Tablemere — Acceptable Use Policy
Version: 2026-09-19-draft
Effective: [effective date]
Part of the Terms of Service of Tablemere SL.
DRAFT for lawyer review. Not yet in force. See
legal/README.md.
This policy says what may not be done with the Service and what the operational limits are. It exists because every customer shares the same catalog software and, today, the same host: one customer's abuse is every customer's outage.
1. You may not use the Service to
- store, process or distribute content that is unlawful under Spanish or EU law, or that infringes someone else's rights (copyright, trade secrets, personality rights, data protection);
- store personal data you have no lawful basis to process, or special-category data (Art. 9 GDPR) without the safeguards the GDPR requires of you as controller; the Service is not designed for health, biometric or criminal-record data and we have not assessed it for those;
- attack the Service or anyone else from it: probing or scanning other tenants' warehouses or buckets, trying to defeat the catalog isolation, credential guessing, denial of service, or using the Service as a relay or command-and-control for malware;
- resell or sublicense the Service, or run it as a hosting service for third parties without an agreement with us;
- use the Service to send unsolicited mail or to host phishing or malware payloads, including in the blob (file) bucket that accompanies each warehouse;
- circumvent the free-tier limit or the operational limits below by creating multiple accounts or organisations for the same use;
- impersonate another person or organisation, including by claiming an email domain you do not control.
2. Security research
You may test the security of your own warehouses and credentials. You may not test another customer's, and you may not run load tests against the shared service without asking first. If you find a vulnerability, tell us at [security@ address]; we will not take action against good-faith research that follows this paragraph and does not access other customers' data.
3. Operational limits (free tier)
The free tier is priced on one dimension only: 5 GB stored per organisation. The limits below are not pricing; they protect the shared service and are visible with their current values at GET /v1/usage. They may be raised on request, and paid plans will carry their own.
| limit | value today |
|---|---|
| storage | 5 GB per organisation |
| objects | 50,000 per warehouse |
| tables | 50 per warehouse |
| namespaces | 10 per warehouse |
| warehouses (catalogs) | 3 per project |
| commits | 20,000 per month, at most one every 10 seconds per table |
| catalog operations | 1,000,000 per month |
| snapshot retention | 7 days or the 20 most recent snapshots per table, whichever expires first |
| credential lifetime | 15 minutes for API tokens; 60 minutes for storage credentials vended per table |
| signup | 5 attempts per hour per network address |
Automated maintenance (compaction, snapshot expiry, metadata retention, orphan-file removal) runs on every warehouse; it is how the limits above are kept and is not optional on the free tier.
4. What happens on a breach
We may, in proportion to the problem: refuse writes or new credentials, revoke specific credentials, suspend the account, or terminate it under clause 13.2 of the Terms. Where the breach is not urgent, we tell you first and give you a chance to fix it. Where it endangers other customers or the Service, we act first and tell you afterwards. We never read your data to look for breaches; we act on what we can see without doing so (metrics, error patterns, abuse reports, legal notices).
5. Reports
Abuse reports and takedown notices: [legal@ or contact email]. We acknowledge within [2 business days proposed] and act as Spanish law (LSSI-CE, Arts. 16 and 17) requires of a hosting provider once we have actual knowledge of unlawful content.
Change log
- 2026-09-19-draft — first draft. Limits copied from
DEFAULT_LIMITSinplatform/control_plane/app.pyon this date. Not published.