GTC & SLAs

Terms and conditions of secunet cloud (aaS and Managed Services)

1. General Terms and Conditions Cloud

As of: 14/11/2025

§ 1 General

Secunet refers to secunet Security Networks AG as well as secunet International GmbH, stashcat GmbH, and SysEleven GmbH, in which secunet Security Networks AG directly or indirectly holds at least 50% of the shares or voting rights. The respective contract is concluded exclusively between the relevant secunet company (hereinafter referred to as “secunet”) and the respective contractual partner. Any contractual obligation or liability on the part of other secunet companies are excluded, unless expressly agreed otherwise in writing.

§ 2 Subject matter of the contract Cloud

1. Under this contract (framework agreement), secunet offers the contractual partner the option for the temporary use of the contractual service in return for payment.
2. The specific content of the contractual service owed by secunet in detail is set out in the individual contract.

§ 3 Provision of the contractual service

1. secunet provides the contractual services (IT services) for the contractual partner on its own public cloud platforms. Resources are used in accordance with a fair use model. secunet does not guarantee a minimum level of resources. The contractual partner shall use the contractual services of the public cloud in such a way that the use of the contractual services of other contractual partners is not affected. secunet reserves the right to take measures in the event of misuse in order to protect the availability of other contractual partners and their projects.
2. When providing the contractual service, secunet shall ensure that sufficient capacity is available to cover the contractual partner’s higher requirements at short notice within the usual ranges. Requirements that exceed this will be met subject to availability. The contractual partner may at any time submit a binding request to secunet for an increase in the capacity of the contractual service it uses, with a lead time of two (2) months.
3. Insofar as secunet provides the contractual service on its infrastructure, this shall take place at the interface of the data network within which the contractual service runs (transfer point) to other networks. secunet is not responsible for establishing and maintaining the data connection between the contractual partner’s IT system and the transfer point.

§ 4 Rights of use for cloud

1. secunet grants the contractual partner a simple right of use that is limited in terms of content to the purpose of the contract and in terms of location to the place of contractual use, limited in time to the duration of the contract, and non-transferable, unless otherwise expressly agreed between the contractual partner and secunet.
2. secunet is entitled to update its service and provide the contractual partner with a new version instead of the version provided for use at the start of the contract, provided that the change is reasonable for the contractual partner. The change is reasonable for the contractual partner if the contractual service is not fundamentally altered and is acceptable to the contractual partner in view of the circumstances. In this case, the new version shall constitute the contractual service and shall be subject to the provisions of this contract, and the contractual partner’s rights under this contract with regard to a previously provided contractual service shall expire even without an express request for return. The changes relate, for example, to updates/upgrades of underlying software and will be notified to the contractual partner prior to their implementation if negative effects on the contractual service (e.g., availability, features) are to be expected. If changes are made unplanned, e.g., for security reasons, the contractual partner will be informed as soon as possible. The contractual partner shall have no claim to a newer version of the contractual service originally provided.
3. Without secunet’s consent, the contractual partner is not entitled to make changes, extensions, or other modifications to the service (within the meaning of Section 69c No. 2 UrhG) or to decompile (within the meaning of Section 69e UrhG) the service insofar as this exceeds what is legally permissible. The above provisions of this section on the granting of rights, secunet’s right to update, and the reservation of consent shall apply equally if and to the extent that work results have been developed on behalf of the contractual partner.
4. Furthermore, unless expressly agreed otherwise with secunet, the contractual partner is not entitled to obtain further business secrets by observation, investigation, dismantling, or testing (“reverse engineering”) insofar as the software provided is not publicly available.
5. Insofar as the contractual partner provides secunet with protected content (e.g., graphics or programs protected by copyright or trademark law, hereinafter referred to as “contractual partner materials”), the contractual partner grants secunet a simple right of use, limited in terms of content to the purpose of the contract, limited in terms of location to the place of contractual use, and limited in terms of time to the duration of the contract, for the performance of the contractual service.
6. The Contractual Partner warrants that it holds all necessary rights to the Contractual Partner Materials provided in order to grant secunet the corresponding rights. If the Contractual Partner does not hold the necessary rights, it shall obtain the necessary rights.
7. secunet is entitled to block access to the user account created for the use of the contractual service if there are indications that the access data of the user account has been compromised. In this case, secunet shall inform the user via the contact information stored by the user in the user account.

§ 5 Rights of use for work results

1. If copyright-protected work results are created by secunet within the scope of this contract, all rights of use thereto shall be exclusively reserved to secunet, including rights to register industrial property rights.
2. If copyright-protected work results arise at secunet within the scope of this contract, secunet grants the contractual partner a simple right of use limited in terms of content to the purpose of the contract and in terms of location to the place of use specified in the contract, limited in time to the duration of the contract, provided that this does not conflict with any legal restrictions and/or rights of use of third parties and no further rights of use have been expressly agreed in writing between the contractual partner and secunet with reference to this provision.
3. If and to the extent that a database or database work is created during the term of the contract, in particular through the compilation of application data, through permitted activities of the contractual partner, all rights thereto shall be vested in the contractual partner.

§ 6 Terms of use for the cloud

1. The contractual partner shall not use secunet’s contractual services in any way that compromises the contractual services provided by secunet to the contractual partner or that results in secunet’s performance vis-à-vis its contractual partner being restricted.
2. The contractual partner is obliged to observe the following terms of use: 
   a) The contractual partner shall not use secunet’s contractual services for abusive and/or illegal purposes or to an extent that jeopardizes public safety. Abusive purposes include, in particular, the distribution, downloading, or publication of content and/or activities that may violate or impair the rights of third parties. Abusive purposes also include the publication and distribution of depictions of sexual abuse, content that is likely to harm the welfare of children and young people and/or seriously endanger their morals, cyberstalking, content that serves to incite hatred or terrorism, that incites criminal acts or is illegal for any other reason. 
   b) If and to the extent that secunet becomes aware of a violation of the Terms of Use, secunet will block and/or remove the relevant content. Secunet shall be deemed to have become aware of such violations if it is requested by the competent authority to block or remove certain content. Secunet shall also be deemed to have become aware of such violations if a user reports content that violates the Terms of Use. Secunet does not moderate content on its services. 
   c) To the extent permitted by law, secunet will inform the contractual partner about the blocking/removal of their content. 
   d) If secunet becomes aware of this due to a report from a user, it will examine the extent to which the blocking of the content will be maintained, taking into account all interests and ensuring proportionality.
   e) In the event of the blocking/removal of its content, the contractual partner is entitled to contest the decision.

§ 7 Third-party software products

1. The contractual service includes third-party software components. The contractual partner undertakes to comply with the relevant license terms and conditions, which secunet will provide in advance if the contractual partner obtains this software from secunet and manages it independently.
2. The contractual partner is aware that the license terms for third-party software components may be changed by the third party. If the change in the terms and conditions affects secunet’s provision of the contractual service to the contractual partner, secunet is entitled but not obliged to use an adequate substitute for the provision of the contractual service. secunet will inform the contractual partner of any changes in advance.
3. If the software contains errors, secunet is entitled to provide a replacement solution.

§ 8 Contractual partner’s obligations to cooperate

1. The contractual partner shall receive access data for accessing secunet’s contractual services and may, depending on the service, create and manage additional access data. All access data must be kept confidential at all times and may not be made available to unauthorized third parties. If the contractual partner suspects or becomes aware that its access data is being used without authorization, the contractual partner shall inform secunet immediately and make reasonable efforts to prevent unauthorized use. The contractual partner is responsible for all activities in connection with its access data.
2. The contractual partner is responsible for ensuring that data is backed up properly and regularly in accordance with the state of the art. This shall be carried out outside the scope of secunet’s contractual services. In addition, the contractual partner is solely responsible for entering and maintaining the data and information required to use the software.
3. secunet shall be released from its obligation to provide the agreed service if and to the extent that the contractual partner fails to fulfill its obligations to cooperate. Any existing schedules shall be automatically adjusted accordingly. If the contractual partner is responsible for the failure to cooperate and if secunet suffers damage as a result, the contractual partner shall compensate secunet for this damage.
4. The contractual partner shall ensure that data stored on secunet systems is free of any malware.
5. The contractual partner shall always use the latest versions of applications, tools, and software provided by secunet. If the contractual partner violates this obligation to cooperate, secunet shall be entitled to extraordinary termination.
6. The contractual partner is fully responsible for updates within its area of responsibility. Before updating, the contractual partner shall ensure that it has the necessary backups for recovery and has checked that the new versions function correctly.
7. If the contractual partner fails to fulfill its obligations to cooperate despite repeated reminders when updating the software within its area of responsibility, secunet reserves the right to carry out these updates. secunet will set the contractual partner a reasonable deadline for the update.
   secunet shall inform the contractual partner 30 days prior to an update carried out by secunet
   a) that and when an update will be carried out by secunet and
   b) to which new version of the software it will be updated.
8. The contractual partner is obliged to report functional failures, malfunctions, impairments, and security incidents to secunet immediately and as precisely as possible. If the contractual partner fails to cooperate, § 536c BGB shall apply analogously.
9. Any false reporting of security incidents shall have no negative consequences for the reporting party.
10. secunet shall not be in default as long as the contractual partner fails to fulfill its obligation to cooperate in accordance with the contract. In all other respects, the statutory provisions shall apply.

§ 9 Disclosure of License and Terms of Use

If the contractual partner is entitled to grant a third party rights of use to the contractual service, it is obliged to ensure that the end customer is obliged to comply with the license and usage conditions. The granting of rights of use to the contractual service to a third party is only permitted with the prior consent of secunet.

