Service Description

This English version is provided for convenience only. The German version is legally binding; in the event of any discrepancy between the two versions, the German version shall prevail.

1. General

1.1 Introduction

centron GmbH (“centron”), Heganger 29, 96103 Hallstadt, Germany, Register Court Bamberg, HRB 3986, as a national provider, provides professional Infrastructure & Platform as a Service offerings which, as a public cloud variant, are made available exclusively to businesses (“Customers”).

The provision of services by centron is based on a professional operating model aligned with the requirements of the international standard ISO/IEC 27001:2022. All services are supported and performed by specialised experts.

1.2 Location of the data centres

The services of the centron Public Cloud are provided and operated in data centres in Germany and, in future, also in other Member States of the European Union (EU). The infrastructure is operated in accordance with the ISO/IEC 27001 security standard. As a European cloud service provider, centron ensures strict compliance with the EU General Data Protection Regulation (EU GDPR).

1.3 Scope

This generally applicable service description (“Service Description”), together with the separately governed Terms of Use and the Service Specification(s) selected by the Customer, forms an essential part of the contract for the purchase of a centron product or service.

In the event of contradictions between the Terms of Use, the Service Description and the applicable Service Specification, the following order of precedence applies:

The Service Specification takes precedence over the Service Description and the Terms of Use. The Service Description in turn takes precedence over the Terms of Use.

1.4 Amendment of the Service Description

centron is entitled to amend this Service Description for existing contractual relationships with effect for the future where this is necessary for the further development of the services or for legal reasons. Section 19 of the Terms of Use applies accordingly to the amendment procedure and to the rights of the Customer (in particular the right to object and the right to terminate).

2. Service Level Agreement

2.1 Service transfer point

centron’s responsibility for the products to be provided ends at the internet transfer point between the respective data centre operated by centron and the internet service provider of the respective region.

2.2 Operating hours

centron’s cloud services are in principle available around the clock, 365 days a year (24/7/365). This excludes the agreed scheduled maintenance work.

2.3 Availability

The general availability of a centron product – after deduction of the Excluded Events under Section 2.4 – is 99.9 % (99.5 % for centron products that are not of redundant design) as a calendar-monthly average, unless otherwise provided in the respective Service Specification on which the product is based (“Availability”). Availability figures apply exclusively to contractually agreed products and their components; no availability commitment is made for the availability of the Customer’s own components or third-party components (software as well as hardware).

The Availability achieved in each calendar month is calculated as follows:

Availability always relates to a calendar month, is determined on a calendar-monthly basis and is stated as a percentage.

“Total Service Minutes” means the total number of minutes in a calendar month (calculation: 60 minutes x 24 hours x number of calendar days in the month).

“Total Downtime Minutes” means the number of minutes per month during which the contractually owed centron product was not provided. The number of minutes per month which, as Excluded Events within the meaning of Section 2.4, are not included in the calculation of Availability shall be deducted from the value of the Total Downtime Minutes.

The general availability of the centron Portal and the centron Application Programming Interface (API) is not subject to any availability commitment by centron. However, centron aims for an availability of the centron Portal and the centron Application Programming Interface (API) of 99.5 % each as a monthly average. Outages, incidents or other unavailability of the centron Portal or the centron Application Programming Interface (API) do not affect the calculation of the Availability of a centron product.

2.4 Excluded Events

Excluded Events are, in particular, those periods during which, owing to the outages and incidents listed below, provision of the centron products and services in accordance with the contract cannot be guaranteed (“Excluded Events”). Excluded Events do not count as downtime. Excluded Events include in particular:

Outages and incidents for which centron is not responsible, in particular DNS and routing problems or unauthorised interference by third parties, such as virtual attacks on the network or mail infrastructure (e.g. DoS, viruses or spam).

Outages and incidents resulting from the implementation of countermeasures against unauthorised interference or from Security Incidents.

Outages and incidents of third-party services outside centron’s control or which are not attributable to the service provided by centron or which lie in the network structure outside centron’s sphere of influence.

Outages and incidents resulting from improper use of programs or devices by the Customer. These include, for example:

Incorrect entries or failure to comply with instructions.

Acts or omissions of the Customer which exceed the prescribed and/or booked Contingents.

Acts or omissions of the Customer as a result of which required configurations are not made and/or not maintained.

Outages and incidents caused by the fault of the Customer.

