Acceptable use

Acceptable use policy

What you may and may not do with silken. It is short on prohibitions that apply to every service and long on the one thing that makes this service different: silken fetches from, and writes to, addresses you name.

Last updated 5 October 2026Read the terms of service

Scope

What this covers.

Part of the agreement, and the operative statement of conduct.

01 / Scope

This policy is part of the terms of service and applies to everyone who uses silken — through the API with a key, through the dashboard, or, if you buy through AWS Marketplace, through that subscription. Section 07 of the terms summarises it; this page is the full statement, and where the two differ this page governs.

You are responsible for use of your account and your keys, including by anyone you give them to. If you build a product on silken, the conduct of your own users is your responsibility to control, and "a customer of mine did it" is not an answer we can act on: silken has no relationship with them and no way to reach them.

The company enforcing this policy is Velvet Software Limited, Dublin, Ireland. What a breach leads to is section 06.

Content

Content you may not process.

silken converts a file. It does not care what is in it, and that is exactly why this list exists.

02 / Content

Do not submit, or direct silken to fetch, any of the following.

Material that sexually exploits or abuses children. This is the one item on the page with no notice, no cure period and no discussion: we act on it immediately, we report it, and the account ends. Section 10 of the terms names this as an exception to the notice-and-cure rule for that reason.
Content you do not have the rights to process. You must own the video or be licensed to use it — section 05 of the terms is the warranty you give when you submit a URL. A rights holder who believes otherwise is directed to the copyright policy, which is honest about the narrow thing silken is able to do.
Content that is unlawful where you are or where we operate, or whose processing is. This includes material whose distribution is prohibited, and material you are subject to a court order about.
Content that infringes privacy or publicity rights — including recordings of people made where they had a reasonable expectation of privacy, and non-consensual intimate imagery.
Content used to build a system for covert surveillance or identification of people without their knowledge. silken produces no derived media — no frames, no fingerprints, no embeddings — but it can be one step in a pipeline that does, and that use is not permitted.

silken does not inspect your video for this list. It reads the technical properties it needs to convert a file correctly. The prohibitions above are obligations you accept, not filters you will be caught by, and section 06 says what that means in practice.

Addresses

The addresses you may point us at.

The clause this policy exists for.

03 / Addresses

A job is an instruction to make an HTTPS request on silken's behalf to a URL you chose. That is a capability, and it is the capability most likely to be misused.

You may point silken only at storage you control, or that you have permission to read from and write to. Everything below follows from that sentence and is spelled out because a general rule is easy to read past.

Do not use the service to probe, scan, enumerate or map a host, a network or a service. Submitting URLs in order to learn what answers is a scan whether or not you call it one, and the timing and error text of a refusal is information you are not entitled to gather this way.
Do not use the service to reach a network that is not reachable from the public internet — an internal service, a private range, a loopback address, a cloud provider's instance-metadata endpoint, or anything behind them.
Do not use the service to generate load against a third party, whether as a denial-of-service attempt, a traffic amplifier, or a way to make requests appear to originate from us.
Do not submit a URL you were not entitled to sign or to obtain, and do not direct a write to an object you do not have permission to overwrite.
Do not use the service to evade a block — a geographic restriction, a rate limit, a robots directive or an access control imposed by whoever holds the content.

What the service refuses on its own

Some of the above is enforced in software rather than on trust, and it is worth knowing which. A submitted URL must be HTTPS, and the address it resolves to must be ordinary public unicast space. Loopback, private ranges, link-local addresses — which includes the one cloud providers answer metadata requests on — multicast and unassigned space are refused. The check runs at connect time rather than when the job is submitted, and again on every redirect, so a hostname that resolves publicly once and privately a moment later is refused too.

A refusal is not a scoreboard. The guard exists to make an attack fail, not to define the boundary of what is allowed: attempting any of the things in the list above breaches this policy whether the guard stopped it, whether it succeeded, and whether you believed it would work. Do not treat "it returned an error" as permission to keep trying.