§ 10 Contract term and termination Framework agreement

1. This contract is concluded for an indefinite period and begins with the conclusion of the so-called onboarding service.
2. Termination of the framework agreement requires the deletion of the organization in the onboarding service. The deletion of an organization is carried out by the last remaining user of an organization. Deletion of the organization is only possible upon termination of all individual contracts, with the restriction that the termination of the framework agreement only becomes effective upon termination of the last remaining individual contract.
3. The right to extraordinary termination remains unaffected. secunet has an extraordinary right of termination in particular if 
   a) the contractual partner fails to properly fulfill its obligations under this contract despite prior written warning and setting of a reasonable deadline, or 
   b) if the contractual partner violates the terms of use. This applies in particular if the blocking/removal of the content is due to an official or court order or 
   c) the contractual partner fails to meet its payment obligations despite a reminder after invoicing, or 
   d) if the contractual partner has filed for insolvency proceedings or 
   e) if insolvency proceedings have been opened against the contractual partner’s assets or the opening of such proceedings has been rejected due to lack of assets.

§ 11 Contract term and termination Commitment and On-Demand

1. The term of use of the contractual service is based on the agreement in the contract and begins with the provision of the contractual service. If an automatic extension of the term of a contractual service has been agreed, this is based on the agreement in the contract.
2. The notice period is based on the agreement made in the contract. If no notice period has been agreed, the following applies: If a commitment of at least twelve (12) months is agreed in a contract, the term is extended by a further twelve (12) months if the contract is not terminated in writing with six (6) months’ notice to the end of the term. If the use of on-demand services is agreed in the contract, no fixed term is agreed. The contractual partner may terminate the use of the on-demand service at any time without notice.
3. Termination of a contract or termination of the use of the on-demand service shall not be equated with termination of the framework agreement.
4. The provision on extraordinary termination of the framework agreement applies accordingly.
5. If the contractual partner wishes to switch to a cloud solution from another service provider before the end of the contract term or transfer all exportable data and/or digital assets to the contractual partner’s own infrastructure, the Special Conditions for Cloud Switching in the secunet Group (EU Data Act) shall apply in addition.

§ 12 Termination

1. Upon termination of the right of use, the contractual partner shall immediately cease using the contractual service.
2. The contractual partner is obliged to return or delete any contractual service provided to secunet immediately after termination of the right of use or, if and as long as it is legally obliged to store it for a longer period, immediately after expiry of the storage period. This also applies to all copies made by the contractual partner for this purpose. Upon request, the contractual partner must provide secunet with written confirmation that this has been done. In the event of termination of the contract or withdrawal from the contract, this paragraph shall apply accordingly.
3. Termination of use of services shall result in the deletion of the data generated or stored therein. Unless otherwise agreed in the contract, the contractual partner shall have the option at any time to download its data itself in the usual format(s) offered by the service before termination of use and to back it up outside the contractual services of secunet or in suitable storage offerings from secunet.
4. Upon request, secunet may cooperate with the contractual partner and/or the third party designated by the contractual partner to ensure that no disruptions to service provision occur during the transition and that the contractual partner or the third party designated by the contractual partner is able to commence operation of the contractual services after the date of termination of the contract. In this respect, secunet may prepare and provide appropriate documentation. The contractual partner shall cooperate in this regard. Upon receipt of written notification that the contractual partner has been able to read and process all transferred data, the data shall be deleted from the systems in secunet’s data center and the contractual partner shall be notified of this deletion in writing (at least in text form).
5. If the contractual partner uses the contractual service beyond the end of the contract period because a switch to its own IT systems or to another provider or for another reason was not implemented in time after termination of the contract, this use shall be remunerated until the final cessation of use. This continued use does not extend a terminated contractual relationship or constitute a new contract for the use of the contractual services.

§ 13 Offsetting and right of retention

The contractual partner shall only be entitled to offset claims if its counterclaims are undisputed or have been legally established. The contractual partner shall only be entitled to assert rights of retention on the basis of counterclaims arising from the same contractual relationship.

§ 14 Remuneration for cloud services

1. Each contract is billed on a monthly basis.
2. Billing is based on the prices specified in the contract or the price list valid at the time the service is ordered via the self-service portal, according to the volume consumed or the service booked. Invoice items whose amount is known in advance in the billing month are billed monthly in advance. Services that are billed according to consumption, such as traffic, are billed retrospectively in the following month. If services are billed according to time, the intervals can be found in the corresponding product descriptions. The service records are deemed to have been accepted if the contractual partner does not object to them within a maximum of ten (10) working days of receipt.
3. Unless otherwise indicated, prices quoted by secunet are exclusive of the applicable statutory value added tax.
4. In the case of agreed partial services and for partial invoices, the provisions regarding remuneration and pricing shall apply accordingly.
5. Invoices are due for payment without deduction within thirty (30) days of receipt. The conditions and consequences of default are governed by the statutory provisions. If part of an invoice is disputed, the undisputed part must always be paid.

§ 15 Standard reporting channel

The contractual partner must submit all types of notifications by email to support@syseleven.de or via the ticket system. In urgent cases (malfunctions, security incidents, etc.), the notification must also be made by telephone to secunet’s emergency numbers:
+49 30 233 2012 30 (during service hours) or
+49 30 609 89 22 11 (24/7 emergency hotline)

§ 16 Incident management for malfunctions, security incidents, and vulnerabilities

1. secunet provides regularly updated information about malfunctions, security incidents, and vulnerabilities (hereinafter referred to as “incidents”) on the status page if the affected contractual partners cannot be informed individually and directly.
2. secunet acts at its own discretion when detecting and remedying incidents in services offered by secunet and used by the contractual partner. Depending on the severity of the incident, secunet reserves the right to take measures without prior notice or consultation with the contractual partner. These include, among other things:
   a) isolation of the affected systems,
   b) completely restricting the accessibility of contractual partner systems, or
   c) the shutdown of compromised services.
   This list is not exhaustive.
3. If secunet becomes aware of security vulnerabilities in installations for which the contractual partner is responsible, secunet shall inform the contractual partner. The contractual partner is obliged to remedy the vulnerability promptly. If this does not happen, secunet reserves the right to take measures to protect its own systems.
4. Once an incident has been resolved, secunet informs the affected contractual partners about the measures taken and any further steps that may be necessary.

§ 17 Cloud warranty

1. secunet guarantees the functionality and operational readiness of the contractual service. Unless expressly stated otherwise below or in the contract, the statutory warranty provisions shall apply.
2. secunet shall be liable for defects in the contractual service provided by secunet in accordance with the warranty provisions of tenancy law (Sections 536 et seq. BGB), but with the proviso that, contrary to Section 536a (1) BGB, liability for damages shall only exist in the event of fault in accordance with the provisions of the contract.
3. Any defects must be reported immediately using the contact options available on the secunet website, providing a detailed description of the defect complained about. Complained defects must be reproducible.
4. A defect exists if secunet does not perform the contractual service in accordance with the contract and this has a significant effect on the suitability for the use agreed in the contract.
5. The contractual partner shall have no warranty claims
   a) in the case of only insignificant deviations from the agreed quality or only insignificant impairment of the usability of secunet’s contractual performance
   b) in the event of incorrect operation by the contractual partner
   c) in the event of the use of hardware, software, or other equipment of the contractual partner that is not suitable for the use of the contractual service
   d) if the contractual partner does not report a defect immediately and secunet was unable to remedy the defect as a result of the failure to report it immediately, or
   e) if the contractual partner is aware of the defect at the time of conclusion of the contract and has not reserved its rights with express reference to this provision.
6. If a defect has been reported by the contractual partner and the contractual partner’s warranty claims are not excluded, secunet is entitled to remedy the defect within a reasonable period of time by taking measures of its own choosing. The contractual partner shall give secunet reasonable time and opportunity to remedy the defect. Subsequent performance shall also be deemed to have been fulfilled if the contractual partner is shown ways of avoiding the effects of the defect. An equivalent new program version of the software underlying the contractual service or an equivalent previous program version of the software underlying the contractual service that did not contain the error shall be adopted if this is reasonable for the contractual partner.
7. If it is impossible or fails to remedy the defect, if there is a culpable or unreasonable delay, or if secunet seriously and definitively refuses to remedy the defect, the contractual partner is entitled in particular to reduce the remuneration owed in accordance with the extent of the impairment (reduction) if it asserts the credit balance specified in the contract within ten (10) days.
8. If secunet provides services for troubleshooting or rectification upon request without being obliged to do so, it may demand remuneration for this in accordance with its usual rates. This applies in particular if a defect cannot be proven.

§ 18 Liability Cloud

1. secunet shall be liable – regardless of the legal basis – for damages and reimbursement of futile expenses only in cases of intent or gross negligence or culpable breach of a material contractual obligation. In the event of a breach of a material contractual obligation, secunet’s liability shall be limited to typically foreseeable damage, except in cases of intent and gross negligence.
2. The contractual partners’ liability for data loss is limited to the restoration costs that would have been incurred if the other contractual partner had made regular and appropriate backup copies and taken the necessary precautionary measures. Section 254 of the German Civil Code (BGB) remains unaffected.
3. The above limitations of liability do not apply to injury to life, limb, or health, to statutory liability under the Product Liability Act, or to the assumption of a guarantee.
4. The above limitations of liability shall also apply directly in favor of secunet’s employees, representatives, and vicarious agents.
5. In the event that contractual services provided by secunet are used by unauthorized third parties using the contractual partner’s access data, the contractual partner shall be liable for any fees incurred within the scope of civil liability until receipt of the order to change the access data or notification of loss or theft, provided that the contractual partner is at fault for the unauthorized third party’s access.
6. If a third party asserts against one contractual partner that a service provided by the other contractual partner infringes the rights of third parties, the one contractual partner shall notify the other immediately. The contractual partner who infringes the rights of a third party is entitled, but not obliged, to defend the asserted claims at its own expense, insofar as this is permissible. The other contracting party is not permitted to acknowledge claims by third parties without the prior consent of the contracting party that has infringed the rights of third parties, or to admit the underlying facts or to conclude a settlement in this regard.