Outages and incidents due to force majeure. Force majeure is an event which was not foreseeable for either party even when exercising the utmost care that could reasonably be expected; in this sense, force majeure may include in particular the following events: fires, explosions, power failures, earthquakes, floods, severe storms, strikes, embargoes, industrial disputes, acts of civil or military authorities, war, terrorism (including cyber terrorism), epidemics and pandemics, acts or omissions of internet providers, acts or omissions of supervisory authorities or administrative bodies (including the adoption of laws or regulations or other governmental acts that impair the provision of centron products and services).

Outages and incidents occurring due to maintenance work under Section 2.8.

Products that are made available to the Customer free of charge or are expressly designated and distributed as a trial version, beta or in a similar manner are not subject to any availability commitment. Outages or incidents arising from the Customer’s use of such services are treated as Excluded Events.

2.5 Supported software versions

centron’s services are based on the software versions current at the time the contract is concluded (‘major versions’).

In order to ensure the security, integrity and performance of the services on a lasting basis, centron reserves the right to replace major versions in use with successor versions (e.g. upgrades or releases). This also applies to existing contractual relationships.

When switching to successor versions, centron will take into account the legitimate interests of the Customer and will announce necessary updates with reasonable notice where they have a material impact on use.

In such a case, the following applies in particular:

centron informs the affected Customers of the upcoming change and of the end of the support period of major versions in the release notes at https://docs.centron.de/release-notes (“Release Notes”).

The major version affected by the change will be supported for at least a further 180 calendar days, calculated from centron’s announcement of the change in the Release Notes, and will then be migrated to the successor version successively and promptly (“Transition Period”).

The Customer may object to an upcoming change until the end of the Transition Period. If the Customer objects to the replacement of a major version by the successor version by the end of the Transition Period, centron may terminate the subscription to a centron product or service affected by the change by ordinary termination with effect from the end of the Transition Period.

During this Transition Period, contracts based on the major version may still be concluded; these must likewise be switched to the successor version at the end of the Transition Period. Customers are encouraged to inform themselves via the Release Notes of any announced changes to major versions before concluding a subscription to a centron product or service; for Customers who subscribe to or renew centron products and services affected by a change within the Transition Period, the affected centron product or service is available in the subscribed major version only until the end of the Transition Period, which, depending on the time at which a subscription is concluded, may amount to considerably less than 180 calendar days.

Where offered, technically possible and requested by the Customer, the Customer also has the option, even before the end of the Transition Period, of migrating major versions affected by a change to the successor versions or – depending on the centron product or service – of having them migrated by centron. However, the Customer has no entitlement to early migration.

After the Transition Period has expired, centron will successively and promptly switch major versions not yet migrated by the Customer to the successor versions.

In some cases of migration of the major version to the successor version, it may occur that a proper automatic migration (in particular of customer data) is not possible for centron without acts of cooperation by the Customer. In such cases, centron will inform the affected Customers of any required acts of cooperation in the Release Notes. The Customer has until the end of the Transition Period – calculated from the publication of the required acts of cooperation in the Release Notes – to perform the required acts of cooperation.

After the Transition Period has expired, the major version will no longer be supported by centron and may also no longer be usable by the Customer; centron is entitled, if and to the extent technically possible for centron, to carry out an automatic migration of the major version to the successor version, even if the Customer has not previously performed the required acts of cooperation; this may result in particular in data loss and loss or restriction of functionality of the affected centron product or service and of the Customer’s own hardware and software or third-party hardware and software used in connection with it. Except in the cases of Section 15.1 of the Terms of Use, centron accepts no liability for damage incurred by the Customer as a result of a migration not being carried out or of an automatic migration.

Following the switch of a software from its major version to the successor version, the successor version shall then be deemed the (new) major version within the meaning of this Section.

2.6 Backup

By default, centron does not perform any data backup unless otherwise provided in the individual Service Specifications.

Where, according to the underlying contractual Service Specification, a data backup is carried out for individual centron products or services, the data backup of the relevant centron product or service is governed by the following standards, unless otherwise provided in the individual Service Specification or otherwise configured by the Customer:

“Recovery Point Objective” (RPO): The RPO, or the maximum permissible data loss, specifies how old the state of the most recent consistent data backup may be. In the event of data loss and where a data restore is necessary, this backup state can be used.

“Recovery Time Objective” (RTO): The RTO, or the maximum recovery time, describes the period within which a data restore to a functionally available system, including operating system data and required (application) data, can be consistently completed on the basis of the restore.

“Retention Period” (RP): The RP describes the maximum duration for which backups are retained.

