCA safe-harbour programme, that we maintain a designated agent under 17 U.S.C. §512, or that DMCA counter-notification procedures apply here.
If we disable your content following a copyright complaint, you may send us a written counter-statement at abuse@xenaxcloud.com. Tell us why you say the material is not infringing, that it is your own work, that you hold a licence or assignment, that the use falls within fair dealing under Section 52 of the Copyright Act, 1957, or that the complainant has identified the wrong material.
We will acknowledge it within 24 hours and tell you our view within 7 days. What it does and does not do:
A strike under Section 7 does not attach merely because a complaint was made. Section 7 sets out when one does.
We forward the substance of a complaint, the work claimed, the URL, the nature of the allegation, so that you can answer it. We do not disclose the complainant's name or contact details to you unless we are legally required to.
This is a limited protection, not a permanent one. Rule 75 requires the complainant to sue within 21 days, and if they do, you will be named and will learn who they are through the proceedings.
A copyright complaint counts as a substantiated violation, and therefore as a strike, where any of the following is true:
A complaint does not count as a strike where the complainant produced no court order and the content was restored, or where the customer produced a licence or other satisfactory answer.
Strikes run under the same system as every other violation, Section 12.3 of the Acceptable Use Policy: a rolling 12-month window, three live strikes, then permanent termination of all services without refund.
Indian law provides no notice-and-takedown mechanism for trademarks equivalent to Rule 75, and trademark questions, similarity, class, territory, honest concurrent use, nominative fair use, are exactly the kind of question a hosting provider is not equipped to decide.
We act on a trademark complaint only on an order of a competent Indian court, or where the content independently breaches our Acceptable Use Policy. Two categories usually do: a page impersonating a brand in order to deceive is phishing, prohibited under Section 2.5 of that policy and treated as severe under Section 13 below; and a storefront selling counterfeit goods is prohibited under Section 2.5 as a fraudulent or deceptive commercial operation.
Send us the complaint anyway. We will forward its substance to our customer, which resolves a good many disputes without anyone going to court, and we will tell you the outcome.
Whether a statement is defamatory, and whether a defence applies, is a judicial question. Following Shreya Singhal v. Union of India, an intermediary's obligation to remove content under Section 79(3)(b) of the Information Technology Act, 2000 arises on a court order or a notification by an appropriate government agency: not on the say-so of the person who objects to it.
We act on a defamation complaint only on such an order. We will forward the substance of your complaint to our customer, tell you that we have done so, and tell you the outcome. We will not take a website down because someone has written something about you that you dispute.
Please do not re-label it. The 36-hour grievance route in Section 19 covers requests to remove content falling within Rule 3(1)(b) of the IT Rules, 2021, which includes categories such as misinformation and gender-based harassment. It is not a way around this Section. Where a complaint is in substance a defamation claim, a dispute about whether something said about you is true or fair. We will treat it as one and ask for a court order, whichever rule you cite.
If your complaint is that a customer's website or service holds, publishes or processes your personal data unlawfully, note that in almost every such case our customer is the Data Fiduciary and we are only their processor: they decided what to collect and why, and only they can act on it. Section 3.2 of our Privacy Policy explains this split.
Please direct your request to the website operator in the first instance. If you cannot identify or reach them, write to grievance@xenaxcloud.com and we will forward your request to our customer and tell you that we have done so. Rights requests under the Digital Personal Data Protection Act, 2023 concerning data we hold about you are handled under Section 17 of the Privacy Policy, within 30 days.
Doxxing, published breach databases, stalkerware and the sale of personal data are separately prohibited under Section 2.8 of the Acceptable Use Policy, and we act on those directly.
Report it immediately to abuse@xenaxcloud.com with "CSAM" in the subject line. You do not need to identify yourself and you do not need evidence in any particular form.
We remove it, terminate the customer immediately and permanently without notice and without refund, preserve the material and all associated records as evidence without vitiating them, and report the matter to the police or the Special Juvenile Police Unit and through the National Cyber Crime Reporting Portal. There is no warning stage, no 21-day window and no reinstatement.
The relevant law is Section 67B of the Information Technology Act, 2000, and the Protection of Children from Sexual Offences Act, 2012: Section 19 of which places a duty to report on any person with knowledge that such an offence has been or is likely to be committed, Section 20 of which places a specific duty on personnel of media, studio and photographic facilities, and Section 21 of which makes failure to report punishable.
Content that exposes a person's private area, shows them in full or partial nudity, depicts them in a sexual act, or impersonates them, including morphed and artificially generated images: is removed within 2 hours of a complaint, as Rule 3(2)(b) of the IT Rules, 2021 requires. The complaint may come from the person depicted or from anyone acting on their behalf, and may be anonymous.