§ 19 Special conditions for free trial

1. If the contracting party uses secunet’s contractual services free of charge and exclusively for testing purposes (hereinafter referred to as “trial installation”), the trial installation shall be limited in time and shall be based on the term agreed in the contract.
2. If a free trial has been agreed, no warranty shall be provided, insofar as this is legally permissible.
3. Within the scope of the free trial of the service, the provider shall be liable in accordance with the statutory provisions of Sections 599 and 600 of the German Civil Code (BGB).

§ 20 Limitation period

All claims arising from this contract shall become time-barred within a period of one year from the start of the statutory limitation period. This shall not apply to claims arising from liability for intent and gross negligence, in cases of malice, claims arising from the Product Liability Act and in cases of an assumed guarantee, as well as in cases of injury to life, limb or health.

§ 21 Confidentiality

1. Confidential information is any information about facts relating to a business operation that is known only to a limited group of people, i.e., that is not public knowledge and should be kept secret due to the legitimate interests of the business owner, regardless of its nature and form. This includes, in particular, verbal information, letters, memoranda, reports, documents, studies, analyses, drawings, letters, computer printouts, software programs, specifications, data, graphic representations, tables, sound recordings, pictorial reproductions, and any type of copies of the aforementioned information for which the disclosing contracting party has taken appropriate confidentiality measures.
2. The contracting parties shall treat confidential information as strictly confidential and shall not disclose it to third parties without the prior written consent of the other contracting party. None of the following companies shall be considered third parties: secunet Security Networks AG, secunet International GmbH, stashcat GmbH, and SysEleven GmbH, insofar as information must be made available to them by secunet in order to fulfill the purpose of the contract. The contracting parties may disclose confidential information to employees who need the respective confidential information for the purposes of executing the contract, provided that the respective employee has undertaken to maintain confidentiality by signing a written confidentiality agreement.
3. The above obligation does not apply to information that
   a) was already public knowledge at the time of receipt by the receiving contracting party;
   b) was already in the possession of the receiving contracting party at the time of receipt by the receiving contracting party;
   c) becomes public knowledge after receipt without the receiving contracting party’s involvement;
   d) becomes accessible from third parties without any obligation of secrecy and non-use, provided that these third parties have not received the information directly or indirectly from the receiving contracting party; or
   e) must be disclosed due to legal provisions, official or court decisions. The disclosing contracting party shall only inform the disclosing contracting party to the extent that legal provisions, official or court decisions require disclosure of confidential information.
   (4) Unless the contracting parties have agreed otherwise, the confidentiality obligations under the provisions of this paragraph shall end five (5) years after the termination of this contract.

§ 22 Data protection

The contracting parties shall comply with all laws, guidelines, and regulations applicable to them and secunet concerning data protection and data security. If personal data is entrusted to one contracting party, the other contracting party shall keep it confidential and protect it from misuse by taking appropriate technical and organizational measures. When processing or passing on personal data, the relevant data protection laws and the provisions of the contractual agreements with secunet shall be observed.
a) The contractual partner shall only employ staff who have undertaken to maintain confidentiality when handling personal data in order to fulfill their obligations. Corresponding declarations of commitment from employees must be submitted at secunet’s request.
b) The contractual partner is prohibited from processing, disclosing, making accessible, or using personal data without authorization for any purpose other than the lawful performance of its tasks.
c) The loss, unlawful transfer, or disclosure of personal data must be reported to secunet immediately at Datenschutz@secunet.com, as there may be information obligations.

§ 23 Compliance

1. The contractual partner undertakes to comply with the provisions of the Code of Conduct for Suppliers and Business Partners (Code of Conduct for Suppliers and Business Partners) and, in particular, to observe the applicable legal regulations on combating corruption and the applicable antitrust laws.
2. In the event of a breach of these obligations, the provider is entitled to terminate this contract without notice. The contractual partner shall indemnify the provider against all damages and claims by third parties arising from the breach and shall hold the provider harmless.

§ 24 Export restrictions

1. The contracting parties are obliged to independently review and comply with all foreign trade regulations applicable to them, in particular import, export control, customs, and national, European, and international sanctions and embargo regulations. This applies both to independent exports or cross-border transfers, in particular resales, of deliveries and to cross-border delivery and service relationships.
2. The contracting party responsible under foreign trade regulations must obtain any necessary (export) licenses from the competent authorities. It shall bear all customs duties, fees, and other charges incurred in connection with cross-border deliveries and services. secunet is not obliged to provide advice.
3. Within the framework of their contractual relationships, the contracting parties mutually agree to regularly check their data for any entries on economic, financial, or trade-related sanctions lists in compliance with data protection regulations, in particular with regard to compliance with the above-mentioned sanctions and embargo regulations.
   With regard to the aforementioned sanctions list screening, the following also applies:
   (i). The contracting parties assure that neither they themselves nor their employees, nor any natural or legal persons in which they hold a direct or indirect majority ownership interest, are listed on any of the above-mentioned sanctions lists.
   (ii). The contractual partner is obliged to immediately notify secunet in writing (compliance@secunet.com) of any positive results confirmed during the check against the aforementioned sanctions lists.
   (iii). In the event of a positive screening result, secunet is entitled to terminate the contract for cause.
   (iv). The contractual partner shall indemnify secunet against all claims by third parties resulting from the breach of statutory and contractual obligations.
4. In accordance with Council Regulation (EU) No. 833/2014, the following applies:
   a) The contractual partner may not sell, export, or re-export goods delivered under or in connection with this contract and falling within the scope of Article 12g of Council Regulation (EU) No. 833/2014, either directly or indirectly, to the Russian Federation, nor may it carry out such actions for use in the Russian Federation.
   b) The Contracting Party shall use all reasonable efforts to ensure that the purpose of paragraph 4 a) is not undermined by third parties in the commercial chain, including possible resellers.
5. Any culpable breach of the preceding paragraph shall constitute a material breach of the provisions of this contract, and secunet shall be entitled to take appropriate measures, including, but not limited to:
   (i). Termination of this contract; and
   (ii). assertion of a contractual penalty amounting to 5% of the value of the goods sold, exported, or re-exported in violation of paragraph 4 a); and
   (iii). Assertion of a contractual penalty in the event of a breach of paragraph 4 b), whereby the amount of the contractual penalty shall be determined by secunet at its reasonable discretion in accordance with § 315 BGB (German Civil Code). The amount may be reviewed by a court in the event of a dispute. The contractual penalty shall be offset against claims for damages.
6. The contractual partner shall immediately inform secunet of any problems in the application of paragraph 4, including any relevant activities of third parties that could frustrate the purpose of paragraph 4 a). Upon request, the contractual partner shall provide secunet with information on compliance with the obligations under paragraph 4 within two weeks.

§ 25 Audit

1. secunet or a third party commissioned by secunet shall be entitled to carry out audits at the contractual partner’s premises in order to verify the proper fulfillment of this contract and the individual contracts as well as the requirements of the Code of Conduct for Suppliers and Business Partners (Code of Conduct for Suppliers and Business Partners of secunet). In addition to observing the necessary security measures and any confidentiality obligations of the contractual partner towards third parties, secunet shall:
   a) notify the contractual partner of audits at least two weeks in advance,
   b) take into account the contractual partner’s operational processes,
   c) limit audits to the rooms and facilities affected by the subject matter of the contract,
   d) comply with data protection regulations and act on the premise of affecting the contractual partner’s trade and business secrets as little as possible.
2. Any use of such secrets beyond what is necessary to enforce secunet’s contractual and legal claims against the contractual partner is prohibited.
3. Each contractual partner shall bear its own costs of verification. However, the contractual partner shall also bear secunet’s costs if the verification reveals violations of this contract or legal provisions.

§ 26 Amendment of the contractual provisions

1. secunet is entitled to amend individual provisions of the contract if there is a valid reason for doing so and the amendment is necessary for the continuation of the contract and reasonable for the contractual partner. A valid reason in this sense exists, among other things, if a change in the legal situation or the highest court ruling or doubts about interpretation that have arisen make it necessary to amend the provisions concerned. A valid reason also exists if a change in market conditions or other legal, economic, or technical conditions that was not foreseeable at the time the contract was concluded and over which secunet has no influence has occurred, leading to a disruption of the contractual equivalence and requiring an adjustment of the terms and conditions to restore equivalence.
2. secunet shall notify the contractual partner of the upcoming changes in writing (e-mail) at least six weeks before the amended terms and conditions are scheduled to take effect. The contractual partner is entitled to object to the changes within six (6) weeks of receiving the notification. If the contractual partner does not object within the deadline and continues to use the service after the objection period has expired, the amended contractual terms and conditions shall be deemed to have been agreed. secunet shall inform the contractual partner of its right of objection and the consequences of not exercising this right in the notification of change.
3. Provisions that affect the main performance obligations of the contracting parties and thus significantly change the relationship between main and counter-performance obligations, as well as other fundamental changes to the contractual obligations that are equivalent to the conclusion of a new contract, are excluded from the right to amend individual provisions of the contract. Such amendments require an express contractual agreement.

§ 27 Final provisions

1. This contractual relationship shall be governed by the laws of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG) and the provisions of private international law.
2. The courts in Germany shall have exclusive jurisdiction over all disputes arising out of or in connection with this contractual relationship. However, secunet may, at its discretion, also bring proceedings before the courts having jurisdiction at the contractual partner’s registered place of business.
3. The establishment of this contractual relationship, as well as all agreements providing for the amendment, supplementation, termination or specification of this contractual relationship, in whole or in part, shall require at least text form. Where this contractual relationship refers to the written form, such written form may also be replaced by electronic form or text form, provided that no mandatory statutory formal requirements apply. Text form requires an electronic signature using a software solution. The foregoing formal requirement shall also apply to any amendment or termination of this text form clause.
4. Should any provision of this contract be or become invalid or unenforceable, or should this contract contain a gap, the validity of the remaining provisions shall remain unaffected. To fill such gap, the contracting parties shall agree upon an appropriate provision which, as far as possible, comes closest to what the contracting parties would have agreed had they been aware of the gap. This shall apply accordingly to invalid provisions that do not constitute secunet’s General Terms and Conditions.
5. Any deviating, conflicting or supplementary general terms and conditions shall not become part of this contract unless their applicability has been expressly agreed at least in text form.
6. Upon request of the other party, and no later than upon termination of the contractual relationship, each contracting party shall hand over to the other contracting party, or destroy in compliance with applicable data protection requirements, all business documents and any business materials relating to this contract, including, but not limited to, software copies, while observing any applicable statutory retention obligations. Upon request, the deletion of such data shall be confirmed to the other contracting party. This shall not apply to backup copies of electronic communications.
7. Even if this contract is written in English, it shall be understood that it has been drafted by German lawyers against the background of German commercial practice and German law. If any provision of this contract requires interpretation, the intended German legal meaning shall prevail.