2.7 Support

centron provides its Customers with qualified staff and supporting resources for the resolution of incidents in accordance with the parameters below.

Incoming support cases are assessed by centron according to their criticality, which results in different response times.

Disruptions (“Incidents”): centron products and services are not available or their use is restricted.

Service or support requests (“Service Requests”): all other support cases, e.g. problems with user registration or system support.

centron reserves the right to downgrade the criticality if the centron product or service is available and the cause of the incident lies within the Customer’s area of responsibility.

*“Response time”: the period within service hours from receipt of the Customer’s report by centron until qualified staff start processing the report (visual inspection).

**“Resolution time”: the period within service hours from receipt of the Customer’s report by centron, by the expiry of which centron must have restored the contractually owed availability of the centron Cloud Service.

centron points out that, in the course of providing support services and in order to maintain the centron products and services, it may be necessary for centron to access the Customer’s centron products and services, including the data stored there. This takes place exclusively for the purpose of rectifying incidents, ensuring the service, handling Incidents or investigating security incidents. The Customer agrees that such access may take place without prior separate consent where this is necessary to fulfil the aforementioned purposes. centron will always take appropriate measures to ensure the confidentiality and integrity of customer data and to limit access to the necessary minimum.

2.8 Maintenance work

centron regularly carries out maintenance work (for example in the form of updates, patches, bug fixes or hardware replacement and hardware extensions) to ensure the functionality, quality and security of the centron products and services.

centron generally announces maintenance work that is expected to impair the usability of the centron products and services for the Customer two weeks before it is carried out via the centron status website status.centron.de. For urgent maintenance work, the announcement may also be made at considerably shorter notice or, depending on the individual case, be omitted altogether. centron recommends that Customers regularly inform themselves about maintenance work on the centron status website.

While maintenance work is being carried out, access to the centron products and services may be temporarily suspended or restricted, in particular where this is strictly necessary owing to the nature of the maintenance work to be carried out.

Downtime resulting from maintenance work carried out shall be treated as Excluded Events within the meaning of Section 2.4.

2.9 Service Payback

If the agreed Availability for centron products and services is not met as described, the Customer will receive, by way of the procedure below, a credit in the form of a credit balance on its customer account (“Service Payback”):

To claim a Service Payback, the Customer must assert in text form, within two (2) weeks of receipt of the invoice for the affected centron product or service and stating the customer number, the invoice number and the affected centron product or service, that the agreed Availability of the booked centron product or service has not been met. A claim not received within two (2) weeks cannot be taken into account.

If the claim is justified, the Customer will receive a credit of the Service Payback to its customer account for the following billing period.

The amount of the Service Payback always relates to the pro rata invoice amount of the centron product or service whose committed Availability was not met.

If a Service Payback claimed by the Customer is rejected, it is incumbent upon the Customer to demonstrate the breach of the agreed Availability of a centron product or service.

Credited Service Payback is offset against remuneration claims for the provision of centron products or services in the following billing period, so that the fee payable by the Customer is reduced accordingly.

Payment or any other refund of the credited Service Payback is excluded.

The following Service Paybacks apply unless a different provision has been made in the Service Specification of the centron product or service:

3. Incidents & Security Incidents

3.1 Information

centron regularly provides Customers with information on disruptions (“Incidents”) via the centron status website (status.centron.de). In the event of security incidents (“Security Incidents”), Customers are informed directly. centron recommends that Customers continuously inform themselves about the status of Incidents & Security Incidents on the centron status website.

For further analyses by the Customer, centron does not provide any data that could permit conclusions to be drawn about the security architecture, infrastructure or other customers of centron.

3.2 Analysis options of centron

For centron products and services which are provided by centron and used by the Customer purchasing the centron products and services, centron may take measures at its own discretion in order to detect vulnerabilities at an early stage both within centron’s area of responsibility and within the Customer’s area of responsibility. The Customer’s area of responsibility includes in particular all hardware, applications and third-party software not provided by centron (“Customer’s Area of Responsibility”).

If Security Incidents in the Customer’s Area of Responsibility are detected by centron or by external service providers of centron, the Customer will be informed of them. Depending on the severity of the Security Incident, the Customer is obliged to take appropriate measures promptly within its area of responsibility to avoid the Security Incident (e.g. by patching an affected application). If, for example, the Customer’s Area of Responsibility is not secured with the latest patches or workarounds, if the area of responsibility harbours security risks for centron or the Customer itself, or if the quality of the centron products and services is adversely affected or jeopardised by a Security Incident in the Customer’s Area of Responsibility, centron reserves the right to take appropriate countermeasures under Section 3.4.