Please tell us the exact URL. We act on the specific content identified. Where a service exists substantially for this purpose we will suspend the whole of it, and treat the matter as a severe violation under Section 12.1 of the Acceptable Use Policy.
On receiving an order of a competent Indian court, or a notification by an appropriate Indian government agency under Section 79(3)(b) of the Information Technology Act, 2000, we remove or disable access to the identified information within 3 hours, as required by Rule 3(1)(d) of the IT Rules, 2021 as amended with effect from 20 February 2026.
For an order or notification to be actionable it must identify the specific information or URL. A government intimation must be issued by an officer not below the rank of Joint Secretary to the Government, or an officer equivalent in rank, and in the case of a police authority not below the rank of Deputy Inspector General of Police, and must identify the legal provision relied upon. We will ask if any of this is missing; asking does not stop the 3-hour clock, so please send a complete order the first time.
Where a lawfully authorised agency orders us to provide information or assistance, we furnish it within 72 hours of receiving the order, as Rule 3(1)(j) requires. Where a report discloses a cyber security incident of a kind CERT-In requires us to report, we report it within 6 hours under the CERT-In Directions dated 28 April 2022, so a phishing or malware report you send us may also become a regulatory filing.
We act on orders of Indian courts and Indian authorities. Under Section 44A of the Code of Civil Procedure, 1908, only a decree of a superior court of a reciprocating territory under which a sum of money is payable can be executed directly in India, an injunction or takedown order cannot. A foreign order of that kind requires a fresh suit on the judgment in an Indian court, where it may be resisted on the grounds in Section 13 of that Code.
Acting on a foreign order without that step would mean taking down our customer's service with no legal duty to do so, which exposes us to them. This does not stop you reporting the underlying content: if it breaches our Acceptable Use Policy or Indian law, we will act on that basis, no order required.
These do not need a court order and do not need you to be a rights holder. If our network is the source of the problem, tell us and we will deal with it. Our response follows the severity tiers in Section 12.1 of the Acceptable Use Policy.
| Type | What to send | What we do |
|---|---|---|
| Spam | Full message headers, not a forwarded copy. Headers are what let us identify the sending account. | Suspend outbound mail immediately on detection under Section 8.5 of the AUP, and require the customer to find and fix the cause before restoring. Serious band. |
| Phishing | The exact URL, and the brand being impersonated | Immediate suspension or removal without prior notice. Severe band. Phishing is live harm and we do not wait. |
| Malware, C2, exploit kits | URL or IP, and any sample hash or scanner reference | Immediate suspension or null-routing without prior notice. Severe band. |
| DDoS or attack traffic from our IPs | Target IP, source IP, timestamps with timezone, and flow or firewall logs | Investigate against our own flow records, then null-route or suspend the source. An attack originating from a customer's service is in the Severe band. |
| Port scanning, brute force | Log extracts showing source IP and timestamps | Where the activity is an attack originating from our network, Severe band, immediate suspension. Isolated or low-volume probing that appears to be misconfiguration rather than attack is handled in the Serious band, with a deadline to fix. |
| Open resolvers, relays, reflectors | IP address and the service concerned | Require the customer to remediate within a stated deadline. Serious band. |
All of these are prohibited under Sections 2 to 4 of the Acceptable Use Policy.
The following are not acted on:
Blocking a sender never applies to a report of child sexual abuse material or non-consensual intimate imagery, or to a court order or government notification. Those are read and acted on whoever sends them.
Declining to act is not a view on the merits. It usually means the complaint has not been put in a form that lets us act lawfully. We will tell you which it is.
When we act on a complaint, our customer is told what was reported, what we did, and what they need to do. Depending on severity, that means the reported content is disabled, the service is suspended, or the account is terminated, the tiers are set out in Section 12.1 of the Acceptable Use Policy.
Where the outcome is suspension, Section 8.2 of the Terms of Service applies: the service is terminated and all Customer Content and backups are permanently deleted 3 days after suspension. Where a severe breach leads us to terminate immediately without a suspension stage, deletion happens on termination.
Deletion is held while an appeal is live. If you appeal to the Grievance Officer under Section 20 before the deletion falls due, the deletion clock stops until the appeal is decided. This hold does not apply where the law requires removal, or in the severe categories in Section 12.1 of the Acceptable Use Policy.
Customers can respond, appeal and be reinstated, Sections 12.2 and 13 of the Acceptable Use Policy.
Every customer is contractually required to maintain a working email address that is not hosted on a domain hosted with us, and to keep their contact details current, Section 3.2 of the Terms of Service. This obligation is not merely administrative: direction (v) of the CERT-In Directions dated 28 April 2022 requires us to maintain validated address and contact details for every subscriber.