2. Special conditions for implementing the requirements of cloud switching in the secunet Group (EU Data Act)

Status: 14/11/2025

The companies in the secunet Group (hereinafter referred to as “secunet”) offer various data processing services (hereinafter referred to as “contractual services”) for temporary use via web-based access in return for payment. 
The following Special Terms and Conditions apply to agreements on the change of the respective contractual service within the meaning of the EU Data Act (REGULATION (EU) 2023/2854 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of December 13, 2023, on harmonized rules for fair data access and use and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Regulation)) between secunet and the contractual partner.

§ 1 Rights and obligations of the contractual partner

1. The contractual partner is entitled to switch to another cloud solution offered by another service provider at any time or to transfer all exportable data and/or digital assets (hereinafter collectively referred to as “data”) to the contractual partner’s own infrastructure.
2. The contracting party shall notify secunet of the change request at least in text form via the known contact option, without the need for a notice of termination.
3. If the contract between secunet and the contractual partner for the originally agreed contractual service has been terminated in due time but the switch has not yet been successfully completed, the originally agreed service shall continue to be remunerated until the switch has been successfully completed. This continued use does not extend a terminated contractual relationship or constitute a new contract for the use of the services.

§ 2 secunet’s obligations

1. secunet shall provide the contractual partner or a third party authorized by the contractual partner or the new service provider commissioned by the contractual partner with appropriate support in completing the change.
2. secunet shall continue to provide the contractual services originally agreed between the contractual partner and secunet until the changeover has been successfully completed. The changeover shall be deemed to have been successfully completed when the exportable and transferable data has been extracted and made available in a suitable manner for data retrieval. Data retrieval shall be carried out by the contractual partner itself, by a third party commissioned by it, or by the new service provider commissioned by it.

§ 3 Information obligations, transparency, technical aspects

1. secunet shall provide information that supports the change of the contractual partner to the extent necessary and relevant. This includes, among other things, information 
   • on the initiation of the change and change procedures,
   • machine-readable data formats that enable data export, including open interfaces and compatibility information (online register),
   • about known technical limitations and restrictions that may affect the change,
   The list of information is not exhaustive. 
   The information is available at secunet.cloud.
2. secunet provides information via the above link about the jurisdiction to which the ICT infrastructure is subject, as well as a general description of the technical, organizational, and contractual measures that secunet has taken to prevent international government access to or international transfer of non-personal data stored in the Union.
3. The contractual partner is aware that the transfer of data may pose risks to the uninterrupted provision of the agreed service. If and to the extent that secunet becomes aware of any potential risks, it will inform the contractual partner immediately.
4. secunet will provide the contractual partner with a list of the data categories that may be transferred in the course of the changeover. In addition, secunet will inform the contractual partner of any data categories that are specific to the internal functioning of the originally agreed service and, due to their nature and characteristics, are not made available for export because of the risk of breach of trade secrets.

§ 4 Transfer periods

1. The transfer process shall commence upon notification by secunet that the exportable data is available for export, but no later than two months after notification of the transfer request by the contractual partner (hereinafter referred to as the “transfer period”).
2. If secunet is unable to comply with the transition period for technical reasons (hereinafter referred to as “technical impracticability”), it shall notify the contractual partner of this, stating the reasons, within 14 working days of notification of the change request. secunet is entitled to extend the transition period at its own discretion. The extension shall not exceed a period of seven months from notification of technical impracticability.
3. If the contractual partner determines that it cannot comply with the transition period, it shall be entitled to extend the transition period once by a period that is reasonable for its own purposes. It shall inform secunet immediately of the extension of the transition period.
4. After the transition period has expired, the data must be retrieved by the contractual partner or a third party commissioned by them or the new service provider commissioned by them (hereinafter referred to as the “data retrieval period”). The data retrieval period, which may not be less than 30 calendar days, begins at the end of the agreed transition period.

§ 5 Termination of the contract

1. Once the changeover has been successfully completed, the contract is terminated and the contractual partner is informed of this by secunet. The changeover is deemed to have been successfully completed once the exportable and transferable data has been extracted and made available in a suitable form for data retrieval.
2. The contract shall also be terminated if the contractual partner wishes to delete its exportable data and/or digital assets at secunet without the need for a change. The contract shall be terminated upon deletion, but no later than two months after the declaration of intent to delete.

§ 6 Standard service fees, lump-sum compensation

1. The contractual partner was informed of the standard service fees (the remuneration to be paid) for the originally agreed contractual service before the contract was concluded. These can be found in the price list and/or the offer provided to the contractual partner. The originally agreed remuneration must be paid until the change has been successfully completed.
2. If a contract was agreed between secunet and the contractual partner for the originally agreed service with a fixed term and/or fixed purchase quantities of resources (both hereinafter referred to as “commitment”) and this commitment is terminated prematurely due to the change request, secunet shall be entitled to claim the remuneration that would have been incurred until the end of the contract term, less any expenses saved, in the form of lump-sum damages.

§ 7 Exceptions for customer-specific adaptations; trial installation

1. If most of the central functions of secunet’s standard services have been customized specifically to the needs of the contractual partner at the latter’s request, the contractual partner may not invoke secunet’s obligations under these Special Terms and Conditions. The same applies if the entire service has been developed specifically at the request of the contractual partner.
2. If secunet provides support at the request of the contractual partner in connection with a change to a new service provider or to the contractual partner’s own infrastructure, secunet shall be entitled to claim the costs incurred in connection with the change.
3. The contractual partner may not invoke the obligations of these Special Terms and Conditions if the agreed service was provided for testing and/or evaluation purposes (trial version) for a limited period of time, either for a fee or free of charge.

§ 8 Final provisions

These Special Terms and Conditions apply exclusively to change requests within the meaning of the EU Data Act of the contractual partner. They apply in addition to secunet’s General Terms and Conditions for Cloud Services.

secunet cloud (formerly SysEleven) Product descriptions self-services and “as-a-service” model

1. General information regarding our self-service products and aaS services

Last updated: 17 November 2025

In this chapter, we describe general services and procedures that apply to all products. We explain more about the individual products and their services in the product-specific descriptions in the following chapters.

Product descriptions may deviate in part from the general description. Should deviating or contradictory descriptions occur, please orient yourself on this order of priority. Validity is defined in descending order:
1.) Service Level Agreements
2.) Product-specific descriptions
3.) General information about the services

1.1. Product descriptions

Product-specific descriptions are contained in the individual chapters.

1.2. Registration

Each contracting partner may create or be assigned to multiple organisations. An organisation is the anchor point to which all other objects such as users or projects are assigned.
More details in this regard can be found in our documentation at https://documentation.syseleven.de/en/products/syseleven-iam/usage/organizations/ and https://documentation.syseleven.de/en/discover/core-concepts/iam/.

1.2.1. Registration self-service

The registration process is divided into the following steps:
a. Registration of user account – admin account
For registration, the user enters a work e-mail address, first and last name as well as password.
This initiates a double opt-in procedure. Clicking on the link provided in the confirmation e-mail concludes the user registration process.
b. Creating an organisation
After the user is registered successfully, an organisation is created. To create the organisation it is necessary to communicate the business name of the company, the company’s registered address and a billing address if this is not the same as the registered address.
Once the organisation has been created successfully, the organisation is released by us and the user is able to access the products. The user can consult the price list to find the prices for use. By creating the organisation, the user declares their authorisation to submit legally binding declarations on behalf of the company.
Please follow this description for registration: https://documentation.syseleven.de/en/discover/get-access/
Note: Using a product requires the registration of at least one user.

1.2.2. Registration by us

If agreed upon and if usage is not exclusively based on a self-service model, registration can also be carried out by our employees. We will contact you for this purpose.

1.2.3. Registration of other users

Once the organisation has been registered and created successfully, the user is authorised to invite other users to join the organisation. The additional users receive an e-mail in which they are invited to register and join the organisation. To register, it is necessary to provide a work e-mail address, first and last name as well as password. Here as well, a double opt-in procedure is used. The user receives a confirmation e-mail at the work e-mail address provided. Clicking on the link provided in this e-mail concludes the registration process. The first time a user logs in after an invitation, the user has to confirm the invitation in order to join that organisation. After registering successfully and accepting the invitation, this user can access our products and services. The Client’s admin account is able to restrict and expand the rights of all users. All users can trigger costs by calling up services if they are granted corresponding rights.
The processing of data provided during the registration process is described in the Privacy Policy. These can be viewed on our website at https://secunet.cloud/en/privacy-policy/

1.3. Provision of services

All services ordered by the user are assigned to projects and billed along with these projects. Where possible, these projects are created by the Client itself or by us.
The service obtainable for the user results from the specific valid product descriptions for the individual products (“Product-specific descriptions”) as well as this general description. All relevant documents can be viewed online at https://secunet.cloud/agb-sla/
The user can find the available service level from the SLA descriptions of the individual products (“Service level agreements”). These can also be accessed online at the link above in their current valid versions.

1.4. Use of the products

The user must possess the necessary technical knowledge in order to ensure correct administration of the IT service by the user.
Documentation is available for the user’s assistance, which can be accessed via the website at https://documentation.syseleven.de/en/discover/

1.4.1. Recommended settings

The provided software is not preconfigured for production operation. We recommend that each user review the configuration of software, particularly with regard to critical security settings, and to adjust the settings to the user’s own needs.