The service

The service, its limits, and other customers.

The limits are a shared resource, not an obstacle.

04 / Integrity

Do not work around the operating limits. The request rate, the concurrent-job limit and the monthly spend cap are enforced against your account, so spreading work across several keys does not raise them and is not intended to. Neither is opening further accounts.
Do not farm the free allowance or the sample. The monthly free minutes are per account, and the promotional conversion is one per account. Opening multiple accounts to collect either is a breach, and it is the breach most likely to be noticed, because the accounts look identical from the inside.
Do not attempt unauthorised access — to the service, to another customer's jobs, usage, keys or invoices, or to the infrastructure any of it runs on. Do not attempt to interfere with another customer's work.
Do not reverse-engineer, decompile or attempt to extract the conversion engine or its tuning, and do not present silken's behaviour as your own service's guaranteed behaviour. Paid Standard and Fast include the 99.5% monthly API availability SLA; enterprise 99.9% applies by order form. Economy and free usage have no SLA. Do not promise your customers service levels beyond your agreement with silken.
Do not use the service in a way that puts us in breach of our own obligations — to our payment provider, to AWS Marketplace, or to the providers whose networks the traffic crosses.

None of these prohibits ordinary heavy use. Running at your limits, all day, every day, is what the limits are for; ask us if you need higher ones — section 07 says how.

Research

Security research.

Welcome, within a boundary this page draws rather than leaves to judgement.

05 / Security

Security research is welcome. If you find a way to make silken do something it should not, we want to know, and we would rather hear it from you.

Test against your own account and your own storage. Not another customer's account, not another customer's data, and not a third party's host.
Stop at proof. Demonstrating that a boundary can be crossed is the finding; crossing it further, reading data that is not yours, or persisting access is not.
Do not run denial-of-service or load tests against the production service, and do not use the URL-fetch path to test somebody else's infrastructure.
Report it before you publish it, and give us a reasonable chance to fix it.

Report a finding as section 07 describes. Research kept inside those lines is not a breach of this policy, and we will not treat it as one.

This invitation is not a legal undertaking, and no bounty is offered. Questions about disclosure arrangements can be sent to the address in section 07.

Consequences

What we do about a breach.

How a report is handled, and what follows.

06 / Enforcement

A breach of this policy is a breach of the terms, and section 10 of the terms is what happens next.

In summary: we tell you first and give you a reasonable opportunity to put it right, except where the conduct or a legal obligation makes that impossible — child sexual abuse material, an active attack, or an order we have to comply with.

What a suspension does is refuse new jobs. It does not stop a job already running, it does not reach the converted files already written to your storage, and it does not delete anything. Hosted outputs and demonstration uploads follow the retention periods in the privacy policy.

How a report is handled

Reports are handled by our team. silken does not inspect the content of the video it converts; a breach comes to our attention because somebody tells us, or because an operator notices something, and it is judged by a person reading the report.

For outputs written to your storage, only you or your storage provider can remove the delivered copy. For media hosted by silken, include the silken playback or download address and any job identifier in your report so we can identify the hosted asset and assess the appropriate action. We may also restrict further processing through the account.

The copyright policy describes the same position for rights holders.

Acknowledgement of a report, records of repeat breaches, any appeal and the reasons given for a suspension are handled case by case by our team.

Reporting

Reporting abuse.

One address, and the two things that make a report actionable.

07 / Reporting

Report abuse of silken, or ask for higher limits, at support@silken.io. Report a security finding at the security address on the contact page, which is separate so that it is not queued behind other mail.

Two things make a report actionable. A job id, if you have one, because that is what identifies work inside silken; and the destination URL or the account email, if you do not. A report naming only a video, or only a website it appears on, is hard to act on: silken looks up jobs and accounts rather than content. For media hosted by silken, include the playback or download address.

A copyright notice is not an abuse report and has its own required form. Send one as the copyright policy describes. Anything else — a question about a job, a bill or an account — is on the contact page.