Where your data lives, and who can touch it.
How we protect the infrastructure and the data on it, where everything is hosted, and the documents that make it binding. The full commitments are in our Data Processing Agreement and Terms and Conditions; uptime, support and backups are summed up in our service levels.
Hosted in Romania, under EU law.
Your servers stay in the EU
Virtual machines, servers, storage and backups are hosted and processed only in Romania, inside the European Economic Area.
A Tier 3 datacenter
NXDATA-2 in Bucharest: two independent power feeds (A+B), each N+1, N+1 cooling, and 99.99% uptime guaranteed for power and cooling.
Physical security
Physical access to the hardware is controlled by the datacenter operator, NXDATA, under its own security measures.
Account and billing data
A few providers outside the EEA handle account, billing or website data, such as Stripe for card payments and Cloudflare for our website, always under EU transfer mechanisms. All of them are listed in our documents.
Isolated, filtered, watched.
Management stays private
Admin interfaces and the backup servers sit on separate internal networks, reachable only over a WireGuard VPN, never directly from the internet.
Firewalls and filtering
Layer 2–4 firewalls inside the network. Public web services sit behind Cloudflare and our own reverse proxy, with OWASP-based rules.
Continuous monitoring
Critical systems, including the customer portal and email, are monitored with Wazuh, our security monitoring (SIEM) platform, to catch intrusions and unusual activity early.
Multi-factor login
The customer portal supports multi-factor authentication, on top of perimeter protection and access control.
Separated services
Our own systems run in separate virtual machines by role, so a problem in one can’t easily spread to another.
Vulnerability management
We track known vulnerabilities and fix them by severity and risk, starting with the high and critical ones.
DDoS protection
Attack traffic is filtered at the network edge by our upstream provider, NEXONHOST.
Hands off your data
We don’t access your data or configurations unless you ask us for help. No telemetry; the only agent we ask for, the QEMU guest agent, talks only to the host.
What we keep, and for how long.
- Schedule
- Incremental backups every day, starting at 22:00 EET/EEST (Bucharest time).
- Retention
- 7 daily, 4 weekly and 6 monthly restore points.
- Where
- Two copies: one on isolated backup infrastructure in the datacenter, and one encrypted copy at a separate, offsite location.
- Guarantee
- On Virtual Nodes and Virtual Racks, a completed backup every day and every restore point restorable exactly as it was taken (crash-consistent), backed by credits if we miss either. See the service levels.
- Bare Metal and colocation
- Self-managed. As an optional extra, we add a backup server dedicated to you, on a private network, at the cost of an extra server, for the backup software you choose (Proxmox Backup Server, Veeam or R1Soft). We provide the hardware and the connections, on a best-effort basis.
- When you leave
- Your data, backups included, is kept for 30 days after the contract ends, so you can retrieve it, then deleted within 7 more days.
- Your own copy
- Our backups protect the platform; they don’t replace your own. Keep an independent, tested backup of anything you can’t lose.
The paperwork, in plain sight.
Data Processing Agreement
Part of every contract. We act as your processor under Article 28 of the GDPR. Section 2.8 lists every sub-processor, with purpose, country and transfer mechanism.
Privacy Policy
How we handle the personal data of our customers and website visitors, and how to use your rights.
Terms and Conditions
Service levels, backups, support and liability, in English and Romanian.
Acceptable Use Policy & DSA
What may not be hosted with us, and how to report illegal content under the Digital Services Act.
If a security incident ever affects data we process for you, we tell you without undue delay, with the information you need to meet your own obligations.