1.4.2. Backup & restore

The user is responsible for backing up the latest status of its services and the accompanying data that is administered in order to be able to restore them independently at any time.
Unless otherwise described for the individual products in the product descriptions, in this context the user will use the options in the software provided by the product.
Note: Any duplications of data as part of particular services do not perform the function of a backup since they do not allow access to older versions of data.

1.4.3. Verification and authorisation

The user may use the functions offered by the software to:

• Manage access to the interface, IT service and the service itself

• Adjusting other security-related settings, e.g.

  • configuration of user rights,
  • backup measures,

  to ensure the integrity and availability of data and the security of the service.

We recommend configuring authorisations restrictively and limiting user access to the necessary minimum.

1.5. Installation of software

If this is offered, the user may independently install software on the provided service. The user is independently responsible for its administration and operation.
There is no assistance for software administration unless this is expressly offered with the product.
When providing the software for installation, we do not provide any licences for or on behalf of the user as a rule. The user accepts the applicable licence terms of the particular manufacturer at the time of installation, and an agreement is established between the user and the particular manufacturer. The user bears sole responsibility for ongoing correct licensing of the software installed by the user.
Note: Our service ends with provision of the software for installation. We make no guarantees for the faultless function and security of this software. The evaluation of software quality and security as well as the decision regarding installation and its complete administration is the sole responsibility of the user.

1.6. Customer data

Customer data refers to all information that the user transfers to our systems while using the product, or engages to be transferred by authorised persons or systems. The administration of customer data is the responsibility of the user.

1.6.1. Erasure of customer data

Each user will erase customer data independently and promptly when it is no longer required. If there is any remaining data after the end of the contract, we will erase this no later than after 7 days.

1.6.2. Unannounced access to customer data by us

If it becomes necessary due to unforeseeable events for us to inspect customer data in order to perform the contract and this was not authorised by the user in advance, we will inform the user afterwards regarding the following details according to the best effort principle:

• What was accessed?
• Who had access?
• When and for how long did access occur?
• Why was access necessary?

1.7. Storage and calling up of data

The user is aware that, where relevant, particular data will only be stored if the user has explicitly activated storage. The procedures for this are described in the product documentation.
During contract implementation, any user data that falls under the user’s responsibility and is managed by the user cannot be provided by us for calling up or transferred to the user. The user must call up these data independently and promptly before the termination of use.

1.8. Maintenance work

We reserve the right to regularly perform maintenance work on the products to retain security and availability, and to further develop the products.
Planned maintenance work which are anticipated to impact the usability of products for all users are generally announced 7 working days before being carried out, at least on our status page.
Note:

• The user is recommended to regularly check the status page for announcement and take suitable measures.
• The user can reduce the impact of maintenance work by executing suitable redundancy measures. Examples for this include infrastructures with redundant design (VMs, storage) on which queries are distributed. The development of georedundant services also helps considerably in this regard.

1.9. Support

The following support plans are available:

1.9.1. Overview of product support

1.9.2. Overview of operational support

1.10. Cessation of use

If the user ceases to use a product or releases the resources employed, the user will no longer have access to its data. These data will be erased automatically. The time of erasure depends on the product used. There is no option of having us restore the data.

2. Product description IT services in “as a Service” model

Last updated: 17 November 2025

This chapter summarizes the general description for all products in an “as a Service” model (hereinafter referred to as “aaS”):

• secunet cloud OpenStack Cloud (“Public Cloud”)
• DB as a Service
• Kubernetes as a Service

These product-specific descriptions extend or replace the general description in Chapter 1 General information regarding our self-service products and aaS services.
If provisions in the two chapters contradict in whole or in part, the provision in this chapter shall take priority.

2.1. Shared responsibility

We offer various products in an as-a-service model based on a model of shared responsibility.
The nature of an “as a Service” product makes it logical for us to share responsibility for accessibility with the user. In the following sections, we indicate which elements are our responsibility and which fall under the user’s responsibility.

2.1.1. What do we do?

Our area of responsibility encompasses supplying and updating the required platform for providing the software, including the interfaces and services required for use.
To this end, we provide interfaces and channels which allow the user to flexibly manage resources.
The user receives an administrative account to manage the service.

2.1.2. What does the user do?

Users can call up and return software via defined interfaces.
Our service ends with the provision of a software in an operable basic configuration, and additional tools for administration where relevant. The necessary configuration is fully under the user’s area of responsibility.

2.2. Use of the products

2.2.1. 3rd party tools

Insofar as we and the software support them and they are available on the market, the user can use typical third-party tools to configure and operate the software.

2.3. Maintenance work

Planned maintenance work that only affects individual users or a small number of users and which require us to impair access to IT services will be communicated specifically to the affected users, 7 working days in advance as a rule.

2.4. Malfunction reports

If the user wishes to call up an agreed service from fixed-term contracts and this is not available, the user must contact support using the standard reporting channels. The user will not be billed for times starting from receipt of the report up to provision of the service.

3. Product description secunet cloud OpenStack Cloud (formerly SysEleven OpenStack Cloud) (“Public Cloud”)

Last updated: 17 November 2025

The descriptions in this chapter extend or replace the general descriptions in Chapter 2 Product-specific description IT services in “as a Service” model.
If deviating descriptions are presented in this chapter, these take priority over the descriptions in Chapter 2 Product-specific description IT services in “as a Service” model.
The secunet cloud OpenStack Cloud is hereinafter referred to as Public Cloud.

3.1. Purpose of this document

This description, along with the documentation, is the central source of information relating to the services (products plus accompanying services) which we perform in the context of our Public Cloud and its platform-related services for its users. These include:

• Infrastructure aaS
• Compute
• Compute with GPU
• Storage (Volume Storage, Object Storage)
• DNS aas
• LB aaS

It contains a quantitative and qualitative service description of the services we offer and accompanying service elements.
A distinction is made between primary services and supporting services.
A primary service (customer-oriented service) is to be understood as a service that is visible for the user. This assists the user’s business divisions and business processes or promotes the result which the user desires to achieve.
A supporting service, in contrast to primary service, is to be understood as a support service that is not directly visible for the user, yet which is essential for the performance of primary services. The performance of supporting services is included as part of the performance of primary services.

3.2. Object of service

We offer our users computing, storage and network resources (hereinafter referred to as “Resources”) under the concept “Infrastructure as a Service” (IaaS) as well as platform-based services using OpenStack.

3.3. Use of the product

3.3.1. Upper limit of use

The maximum resources available to call up are agreed based on an agreed upper limit of maximum usable resources (hereinafter referred to as “Quota”). This quota can be changed by mutual agreement.

3.3.2. Required activities of the user

A user manages its IaaS resources independently. This also includes management of the selected operating system, particularly installation, operation, life-cycle management (integrating patches) and backup. This list is not intended to be exhaustive.
The user is responsible for the security of the resources employed.
When producing VMs, the user may use public operating system images that we support or other images that we provide. The proper function of these images is not an integral component of the product. We offer no guarantee of function or availability. The documentation contains information about images provided by us and references to licensing at https://documentation.syseleven.de/en/products/syseleven-stack/
When providing the images for installation, we do not provide any licences for or on behalf of the user as a rule. The user accepts the applicable licence terms of the particular manufacturer at the time of installation, and an agreement is established between the user and the particular manufacturer. The user bears sole responsibility for ongoing correct licensing of the software installed by the user.

For VMs with GPU, the following applies:
1. The use of Nvidia GPUs (including driver) by the user is also subject to Nvidia’s current valid end user license terms, which the user accepts by using this IT service; depending on the installation type (see https://documentation.syseleven.de/)
a. these must be actively confirmed or
b. these are stored in the usual directories for review after installation or
c. these must be accepted upon download from the Nvidia source.
2. If these licensing terms are not available, the user can procure them directly from Nvidia.
3. If the end user licensing terms contain requirements for use and/or restrictions of use regarding the Nvidia products, these also apply for the relationship between the user and us regarding the use of the IT service.
4. We have the right to terminate the use of the IT service with immediate effect if the user violates the Nvidia end user licensing terms and a prior request to cease the violation is not complied with.
5. The user will regularly back up interim results to ensure that the impact of outages is minimized. We do not store any data.
6. The user can obtain these in the on-demand model or as a commitment
7. Users with commitment have a higher priority for allocation of VMs with GPU
8. The following applies for commitments:
a. These are always billed, even if the user does not call up the agreed-upon service.
b. We are allowed to use services that are not called up in other ways
9. The following applies when calling up based on an on-demand model:
a. The user can issue a request for a VM with GPU. If capacities are available, the service is provided.
b. We reserve the right to temporarily revoke the service from the user after prior announcement.

3.4. Regions

This description applies for the regions

• HAM1 (Hamburg) and
• DUS2 (Düsseldorf).

You can learn more under 4.6.1.1 Regions.

3.5. Service management

3.5.1. Purpose of service management

In order to guarantee the suitability and usability of the services we offer at all times, the primary and supporting services are maintained and further developed according to the defined life cycle (internal definition regarding the life cycle of a service according to the reliability criteria for individual components).

3.5.2. Best management practices and proof of effectiveness

In order to act in accordance with the principles of service management, we orient our service management based on best management practices pursuant to ITIL®.

3.5.3. Scope of service management

The established service management system which we use includes all

• Directives,
• Processes,
• Functions,
• Standards,
• Guidelines,
• Resources and tools,

which guarantee that we can achieve the specified service targets.
The service management processes introduced in line with best management practices pursuant to ITIL® include

• Capacity Management,
• Service Continuity & Availability Management,
• Service Level Management incl. Service Catalogue Management,
• Service Reporting,
• Information Security Management,
• Budgeting and Accounting for IT-Services,
• Incident and Service Request Management,
• Problem Management,
• Business Relationship Management,
• Supplier Management,
• Configuration Management,
• Change Management as well as
• Release and Deployment Management.

