Tunnel Acceptable Use

Nouva Ephemeral Tunnels is a shared, free developer utility for temporary development, preview, webhook, and callback testing. Tunnel URLs are public and exist only while the authorizing SSH session is connected.

Allowed use

You may expose services you control for development and testing, receive legitimate third-party callbacks, demonstrate non-production work, and replay your own captured requests while the originating session remains live.

Prohibited use

You must not use a Nouva tunnel for:

phishing, impersonation, credential collection, or deceptive login pages;
malware, exploit delivery, command-and-control traffic, or illegal content;
spam, unsolicited bulk messaging, scanning, scraping, or denial-of-service activity;
an open proxy, traffic relay, production hosting, or bypassing network restrictions;
collecting data without authorization or exposing secrets and production data;
infringing rights or violating any applicable law.

Shared-service limits

The fair-use limits below apply equally to everyone. At a rolling request or transfer limit, SSH remains connected but new HTTP requests receive 429 until usage falls below the window. Attempts rejected at the edge do not consume the rolling allowance.

Nouva Ephemeral Tunnels fair-use limits
Limit	Free V1 allowance
Live forwards	5 per workspace
SSH connections	3 per user, 5 per workspace
Transfer	5 GiB / 24h, 25 GiB / 30d per workspace
Requests	50,000 / 24h, 250,000 / 30d per workspace
Request rate	60 req/s sustained, burst 120 per forward
In flight	100 per forward, 250 per workspace
Request body	25 MiB
Response body	100 MiB
URL / headers	8 KiB / 32 KiB
Ordinary HTTP lifetime	90 seconds
WebSocket / SSE	No fixed lifetime; 30-minute no-byte timeout
SSH lifetime	Unlimited while keepalives succeed
SSH liveness	Disconnect after three missed 30-second keepalives

Inspection and privacy

Request metadata is retained for seven days. Full bodies are captured only when the tunnel creator enables capture, are encrypted at rest, and remain creator-only. Workspace administrators may disconnect a session but cannot read its captured payloads. Do not send secrets that you are not authorized to process.

Enforcement

Nouva may immediately disconnect sessions, reserve aliases, or suspend users and workspaces to protect people and infrastructure. Confirmed abuse evidence may be kept for up to 180 days; ordinary captures and session metadata keep their shorter published retention periods. Enforcement does not create a right to a permanent alias or endpoint.

Report a problem