Let me preface by stating that I'm not looking for any resolution on this. I'm a security researcher reporting unusually poor customer service and adherence to a company's TOS.

Cloudbet's TOS can be found here: https://www.cloudbet.com/en/help/terms.

I may or may not be located in a prohibited country per section 7.1.3, but Cloudbet thinks that I am. Cloudbet suspended and KYC'd one of my accounts created using a popular VPN service pretty quickly after a small initial deposit. I refused KYC from Cloudbet. Per their TOS, the remedy for refusal of KYC is the termination of our contract. That is implemented through an account closure. Cloudbet's TOS permits an account closure with confiscation of the balance of an account in the event that a user has placed bets from a prohibited jurisdiction (11.4). In every other case, account closures are to accompanied by a refund of the current account balance. No bets were ever placed on this account and so Cloudbet is not adhering to it's obligations as detailed in its TOS.

Anyway, I was looking in to Cloudbet because I noticed that they offer games from a provider with a known vulnerability. I was able to create an account using an alternative method, and did verify that this game can be played on Cloudbet and the vulnerability exists. I would typically disclose that to Cloudbet privately, but in this case I have no real motivation to do so. If anyone would like to responsibly disclose this vulnerability, I can state that the game is from one of the Microgaming studios, it's a table game, it has side bets, and the side bets are important to the vulnerability.