Types of warnings
If our compliance systems flag activity on your server, you receive an email from info@oneclickclaw.io. There are three levels:
- Soft warning (Level 1). We saw something unusual, want you to know, and ask you to investigate. Your server keeps running.
- Strong warning (Level 2). We saw something more serious. Your server keeps running for now, but you have 24 hours to respond before it may be suspended.
- Suspension. Your server is stopped immediately. You have 7 days to appeal before the account may be terminated and data deleted, per Terms of Service section 13.
What triggers a warning
The most common triggers are:
- Outbound port scanning or connection floods.
- Connections to known malicious IP addresses.
- Patterns consistent with cryptomining or botnet activity.
- Hosting content that violates the Acceptable Use Policy.
- An external complaint, DMCA notice, or law enforcement request.
What to do if you get one
1
Read the email carefully
It explains the alert, the evidence, and the relevant Terms of Service clause. Do not ignore it.
2
Check your server
If you have SSH access enabled, log in and inspect running processes, recent logins, and any unfamiliar files. If you do not have SSH, download a Diagnostic Bundle from the dashboard and review it.
3
Reply to the email
Tell us what you found. If the activity was your own, explain it. If it looks like compromise, say so and rotate every credential (account password, AI provider keys, SSH keys).
How to appeal
Reply to the warning or suspension email within the deadline (24 hours for Level 2, 7 days for suspension). Include any evidence, logs, or context that supports your case. Keep the tone factual.
After the appeal
We respond with one of three outcomes: warning lifted (no further action), warning kept on file (server keeps running, but a future repeat may escalate faster), or termination upheld. The decision and the reasoning are sent in writing.