3.6. Services

3.6.1. Primary and supporting services

The following describes all primary and supporting services with regard to functionality, quantity and quality. In addition, corresponding service targets (service level) are agreed for each primary service, which must be achieved as an integral component of the contract.

3.6.1.1 Dashboard

A dashboard is available in which the customer can create, manage, extend, delete and monitor OpenStack resources. The dashboard also offers access to additional products and services.
Access to resources – similarly to the operation of a physical data centre – is only possible using a corresponding network or Internet connection. Within a customer network, the software makes it possible for us to distribute various resources among different locations.
• dashboard.syseleven.de

3.6.1.2 SSO

Authentication/Authorisation
An integrated identity and access management service with SSO is available for Public Cloud and additional products and services that we provide.
This software is responsible not only for simple authorisation, but also takes over the process of user authentication. Centralising the entire authentication process to a single identity provider facilitates the single sign-on method, among other benefits. The following APIs are available for the user:
• idp.apis.syseleven.de (users)

3.6.1.3 CLI Tools

The client (also known as OSC) is a command line client for the Public Cloud which compiles the command set for Compute, Identity, Image, Object Storage and Block Storage APIs into a single shell with a unified command structure. With this client, each customer can manage its resources in the Public Cloud:
• docs.syseleven.de/SysEleven-stack/en/howtos/openstack-cli

3.6.1.4 Documentation

We offer technical documentation to assist the user with the use of OpenStack services.
The availability of technical features and the nature of their use may differ between the regions, particularly in the areas of authentication and authorisation (IAM).

3.6.1.5 Public Cloud API

We provide access to the cloud functionality for developers based on REST (Representational State Transfer). The Public Cloud API can be used by established user accounts with the “Customer” type. The web service end points are:
• api.dus2.cloud.syseleven.net
• api.ham1.cloud.syseleven.net

3.6.2. Compute

3.6.2.1 Private Node Pools

With Private Node Pools, we offer the user the exclusive use of a group of servers that are virtually separated from the Public Cloud servers. For this purpose, multiple servers – at least 3+1 – are compiled into a Private Node Pool. In this context, 3 servers are intended for production operation and one additional server is provided as a stand-by replacement. The user then has exclusive access to the server resources and can create virtual servers on them as usual.
Individual flavours are also possible here, which are defined in collaboration. We provide advice regarding necessary features for operation in order to ensure qualities such as availability and live migration of VMs. Overprovisioning of CPU threads and positioning guidelines for VMs are also defined individually for a Private Node Pool.
For Private Node Pools, an individual service level agreement is established.
Note:

• Private Node Pools cannot be created or managed by the user. They are exclusively defined on an individual basis with the user during a project along with the corresponding operating parameters.
• VMs can only be migrated within a Private Node Pool.

3.6.2.2 Virtual server (VM)

The user has the option of hiring various resources as needed and compiling them into a virtual server (hereinafter referred to as VM). A VM comprises the following components:

• Memory (RAM),
• Virtual processor cores (vCPU),
• Storage,
• Network cards (optional).
• GPU (optional)

3.6.2.3 Flavours

There are pre-defined ratios between vCPUs and RAM, known as flavours. Provision of vCPUs and RAM is only possible in the ratios defined by the flavours.
VMs that provide one or more GPUs use non-virtualised Nvidia graphics cards with direct and complete access to the GPUs via pass-through mapping.
A list of the flavours offered in the regions can be found at:
• documentation.syseleven.de/en/products/syseleven-stack/concepts/flavors-catalog/

3.6.2.4 API

All end user functions (and some administrative functions) of Nova are provided in each region via a REST-API which can be used to establish more complex logic or automation with Nova. These can be used directly or via various SDKs.
• api.ham1.cloud.syseleven.net
• api.dus2.cloud.syseleven.net

3.6.2.5 Processors

When purchasing hardware, we make sure that the processor generations are always up to date. When calling up the processor generation, however, the oldest model in the region is always reported. This does not necessarily match the actual processor model. The customer has no option of selecting a particular model.

3.6.2.6 SSH key support

Our Public Cloud supports importing SSH keys. These can be uploaded via an OpenStack API endpoint or via one of the available dashboards.

3.6.3. Storage

3.6.3.1 Block Storage (volumes)

The block storage we provide, also known as cinder volume, enables the customer to access a redundant storage system. This system is 100% made up of enterprise level drives.
We rely on a purely software-based solution (software defined storage, hereinafter referred to as SDS). This SDS is a scalable, fault-tolerant distributed storage system. The SDS supports live migration from VMs and is integrated into the APIs provided by OpenStack, Cinder or Nova:

3.6.3.2 Block storage/cinder API

Cinder is a block layer service for OpenStack. It virtualizes the management of Block Storage and provides end users with a self-service API to request and consume these resources without requiring knowledge about where their memory is actually used or on what device type.
Block storage can also be used with multi-attachment volumes. This is useful, for example, to improve the scalability of app servers or to reduce single points of failure: If your system is dependent on a file system for storing information, e.g. images, you can use multi-attachment volumes to enable the file system for a series of VMs without requiring network storage solutions such as NFS.
• api.ham1.cloud.syseleven.net/v3/
• api.dus2.cloud.syseleven.net/v3/

3.6.3.3 Object Storage

Our Public Cloud offers S3-compatible object storage (compatibility refers here to the main attributes of an S3 API and therefore does not offer the same scope of functions as AWS). This stores and calls up any unstructured data objects via an HTTP-based RESTful API. Using data replication and an existing scaling architecture, storage is highly fault-tolerant. With corresponding access rights, access to object storage is established using the OpenStack API. The S3 API can be used with various S3 clients and/or SDKs.
With georedundant replicated object storage, the requirements for memory use are twice as high, since the data are automatically replicated into the corresponding associated region.

3.6.3.4 Local Storage

We offer local storage instances with a particularly low latency.
When one of the corresponding flavours is selected, a virtual server is generated on a server with local storage. We allocate these VMs to local storage according to the definition in the list of flavours with local storage. The following applies in this context:

• Local storage can be combined with our block storage/cinder
• Local storage instances cannot be expanded or reduced
• Local storage is not offered in all regions

Note:

• Local storage instances offer simple data replication onto the server where they operate.
• The user is responsible for ensuring the necessary backups.
• If access to a VM with local storage is no longer available, then access to the local storage is no longer possible either.

The list of flavours can be accessed at:
documentation.syseleven.de/en/products/syseleven-stack/concepts/flavors-catalog/

3.6.3.5 Snapshots

Users can generate copies of individual block storages, known as snapshots. It may be necessary to restart the VM in this process.
Two different snapshot types are available:

• Instance snapshots can be generated from instances that use network storage.
• Volume snapshots can be generated from each volume, whether from a root hard disk for an instance or from an additional volume.

Snapshots can be used as a template for new server instances.

3.6.3.6 Images

We provide a range of images. These are the current LTS versions of unmodified cloud images for

• Ubuntu,
• CentOS and
• Debian.

These are administered and promptly renewed when the manufacturer publishes new versions. Then they are automatically made available to the Public Cloud. The current list can be found in our documentation:
documentation.syseleven.de/en/products/syseleven-stack/
We reserve the right to add non-LTS and test or beta versions.
Note:

• We reserve the right to add non-LTS and test or beta versions.
• Please note the provider’s recommendations and do not use them for production purposes.
• We also discontinue EOL (End of Life) images and remove them from our portfolio.

3.6.3.7 Image upload

Our Public Cloud allows users to transfer and use their own images:
documentation.syseleven.de/en/products/syseleven-stack/usage/storage/images/

3.6.3.8 Glance

This OpenStack component offers a RESTful API which makes it possible to request VM image meta data and call up the current image:
• api.ham1.cloud.syseleven.net
• api.dus2.cloud.syseleven.net

3.6.4. Network

Our Public Cloud offers a network service. This also delivers an Internet connection.
We use a software defined network. In this way, each user is able to generate their own virtual network structure that is completely separate from the network structures of other customers. This relates to L2 services, broadcast domains, DHCP as well as L3 management: each customer is able to independently issue IP addresses in their own virtual network and there is no risk of collision with networks managed by other customers.

3.6.4.1 Network interface

Our Public Cloud makes it possible to equip virtual instances with network interfaces. Using these virtual interfaces is necessary in order to connect multiple virtual instances together or connect them to the Internet.

3.6.4.2 External network

We currently have an external network connection with a bandwidth of more than 400 Gbit/s (distributed over multiple locations).
Depending on the location, capacities are available for operating services that transfer data to or from the Internet. Thanks to a direct connection between the regions at the German location, the upstreams can be used across different locations.
The total capacities of the respective locations are described below.

Depending on the circumstances, the maximum external throughput can only be achieved with a corresponding upstream from the provider.

3.6.4.3 Internal network

Every hypervisor has a high availability 50 Gbit/s connection to the non-blocking switching fabric.
Our internal network comprises multiple IP networks, each structured redundantly. Each server has a redundant connection to the IP network.

3.6.4.4 Network sub-services

* Firewall functionality can be replicated with security groups (see below).

3.6.4.5 IP address management

We provide the user with public IP addresses which, depending on the intended use, can be booked permanently or during the existence of a virtual server. These IPs that we provide are only necessary if connections need to be established via the Internet. Internally, virtual machines can be networked freely. For this purpose, we offer a DHCP server which enables and simplifies the allocation of IP addresses. However, an independent addressing scheme can also be established.

Public IPv4 addresses
Virtual machines can access the Internet using a virtual router (SNAT). SNAT enables the simultaneous use of a public address (compared with private IP addresses) by multiple hosts. Typically, the router in the network adopts the SNAT which establishes the Internet connection (for this reason, this router is the default gateway for a host as a rule). In order to access the Internet with VMs and load balancers, we offer a floating IP service (DNAT). Destination network address translation (DNAT) is a NAT method executed for incoming IP data packages. NAT (network address translation) is a method used in IP routers that connects local networks to the Internet.
For Internet access, we offer the network “ext-net”.
Management can be handled via public OpenStack API endpoints as well as with user interface (GUI).

