Account safety
Acceptable-use policy
PRL Vault is for people managing their own accounts and mining equipment. Protecting accounts comes before convenience.
Bots, scripts and AI
Do not use bots or AI agents to create accounts in bulk, impersonate people, evade safeguards, scrape private data, spam, manipulate markets, farm referrals, or automate withdrawals. Do not share credentials or let an autonomous agent control funds. The official rig agent and explicitly authorized mining integrations are allowed within their intended scope. Using AI for research or accessibility is not by itself evidence of abuse.
Rate limits
Sign-in allows up to 10 attempts per minute per network address. Email signup allows up to 6 attempts per hour per network address; bursts above 3 can trigger review. More than 3 withdrawal attempts per minute per account, 10 sensitive security actions per minute, or 60 security-console actions per minute can trigger a restriction. Shared networks can cause false positives. Other endpoints may apply additional limits. A 429 response means wait for Retry-After; do not rotate accounts or addresses to evade it.
Temporary restrictions and review
Signup bursts, rapid withdrawal attempts and repeated scripted sensitive-action patterns are risk signals, not proof that someone is a bot. Detected accounts are restricted for up to 24 hours and placed in a human review queue. An administrator may lift the restriction or impose a longer ban with a recorded reason. Restrictions block account activity, including withdrawals; they do not transfer ownership of funds or permit confiscation. Contact prlvault@prlvault.com with your account email and an explanation to appeal. Never send a password, private key or authenticator code.
Staff boundaries
Support cannot view or set passwords or authenticator secrets. The owner must reset their password at sign-in; all staff must use 2FA. Staff can require a reset, not choose your replacement password. Security actions are recorded in an append-only database audit log visible only to the owner-level SUPERADMIN. Infrastructure owners can still change deployed code or the database; no honest service can promise protection against every future administrator without independent controls.
Security data
We retain account risk flags, action timestamps, review reasons, and keyed network identifiers to apply limits and investigate abuse. Do not test security controls against accounts you do not own. Report suspected vulnerabilities privately rather than exploiting them.