# Reporting abuse

How to report an app on Deplane that hosts phishing, malware, spam, or other abuse, and what happens next.

Apps on Deplane have addresses like `https://NAME.deplane.dev`. If one of them is harmful, tell us. You do not need a Deplane account.

## How to report

Use any of these:

- The web form at https://login.deplane.cloud/abuse.
- Email abuse@deplane.cloud. Include the full URL, what is wrong, and any evidence.
- The API, described below.

Give your email address if you want us to reply. It is optional: you can report anonymously. We never show the reported customer who reported them.

For security vulnerabilities in Deplane itself, email security@deplane.cloud instead. See [Security](security.md#report-a-vulnerability).

## Report through the API

Send a JSON object to `POST https://api.deplane.cloud/v1/abuse-reports`. No login is needed.

```sh
curl -X POST https://api.deplane.cloud/v1/abuse-reports \
  -H 'Content-Type: application/json' \
  -d '{
    "url": "https://pay-verify-01.deplane.dev/login",
    "category": "phishing",
    "details": "This page copies our bank login form and asks for card numbers.",
    "email": "security-team@example.org"
  }'
```

| Field | Required | What it is |
|---|---|---|
| `url` | Yes | The full http or https address of the page you are reporting, at most 2048 characters. |
| `category` | Yes | One of `phishing`, `malware`, `spam`, `csam`, `copyright`, `illegal`, or `other`. |
| `details` | No | What is wrong, in your words, at most 5000 characters. |
| `email` | No | Where we can reach you. Leave it out to report anonymously. |

The API answers `202 Accepted`:

```json
{
  "id": "abr_2k7j4h9g1f6d3s8a5p0o1q2w",
  "status": "received",
  "message": "Thank you. We acknowledge every report within 24 hours. Quote this ID if you write to abuse@deplane.cloud."
}
```

The answer is the same whether or not the address belongs to a Deplane app. Each IP address can send 3 reports per hour. Errors use the codes [invalid_report_url](errors.md#invalid_report_url), [invalid_category](errors.md#invalid_category), [report_too_long](errors.md#report_too_long), and [rate_limited](errors.md#rate_limited).

## What happens next

1. We acknowledge every report within 24 hours.
2. We look at the app and the evidence. Reports of child sexual abuse material and active phishing come first.
3. If the app breaks the [Acceptable use policy](acceptable-use.md), we suspend it, and the whole organization when needed.
4. We keep evidence of what we found, for law enforcement and for appeals.
5. If you gave an email address, we tell you the outcome.

Where the law requires it, we report illegal content to the authorities, and we send the customer a statement of the reasons for our decision.

## If your app or organization is suspended

Suspension stops harm quickly without deleting anything.

- **A suspended app** runs zero instances, so its URL stops answering. It cannot be deployed, scaled, or changed. Its releases, settings, and secrets are kept.
- **A suspended organization** has all its apps at zero instances. Every token of the organization stops working, so the CLI and the API answer [account_suspended](errors.md#account_suspended).

When a suspension is lifted, apps start again with the settings they had.

## Appeal

If you think we got it wrong, email support@deplane.cloud from your account's email address. Say which app or organization it is and why the decision should change. A person reviews every appeal and answers with the outcome and the reasons.