Security groups
A security group acts as a virtual firewall for a VM as well as other virtual resources. Security group rules specify the network access. These rules can also reference different security groups or refer to themselves.
If a security group is not specified, a default setup is provided. You can find more about this at:
documentation.syseleven.de/en/products/syseleven-stack/

Firewall groups
Firewall groups are not currently available for all customers. The functionality is described here:
documentation.syseleven.de/en/products/syseleven-stack/usage/networking/firewall-groups/

Private IPv4 addresses
Our cloud networks operate as a “virtual bridge”.
Simple allocation of one or more of our cloud subnets to a specific network is possible. Subnets can be used for managing IP addresses and configuring DHCP servers.
VMs and virtual routers use our Public Cloud stack port to connect virtual networks. A port is a connection point for a single device, such as a network interface card (NIC), to a network. The port also describes the associated network configurations, such as MAC and IP addresses. IP addresses need to be configured by the customer.
Multiple isolated layer-2 networks can be created. Different networks can also use overlapping IP address spaces if they are not connected to one another. To communicate between two networks, it is always necessary to use a router.
In our private network, any RFC1918-compliant IPv4 address can be used. – https://www.rfc-editor.org/rfc/pdfrfc/rfc1918.txt.pdf

Dedicated IP pool
On request, users can reserve their own dedicated IP pool from us with public IPs from which they dynamically operate their VMs. By default, the pool is an IPv4 /28 or IPv4 /27 subnet. Larger networks may be available on request.

3.6.4.6 Load Balancing – LBaaS

We offer users a Layer-7 load balancer service. The Layer-7 load balancer enables header insertion and PROXY protocol support. In addition, health checks are offered for all upstream instances that are members in both load balancer pools.

3.6.4.6.1 Customer public IP space (Bring your own IP)

In order to connect to the Internet without NAT, fixed IP addresses can be used instead of floating IP addresses. For this purpose, the user’s own public IP addresses must be brought along. These can easily be transferred into our Public Cloud network. Users can also use both address types in parallel.

3.6.5. Supporting Services

3.6.5.1 DHCP

For each network interface of a virtual server, we provide an IP configuration via DHCP.
The type of configuration differs depending on whether the network interface is connected to the public Internet or a private Ethernet.
Public Internet:
The following parameters are provided for configuration via DHCP:

• public IP address,
• network mask (255.255.255.255),
• gateway address,
• DNS server address and
• MTU

Private networks:
The following parameters are provided for configuration via DHCP:

• private IP address (10.x.x.x),
• network mask (255.255.255.0) and
• MTU

Our DHCP server always uses the address A.B.C.1 in the class C network corresponding to the assigned IP address.
Per network interface, the configuration via DHCP can be switched on or off. For newly created network interfaces, configuration via DHCP is switched on.

3.6.5.2 DNSaaS

We offer DNS as a Service. The user can use the following functions:

• Manage DNS records and zones with a highly available, authoritative DNS infrastructure across our five regions.
• API usage for various clients.
• Web interface for managing zones and records
• Secondary zones. Hidden master, and our DNS infrastructure acts as slaves.
• Import / export function with the master file format (RFC 1035)
• Zone transfer to various projects. This means, for example, that subdomains can also be managed in other OpenStack projects.

Available at designate.cloud.syseleven.net

3.6.5.3 VPNaaS

We offer VPN as a Service. The user can use the following functions:

• Possible connection of a private cloud with our Public Cloud
• Operation of geo-redundant setups
• Possible connection of public clouds from other providers with our Public Cloud
• Use of VPN networks in our Kubernetes products.
• Connection of back office networks (e.g. ERP in the protected company intranet) with the networks of our Public Cloud and
• Hybrid setups with us, in which workload is distributed across different platforms

3.6.5.4 DDoS Protection (optional)

Our customers’ infrastructure can be transparently protected against DDoS attacks at the network level if the customers have booked this chargeable service.

3.6.6. General Supportive Services

3.6.6.1 Operation

3.6.6.2 Regions

We currently have two regions (HAM1 and DUS2) with the latest expansion stage of our Public Cloud, one per location, in which the secunet cloud OpenStack Cloud is provided. The security requirements of the regions are subject to the ISO 27001 standard. The data is not forwarded to third parties (regions, countries). The regions are connected to each other. The bandwidth is more than 500 GBit/s.

Düsseldorf DUS2 – Region

Hamburg HAM1 – Region

3.6.6.3 Infrastructure components

Core Network
We operate a core network across all regions in Düsseldorf and Hamburg (as well as Berlin and Frankfurt) for a redundant connection of our Public Cloud. All services that we provide for this purpose are connected to the Internet via the core network. The core network consists exclusively of devices from well-known manufacturers. The core network is capable of transporting several 100 GBit/s thanks to modern fibre optic technologies.

OpenStack Cloud underlay network
We operate various 2x25GBit/s Ethernet networks at each location. All Ethernet networks are operated with state-of-the-art technology from well-known manufacturers. Our Public Cloud network connects nodes to ensure data exchange in the cloud.

Hardware Nodes
We operate nodes that represent the “Compute” and “Storage” products. All nodes consist of hardware from well-known manufacturers with many years of experience. Each of these nodes is connected to the 2x25GBit/s Ethernet network.

4 Added Services

Last updated: 17 November 2025

The use of these services is optional. Users can save themselves many tasks in managing standard software.
We offer various software as aaS. This allows the user to access software without having to install it themselves.
The scope of the workload reduction depends on the service.
The following descriptions extend or replace the descriptions in Chapter 2 Product-specific description IT services in “as a Service” model.
If deviating content is presented therein, this takes priority over the descriptions in Chapter 2 Product-specific description IT services in “as a Service” model.

4.1. Description secunet cloud OpenStack Cloud (formerly SysEleven OpenStack Cloud): DBaaS

4.1.1. Properties of the product

We provide functionality managed by us with which dedicated database management systems (hereinafter referred to as “DBMS”) are created, to which the user is granted access. It is the sole responsibility of the customer to manage each DBMS via configurations. The customer receives access to the Database-as-a-Service API (hereinafter referred to as “interface”) via which the customer can independently create and delete DBMS.
A list of the supported databases can be viewed online at:
documentation.syseleven.de/en/products/syseleven-dbaas/
DBaaS is a product with shared responsibility. The product is intended for experienced DBMS administrators.

4.1.1.1 Our tasks

• Provision and management of the interface for provisioning DBMS and for their deletion.
• Provision of an admin account on the DBMS.
• We provide DBMS with various basic configurations from which the user can select a suitable one.

4.1.1.2 Tasks of the user

Using the admin account, the user must perform all administrative tasks of a DBMS, e.g.

• Configure the DBMS
• Create and manage additional users
• Manage databases
• Capacity management and more

Users should have experience in operating DBMS.

4.1.2. Support

For this product, only product support in the Self-Service plan is available.

5 Product description – secunet cloud OpenStack Cloud (formerly SysEleven OpenStack Cloud): Kubernetes aaS (formerly MetaKube Core)

Last updated: 17 November 2025

The descriptions in this chapter extend or replace the descriptions in Chapter 2 “Product-specific description of IT services in the as-a-service model”.
If this chapter contains deviating provisions, these take priority over the descriptions in Chapter 2 “Product-specific description of IT services in the as-a-service model”.

5.1 Properties of the product

With Kubernetes aaS, we offer a managed Kubernetes environment as a shared platform. Users can use it to create and manage Kubernetes clusters in their projects.
The user is granted access to the corresponding APIs for using the IT service.
Kubernetes aaS is not operable on its own and requires services from our Public Cloud, which the user must order separately.
Kubernetes aaS worker nodes are displayed in the Kubernetes aaS GUI as regular IaaS resources.
Kubernetes aaS provides a ready-to-operate Kubernetes environment that provides the user with the configurations and functions typically required to operate their workloads. Users of Kubernetes aaS do not have to take care of providing Kubernetes themselves.
Compared to a self-operated Kubernetes environment, however, there are restrictions with regard to customisation options. These restrictions are necessary in order to be able to guarantee secure and stable operation.
Kubernetes aaS exclusively supports features from stable versions of the upstream Kubernetes project, so-called stable releases. Unless expressly documented elsewhere, Kubernetes aaS does not support alpha or beta versions – hereinafter referred to as pre-release versions – and their features. This also applies if these are available in the upstream Kubernetes project.
In the following exceptional cases, we may deviate from this approach:

• We have expressly asked the user to test new features.
• Features have been activated via a feature flag. In this case, users must expressly opt in to use these features. Further information on this is contained in the section on previews.

5.2 Areas of responsibility

Kubernetes aaS is not a fully managed cluster solution. For some components, such as worker nodes, there is a shared responsibility between us and the user. For certain administrative tasks within a Kubernetes cluster, inputs or measures by the user are therefore required.
A measure by the user may be necessary, for example, to fully apply a security patch for the operating system of a worker node.
All worker nodes are subject to the shared responsibility of us and the user. Users have the option of logging in to their worker nodes and making changes independently, for example performing kernel updates or installing or removing packages.
We advise all users against using this access for independent changes, unless we expressly request it. Otherwise, support for the affected worker nodes or clusters may be restricted or excluded.

5.2.1 Parts of the IT service managed by us

5.2.1.1 Platform

With Kubernetes aaS, the customer receives a fully managed graphical user interface (GUI) and a fully managed API. These include all components and services that the user needs to operate their Kubernetes clusters and make them available to their end users.
The managed Kubernetes control plane components include in particular:

• API server
• Controller manager
• Cloud controller
• etcd cluster
• Scheduler
• Machine controller

In addition, we monitor the following components, among others:

• Kubelet and Kubernetes API server
• etcd
• DNS services, for example CoreDNS
• Kubernetes proxy and network components

The services are considered managed because we provide and operate them and are responsible for their availability and functionality.
Users cannot modify these managed components themselves. The customisation options are restricted in order to be able to guarantee consistent, secure and scalable operation.

