# What is unlimited, what is bounded, and what is not allowed.

Short page on purpose. The technical limits fit in one table; the rules of use fit in one list.


## Technical limits

| Item | Limit |
| --- | --- |
| Concurrent connections | Unlimited, on every network |
| Requests per second | No limit on the gateway; the target sets the pace |
| Concurrent sticky sessions | Unlimited |
| Sticky session lifetime | 1 minute to 24 hours, default 10 minutes |
| Whitelisted addresses | 50 per account, IPv4 |
| Sub-users | Unlimited |
| Idle connection to the gateway | Closed after 60 seconds without traffic |
| Transfer duration | No limit while data flows |
| Destination ports | Any TCP port except 25 |
| UDP, IPv6 targets, inbound connections | Not supported |
| API | 120 requests per minute per token |


## Traffic by network

| Network | Traffic model |
| --- | --- |
| Residential | Metered per GB, both directions, bought in advance, never expires |
| Mobile, rotating | Metered per GB, same rules as residential, separate balance |
| ISP | Unlimited and unmetered |
| Datacenter | 100 GB per IP per month, pooled across the order; speed reduced when the pool is exhausted, never cut |
| Mobile, dedicated device | Unlimited and unmetered |

"Unlimited" means unmetered: we do not count the bytes and we do not throttle. Dedicated addresses are yours alone, so the only capacity you compete with is your own.


## Acceptable use

The network is for collecting and verifying public information, running your own accounts and properties, and testing what you are entitled to test. The [acceptable use policy](https://hodlproxy.com/legal/acceptable-use) is the binding text; in short, the following ends an account:

- Attacks of any kind: denial of service, brute force, credential stuffing, exploitation of vulnerabilities you have no authorization to test.
- Fraud, including payment fraud, fake engagement sold to third parties, and impersonation.
- Unauthorized access to systems, accounts or data.
- Spam and unsolicited bulk messaging (this is also why port 25 is closed).
- Anything illegal where you operate or where the target operates, and any content involving the abuse of minors.
- Collecting personal data without a lawful basis, or reselling access to the network without agreement.

Abuse reports are investigated and acted on; where the law requires, we cooperate with the authorities. Residential exits belong to real people who opted in, and we protect them first.


## Good citizenship

- Pace requests per domain and back off on `429`. The absence of a limit on our side is not an invitation to hammer a target.
- Respect `robots.txt` where it applies to what you do, and the target's terms where they bind you.
- Prefer the network that fits: datacenter for open sources, residential and mobile only where the target requires them.


Source: https://hodlproxy.com/docs/limits