So where a notice bounces or a customer does not respond:
Some of our customers resell our services under their own brand. Where a complaint concerns content on such a service, our records identify the reseller as the responsible customer, and we deal with the reseller.
On a Serious-band matter we notify the reseller and give them 48 hours to respond and begin remediation, and we may act on the service if the problem is not resolved within 72 hours: a longer window than a direct customer gets, because the reseller has their own client to reach. Section 21.1 of the Terms of Service sets this out.
That window does not apply where a statutory clock is running. The deadlines in Section 11.3 above, 2 hours, 3 hours, 36 hours, and the 36-hour Rule 75 copyright deadline in Section 4.3, bind us regardless of anything we have agreed with a reseller. Where one of them applies we act within it and notify the reseller afterwards. Rule 3(1)(b) removal requests and copyright complaints are Serious-band matters, so this qualification does real work: a reseller does not get 48 hours on a complaint we must act on in 36.
Severe matters carry no window for anyone. Child sexual abuse material, non-consensual intimate imagery, active phishing, malware distribution and attacks originating from the service are suspended or null-routed immediately and without notice, whether the customer is a reseller or not. Several of them carry statutory deadlines as short as two hours, and no contractual window can extend those.
We do not ordinarily contact a reseller's own clients directly, and we do not disclose a reseller's client list to complainants. In an emergency, the severe categories in Section 13 and Section 11. We may contact an end client directly if we can identify them, as Section 21 of the Terms of Service permits. Resellers are required to maintain records identifying each of their end clients and to furnish them to us within 24 hours of our request.
Where we remove or disable access to information following a complaint, a court order or a voluntary decision, we preserve that information and the associated records without vitiating the evidence, for 180 days, or longer where a court or a lawfully authorised agency requires it. This is required by Rule 3(1)(g) of the IT Rules, 2021.
Preserved material is held under restricted access and is used only for investigation and legal purposes. It is not provided to a complainant, and it is not provided to the customer where doing so would prejudice an investigation. Section 15 of the Privacy Policy covers retention generally.
| Type of report | Our deadline |
|---|---|
| Acknowledgement of any report | 24 hours |
| Child sexual abuse material | Immediate |
| Non-consensual intimate imagery, nudity, a sexual act, or impersonation including morphed or artificially generated images | 2 hours from receipt |
| Order of a competent Indian court, or notification by an appropriate government agency | 3 hours |
| Active phishing, malware distribution or attack traffic | Immediate, without prior notice |
| Request to remove other content falling within Rule 3(1)(b) of the IT Rules, 2021 | 36 hours |
| Copyright complaint complying with Rule 75 | 36 hours to disable; restored after 21 days absent a court order, or earlier under Section 4.4 |
| Information or assistance ordered by a lawfully authorised agency | 72 hours |
| Any other complaint | Resolved within 7 days |
| Request under the Digital Personal Data Protection Act, 2023 about data we hold | 30 days: see Section 17 of the Privacy Policy |
Where a report is incomplete, the clock for the last two rows runs from when we receive what we asked for. The statutory deadlines above run from receipt of the complaint and are not extended by our asking for more information.
For content within Rule 3(1)(b), the 36-hour deadline is ours and we meet it ourselves. We do not wait for the customer's response window to expire before acting.
If you are a customer and you think we have got a decision wrong, or you are a complainant and you think we have wrongly declined to act:
Section 15 explains how an appeal affects the deletion of your data.
We do not currently publish a transparency report. We may publish periodic aggregate statistics about the reports we receive and the action we take, how many complaints, in what categories, and how they were resolved, and any such report would contain aggregate numbers only and would not identify a customer, a complainant or any individual. We make no commitment as to whether or when we will start.
Separately and regardless of the above, we tell every complainant the outcome of their own report, and we tell every customer what was reported about them and what we did.
| Abuse and copyright reports | abuse@xenaxcloud.com |
|---|---|
| Grievance Officer and appeals | Mr. Sanket Tripathi, grievance@xenaxcloud.com |
| Technical support | support@xenaxcloud.com |
| Billing | billing@xenaxcloud.com |
| Postal address | Xenax Cloud India Private Limited, H. No. 17, Jyoti Nagar, Fatehpur Road, Banda - 210001, Uttar Pradesh, India |
An email to abuse@ is enough for an abuse report, but it is not service of a legal notice. As Section 16.3 of the Terms of Service requires, a formal legal notice must be sent in writing to the registered office above, with a copy by email to grievance@xenaxcloud.com.
We use analytics cookies to understand how the site is used so we can improve it. These load only if you accept. The cookie that keeps your session working is always on and needs no consent. Read our Privacy Policy.