3.3 Data collection for analysis options of centron

To detect possible Security Incidents in the Customer’s Area of Responsibility, log data of the customer systems or perimeter (e.g. firewalls, switches, routers and others) may be evaluated on a rule-based basis for anomalies and potential Security Incidents. Corresponding vulnerability scans (proactive and reactive) may also be carried out for systems accessible on the internet.

3.4 Possible countermeasures in the event of Security Incidents

To protect the Customer and the centron products and services, centron reserves the right, in suspected cases or in the event of proven Security Incidents of corresponding severity, to take appropriate measures without prior notice to or consultation with the Customer (“Countermeasures”). Separate information will of course be provided to the Customer at the latest afterwards. Countermeasures include in particular:

Disconnecting affected systems and centron products and services from the network, shutting them down or pausing them in order to prevent damage to systems and centron products and services.

Forensic analysis of potentially affected systems and centron products and services (in particular in order to obtain findings for criminal prosecution or for the assessment of criticality or damage).

Other activities to prevent or reduce impairments of other customer systems of the centron products and services or of external systems.

3.5 Technical changes to resolve Security Incidents

The Customer will be informed promptly of technical changes made which, from centron’s point of view, were necessary for resolving Security Incidents and were implemented. If the Customer does not object to these technical changes, stating reasons, within a period of 14 calendar days from receipt of the information by the Customer, these technical changes shall be deemed accepted by the Customer.

The Customer has a right to object only if the scope of services of the centron product or service has deteriorated more than insignificantly following the technical change made, or if use of the centron product or service or the Customer’s ability to access the centron product or service is no longer possible as agreed owing to the technical change made.

In the event of an effective objection, the Customer shall give centron the opportunity to remedy the matter. In the course of remediation, centron will take economically reasonable measures to achieve a more customer-friendly solution with regard to resolving the Security Incident. If centron refuses remediation on justified grounds (e.g. owing to technical impracticability, persistence of the Security Incident or economic unreasonableness) or if the Customer’s ground for objection persists after remediation, centron will continue to provide the affected centron product or service with the technical changes made, and the Customer shall have the right to terminate the affected subscribed centron product or service for good cause with immediate effect.

4. Encryption of stored data and management of cryptographic keys

4.1 Encryption of the infrastructure

To protect stored data, centron GmbH uses cryptographic methods on the infrastructure it operates. This includes the encryption of the storage volumes used for customer VMs by means of Microsoft BitLocker, where this measure has been set up for the respective infrastructure.

Encryption at infrastructure level serves to protect stored data, above all in the event of loss, theft or unauthorised access to physical data media. It does not constitute end-to-end encryption and does not prevent technically necessary access to data during ongoing operation.

4.2 Key management by centron

Where centron operates encryption at infrastructure level, the cryptographic keys and recovery information required for this purpose are managed by centron.

The keys are stored in a protected key management system. Access is restricted to authorised persons and takes place in accordance with the applicable security and authorisation procedures.

The Customer expressly agrees that centron manages the keys required for the operation of the infrastructure provided and uses them to the extent necessary. This also includes unlocking encrypted data media and restoring operability.

This provider-side key management is laid down as a contractually agreed exception to exclusive customer-side key sovereignty within the meaning of basic criterion CRY-03 of BSI C5:2020 (Cloud Computing Compliance Criteria Catalogue of the German Federal Office for Information Security).

4.3 Key management by the Customer

Where the Customer uses its own encryption methods within its virtual machines, operating systems, databases or applications and manages the associated keys exclusively itself, these keys and their management remain its responsibility.

centron does not require knowledge of these customer-owned keys in order to provide the underlying infrastructure.

The Customer is responsible for the secure generation, storage, use, backup and recovery of its self-managed keys.

The encryption used by centron at infrastructure level remains unaffected by this.

4.4 Protection and recovery of the keys

centron protects the keys and recovery information it manages against unauthorised access and impermissible use by means of organisational and technical security measures.

Documented emergency procedures exist for the recovery of the central key management system.

4.5 Special requirements of the Customer

If the Customer requires encryption in which only the Customer itself has access to the cryptographic keys, it must use an appropriate method within its area of responsibility or separately agree a suitable service for this purpose with centron.

Provider-side encryption of the infrastructure alone does not ensure exclusive customer-side key sovereignty.