Anti-Abuse Policy

1. Purpose & Scope

1.1 Purpose

This Anti-Abuse Policy establishes Bio-Link.se's commitment and operational framework for preventing, detecting, and responding to abuse of our URL shortening and bio page creation platform. As a link service, we have a heightened responsibility to prevent our infrastructure from being weaponized for phishing, malware distribution, fraud, or other harmful activities.

1.2 Scope

This policy applies to:

• All users — Free, Premium, and OF Plan subscribers
• All content — Bio pages, shortened URLs, embedded links, images, and text
• All access methods — Web interface, API, and any future integrations
• All jurisdictions — Regardless of where the user is located

1.3 Core Principles

Our anti-abuse operations are guided by:

• Zero Tolerance — No warnings for serious violations (phishing, malware, CSAM, fraud)
• Proportionality — Enforcement actions proportional to the severity of the violation
• Speed — Automated detection and rapid human response minimize harm
• Transparency — Clear rules, published statistics, and documented processes
• Due Process — Appeals available for non-critical enforcement actions
• Cooperation — Active collaboration with security vendors, law enforcement, and industry peers

2. Definitions

3. Abuse Categories & Severity Classification

All abuse is classified by category and severity level. Severity determines response time, enforcement action, and escalation path.

4. Detection Methods

Bio-Link.se employs a defense-in-depth strategy with multiple overlapping detection layers:

4.1 Automated Pre-Publication Scanning

Every link and bio page is scanned before activation:

• Google Safe Browsing API — Real-time check against Google's database of billions of unsafe URLs
• VirusTotal API (97 engines) — Multi-engine scan including Sophos, Fortinet, ESET, Kaspersky, BitDefender, and 92 additional vendors
• Internal Blocklist — Matching against our proprietary database of known malicious domains, patterns, and IP ranges
• AI Pattern Detection — Machine learning models trained to identify phishing page structures, fraudulent language patterns, and social engineering techniques

4.2 Continuous Post-Publication Monitoring

All active content is re-scanned on a continuous schedule:

• 03:00 UTC — Full scan of all active shortened URLs via Google Safe Browsing
• 04:00 UTC — Bio page content review and embedded link validation
• 09:00 UTC — New content review (links created in previous 24 hours)
• Real-time — Continuous monitoring of flagged accounts and high-risk content

4.3 Behavioral Analysis

Our systems monitor user behavior patterns to identify suspicious activity:

• Rapid bulk link creation (exceeding normal usage)
• Links to newly registered domains (< 30 days old)
• Patterns matching known phishing kit structures
• Account creation from flagged IP ranges or known VPN/proxy services
• Repeated targeting of specific brands or financial institutions
• Unusual geographic patterns (e.g., account from Sweden, all links targeting Brazilian banks)

4.4 External Intelligence Sources

• Security vendor notifications — Alerts from Google, VirusTotal, Cloudflare, and others
• Abuse reports — User reports via abuse@bio-link.se
• Law enforcement requests — Official takedown requests and investigation notices
• Industry sharing — Threat intelligence from platform peers and security communities
• Brand protection services — Notifications from companies monitoring for impersonation

4.5 Cloudflare Protection Layer

• DDoS mitigation
• Bot detection and challenge pages
• Rate limiting
• IP reputation scoring
• Web Application Firewall (WAF) rules

5. Response Process

When abuse is detected or reported, the following process is initiated:

5.1 Automated Response (P0 Critical)

For P0 violations, the system acts without waiting for human review:

• Malicious link immediately redirected to a security warning page
• Account automatically flagged and access suspended
• Admin notification sent via email within seconds
• All other links from the same account queued for emergency scan
• IP address and device fingerprint recorded for ban enforcement

5.2 Manual Review Process

All automated actions are followed by human verification:

• Security team member assigned to the case
• Content reviewed against Terms of Service and applicable law
• False positive check performed
• If confirmed: enforcement proceeds. If false positive: content restored and user notified
• Decision documented with reasoning

6. Response Time SLAs

We commit to the following response time targets:

7. Escalation Matrix

Abuse cases are escalated based on severity, complexity, and external involvement:

7.1 Auto-Escalation Rules

• Any case not resolved within 2× the SLA target is automatically escalated one level
• Any case involving minors is immediately escalated to L3+L4
• Any case with law enforcement involvement starts at L3 minimum
• Any case involving 10+ affected accounts is escalated to L3

8. Enforcement Actions

Enforcement actions are proportional to the severity of the violation:

8.1 Content-Level Actions

• Link Redirect — Malicious link redirected to a security warning page
• Link Deactivation — Shortened URL permanently disabled
• Bio Page Removal — Entire bio page taken down
• Content Edit — Specific content removed with page preserved (minor violations)

8.2 Account-Level Actions

• Warning — Written notification of policy violation (P3 only, first offense)
• Temporary Suspension — Account access disabled for 7–30 days (P2, first offense)
• Permanent Termination — Account permanently deleted, all content removed (P0/P1, or repeat P2)
• Plan Downgrade — Forced downgrade from OF Plan for age gate violations

8.3 Network-Level Actions

• IP Block — Source IP address banned from the platform
• IP Range Block — Extended block for coordinated attacks
• Device Fingerprint Ban — Device-level block to prevent ban evasion
• Email Domain Block — Registration blocked from disposable/abusive email providers

8.4 Enforcement by Severity

9. Appeals Process

9.1 Who Can Appeal

Appeals are available for:

• P2 and P3 enforcement actions
• Suspected false positives
• Content incorrectly flagged by automated systems

9.2 How to Appeal

1. Send an email to appeals@bio-link.se
2. Include your username, the content/action in question, and your reasoning
3. Provide any evidence supporting your case
4. Appeals must be submitted within 14 days of the enforcement action

9.3 Appeal Review

• Appeals are reviewed by a different team member than the original decision-maker
• Review completed within 10 business days
• Outcome communicated via email with reasoning
• Appeal decisions are final

9.4 Possible Outcomes

• Upheld — Original action remains. No further appeal available.
• Modified — Reduced enforcement (e.g., suspension shortened, warning instead)
• Overturned — Content restored, account reinstated, apology issued

10. Evidence & Data Retention

We retain abuse-related data for enforcement, legal compliance, and pattern detection:

11. External Reporting Obligations

Bio-Link.se reports abuse to external authorities and organizations based on the nature of the violation:

11.1 Mandatory Reporting

We are legally obligated to report in the following cases:

11.2 Voluntary Reporting

We may also report to the following at our discretion:

• Google Safe Browsing — Submit newly discovered malicious URLs for global blocking
• VirusTotal — Share threat samples and indicators
• Cloudflare — Report coordinated attack patterns
• Anti-Phishing Working Group (APWG) — Contribute phishing data to the eCrime database
• Spamhaus — Report spam-related infrastructure
• Brand owners — Notify companies being impersonated on our platform
• Domain registrars — Report malicious domains linked through our service
• Hosting providers — Notify upstream hosts about malicious destination content

11.3 Law Enforcement Cooperation

Bio-Link.se cooperates fully with law enforcement under the following framework:

• Valid legal requests: We respond to court orders, subpoenas, and official information requests
• Emergency requests: Imminent danger cases processed without waiting for formal legal process
• Proactive reporting: We report serious crimes even without receiving a formal request
• Evidence preservation: We honor preservation requests and litigation holds
• Jurisdiction: Primary cooperation with Swedish law enforcement; international requests via mutual legal assistance treaties (MLAT)

12. Industry Cooperation

12.1 Security Vendor Integration

We maintain active integrations with the following security vendors and databases:

• Google Safe Browsing — Bidirectional: We consume their threat data and contribute our findings
• VirusTotal — 97-engine scanning with results informing our automated blocking
• Cloudflare — Infrastructure-level protection and threat intelligence

12.2 Abuse Contact Responsiveness

We are committed to being a responsive abuse contact:

• abuse@bio-link.se is actively monitored and responds within SLA targets
• We acknowledge receipt of all external abuse reports within 24 hours
• We provide actionable updates to reporters when content is actioned
• We maintain an up-to-date abuse contact in our WHOIS records and on our website

12.3 Threat Intelligence Sharing

We contribute to the broader security ecosystem by:

• Sharing anonymized threat patterns with security communities
• Reporting malicious destination URLs to relevant blocklist operators
• Notifying affected platforms when their brands are being impersonated
• Contributing phishing URLs to public threat feeds where appropriate

12.4 False Positive Resolution

We actively work to resolve false positive detections:

• Submit false positive appeals to security vendors when our domain or user content is incorrectly flagged
• Maintain communication channels with vendor security teams
• Provide evidence and context to support delisting requests
• Publish transparency information about false positive incidents (see our Security & Safety page)

13. User Reporting Mechanisms

13.1 How to Report Abuse

Users and third parties can report abuse through multiple channels:

13.2 What to Include in a Report

Effective reports should include:

1. The URL or bio page link (e.g., bio-link.se/username or a shortened link)
2. Type of abuse (phishing, malware, scam, spam, illegal content, etc.)
3. Description of why you believe it is abusive
4. Screenshots or evidence (if available)
5. Your contact information (optional but helpful for follow-up)

13.3 Reporter Protections

• Confidentiality: Reporter identity is never disclosed to the reported user
• Anonymous reporting accepted: Contact information is helpful but not required
• No retaliation: We prohibit any form of retaliation against good-faith reporters
• Status updates: Reporters with contact info receive confirmation and outcome notifications

13.4 Abuse of the Reporting System

14. Adult Content Specific Abuse

Adult content on Bio-Link.se is only permitted under the OF Plan ($3.99/month) with strict safeguards. This section covers abuse scenarios specific to adult content.

14.1 Age Gate Violations

14.2 Prohibited Adult Content

The following always triggers P0 (Critical) response:

• Child Sexual Abuse Material (CSAM) — immediate takedown, NCMEC report, law enforcement notification
• Non-consensual intimate imagery (revenge porn) — immediate takedown, law enforcement notification
• Content involving trafficking or coercion — immediate takedown, law enforcement notification

The following triggers P1 (High) response:

• Bestiality / zoophilia content
• Content depicting or simulating sexual violence
• Content involving unconscious or drugged individuals
• Any other content listed in Terms of Service Section 4.3B

14.3 Adult Content Monitoring

OF Plan accounts are subject to enhanced monitoring:

• Automated Age Gate presence verification on every bio page load
• AI content classification to detect untagged adult content
• New adult bio pages may enter a manual review queue (reviewed within 48 hours)
• Regular compliance audits of OF Plan accounts
• Enhanced user reporting mechanisms for adult content concerns

15. Transparency & Accountability

15.1 Public Transparency

We maintain transparency about our anti-abuse efforts through:

• Security & Safety page — Public information about our security systems, scanning schedule, and incident reports: bio-link.se/custom/safety-security/
• Annual Transparency Report — Published statistics on enforcement actions, abuse volume, and response metrics
• Incident Disclosure — Significant security incidents disclosed publicly with timeline and remediation details

15.2 Transparency Report Contents

Our annual transparency report includes:

• Total abuse reports received (by category)
• Reports actioned vs. dismissed
• Average response times by severity
• Accounts terminated (by violation type)
• Law enforcement requests received and fulfilled
• False positive rate and resolution statistics
• DMCA / copyright takedown statistics
• Geographic distribution of abuse (anonymized)

15.3 Internal Accountability

• All enforcement actions are logged with timestamps, reasoning, and the responsible team member
• Regular internal audits of enforcement consistency
• Quarterly review of SLA performance
• Annual policy review and update (see Section 16)

16. Policy Review Cycle

16.1 Regular Review

This Anti-Abuse Policy is reviewed and updated:

• Annually — Comprehensive review of all sections
• After major incidents — Post-incident review may trigger immediate updates
• When regulations change — EU Digital Services Act, Swedish law, GDPR updates
• When detection capabilities change — New security tools or vendor integrations

16.2 Change Notification

Material changes to this policy are communicated via:

• Email notification to registered users
• Website notice on the policy page
• Updated "Last Modified" date in the header

16.3 Version History

17. Related Documents

This Anti-Abuse Policy is part of Bio-Link.se's legal and operational framework. It should be read in conjunction with:

18. Contact Information