5.2.1.2 Worker nodes

As part of our responsibilities for Kubernetes aaS, we perform the following tasks in particular:

a. We provide automated operating system patches for the worker nodes. The specific procedure depends on the selected operating system image provided by us:

• optional for Flatcar, formerly CoreOS
• mandatory for Ubuntu

b. In the case of undefined or unclear states, we support the user in troubleshooting and in restoring the functionality of the worker node. If necessary, we support the provision of a new worker node.
c. We provide Kubernetes versions and test these in advance for their functionality within Kubernetes aaS.
d. We provide the packages required for Kubernetes version upgrades on the worker nodes.

Kubernetes aaS creates and manages backups in the form of etcd snapshots of the clusters. Based on these backups, a cluster can be restored or re-provisioned if required. Restoration takes place within the scope of a service request from the user.

5.2.2 Parts of the IT service managed by the user

5.2.2.1 Clusters and worker nodes

When creating a cluster, the user defines the Kubernetes worker nodes that are provided by Kubernetes aaS. The user’s workloads are then executed on these worker nodes. The user can configure the worker nodes within the scope of the described options.
The user is responsible for ensuring that neither their data nor their workloads are lost when making their own changes to the worker nodes.
Under certain circumstances, a worker node must be restarted to restore its functionality. An automatic restart generally does not take place unless it is part of an automated operating system update.
Depending on the selected IaaS provider, different procedures may be used. Further information can be found in the documentation of the respective IaaS provider.

5.2.3 Restrictions on the configuration of worker nodes

As an as-a-service, Kubernetes aaS requires certain network configurations and connectivity options.
Adjustments to network security group rules, the blocking of certain ports or the use of block or allow lists can result in Kubernetes aaS no longer being able to manage the affected worker nodes.
It is not permitted to completely block outgoing data traffic. If the user has completely blocked outgoing data traffic, it is their responsibility to reverse this change.
Support for the affected worker nodes may be suspended until the required network connections have been restored.

5.3 Product-specific tasks of the user

5.3.1 Installation of updates

We do not automatically restart worker nodes in order to fully apply patches at operating system level. Although the operating system patches are provided by us on the worker nodes, the user is responsible for any necessary restart of the worker nodes.
For Flatcar images, the user can configure and automate restarts.
With Ubuntu, a restart is generally not required. Shared libraries, daemons such as the SSH service and other components at system or operating system level are patched automatically.
The user is responsible for performing Kubernetes version upgrades. The upgrades can be performed via the Kubernetes aaS GUI or the API. This applies both to security-relevant updates and to updates to improve the functionality of Kubernetes.

5.3.2 Configuration of worker nodes

Users can extend the default configuration of their worker nodes. For example, they can use Secure Shell (SSH) to configure worker nodes like regular virtual machines.
However, the underlying operating system base image should not be modified.
Changes made by users may not be retained when upgrades, scaling, updates, restarts or recreations of the worker nodes are performed.

5.3.3 Images

Users can create their own base images supported by Kubernetes aaS and use them within Kubernetes aaS.
The user is responsible for the correct functioning of a self-created operating system image within Kubernetes aaS.
We do not provide support for self-created images and the clusters operated with them.

5.3.4 Allocation of IaaS resources

Kubernetes aaS manages the life cycle and operational processes of the worker nodes on behalf of the customer.
The user makes changes to the IaaS resources assigned to the worker nodes themselves via the Kubernetes aaS GUI or the API.

5.3.5 Workload-specific configurations

For workload-specific configurations or packages, we recommend the use of Kubernetes DaemonSets:
https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
By using privileged Kubernetes DaemonSets and init containers, users can install, update or configure third-party software on cluster worker nodes.
Examples of such adjustments are the installation of custom software for security scans or the adjustment of sysctl settings.
This approach is recommended when corresponding workload-specific adjustments are required.
However, our support cannot assist the user in diagnosing or resolving problems caused by faulty or otherwise unsuitable changes to customer-provided DaemonSets or init containers that result in a worker node no longer being available or functional.

5.3.6 Applying cluster patches

The user is responsible for any necessary restart or update required to fully apply a cluster patch provided by us.
If the user does not apply provided patches in accordance with the instructions for Kubernetes aaS, the cluster may remain vulnerable to security issues that the patches are intended to resolve.

5.3.7 Applying kernel updates

Kernel updates are installed by recreating worker nodes using a correspondingly updated image.
For this purpose, we provide a rolling update mechanism that must be triggered by the user.
The user is responsible for configuring their services in such a way that possible impairments or outages during a rolling update are avoided as far as possible.

5.4 Resolution of malfunctions and security incidents

In many cases, the user’s workloads continue to run even if Kubernetes master or control plane nodes, etcd or other components managed by us fail.
If a serious security problem, for example with a rating of “Remote Code Execution”, occurs in one or more components of Kubernetes aaS, we will patch the affected clusters to resolve the problem. Alternatively, we provide users with instructions for a required upgrade.
For worker nodes affected by a security problem, we apply a patch without interruption of operation – if available – and inform users of the change made.
If a security patch requires a restart of the worker node, we inform the affected users of the necessary measure.

5.5 Support

Worker nodes execute the user’s private code and may contain private, confidential or personal data.
Our support accesses worker nodes only in a restricted manner, after express authorisation and at the user’s request, in order to assist with the analysis and resolution of a problem.
We have implemented technical and organisational measures to prevent unauthorised access to worker nodes.
We provide support in accordance with the applicable support policies. The provisions relate to our Public Cloud offering in the role of IaaS provider.
No support is offered for Kubernetes aaS worker nodes operated with other IaaS providers. The user is advised to consult the documentation of the respective IaaS provider.
Within the scope of technical support for Kubernetes aaS, we do not offer support for worker nodes that are not operated within our Public Cloud offering.

6 Glossary

Last updated: 17 November 2025

6.1. General

Instance
A virtual server or a virtual machine (VM).
Region
A region is located in a data centre characterised by a unique geographical location. Currently, we have one region per data centre.
Floating IP
IP address that can be assigned to an instance so that it is reachable from the Internet.
Flavour
Instance type and a defined size of vCPU/RAM from a flavour family (ratio between vCPU and RAM, e.g. 1:2, 1:4, …)
On-Demand Buffer
Flexibly usable resource buffer with billing according to actual use, per hour.
Quota
Individually agreed upper usage limit of resources. Can be flexibly adjusted via a request to support.

6.2. Storage

Volume
Volume refers to a virtual device (medium, drive, disk, …) also known as network storage. Volumes are free of data on handover.
Snapshot
Snapshots capture a state of a volume. Snapshots are not always complete copies of the volume. They always remain assigned to the volume. Volume snapshots can be created from any volume. Root volumes are excepted.
Image
Images are provided for initialising network volumes and local storage volumes. These are pre-configured operating systems. Images can also be uploaded as a file (ISO images, installation CD) or created from volumes or snapshots.
Block Storage
Volume storage – designed as network storage.
S3 / Object Storage
represents an API that configures so-called buckets and makes them available to the user. The user can then place their objects in them. The API is based on an AWS definition.
Root Volumes
A special form of block/network storage. Usually set up as an operating system partition. The size of the root storage is fixed and is determined by the flavour. It is not counted towards the quota.
Distributed Storage
Distributed storage. The data is distributed across all existing nodes using a software defined storage (SDS). Data is replicated through special coding or triple replication.
Local Storage
A root volume is assigned directly to a virtual machine. The root volume is located on the same physical node. Local storage is highly performant storage for VMs with low latency.
HDD
Hard disk drive, rotating hard disk, high storage density on the medium, but requires mechanics, longer access times
SSD
Solid state disk, storage without rotating parts, fast access times, low latencies
NVMe
NVMe stands for “Non-Volatile Memory Express” and is a modern transmission protocol specifically for SSDs. It uses the PCI Express (PCIe) interface and thereby enables speeds many times higher than classic SATA SSDs.

6.3. API

API – Application Programming Interface
A standardised interface that enables user access and forms the basis of customer-side automation.

6.4. CPU

Core; CPU
Processor core
vCore; vCPU
Virtual processor core

6.5. Date/time

Month
Calendar month

secunet cloud (formerly SysEleven) Product descriptions Managed Services

1. Individual, managed IT services

Last updated: 17 November 2025

The following content describes the product “Individually managed IT services”. This product enables the user of our Public Cloud to hand over the operation of individual software in a project to us.

1.1. Product description

We operate an individual IT service and, if additionally agreed, carry out coordinated actions in the event of a malfunction of the IT service, which are defined in an operations manual.
The product is installed on our platforms and operated using our tooling.

1.1.1. Our tasks

As part of the operation, we assume responsibility for the availability of the IT service under the conditions of the agreed Service Level Agreement and take on the following tasks for the IT services:

• Life cycle management
• Configuration according to best practices or according to the contractual partner’s specifications
• Alerting
• Monitoring
• Trending
• Backup

We work

• according to standardised operating processes,
• according to the agreed SLA and
• according to an agreed operating concept.

Usually, we install the IT services to be operated ourselves. If an already existing IT service still managed by the user is to be taken over into operation, this installation is checked by us before commissioning.
We support the user in the interaction of the IT services operated by us and by them insofar as we act as administrator of the IT service operated by us and, for example, analyse log files for troubleshooting or performance optimisation at the user’s request.

1.1.1.1 Standard software

We offer the operation of a range of standard software that follows our best practices for configuration, maintenance and troubleshooting. The user receives the currently supported software from their contact person. A list of the currently supported software and further detailed information can be viewed here:
documentation.syseleven.de/en/products/metakube-operator/managed-services/

1.1.1.2 Individual software

For individual software, we optionally offer operation according to an operations manual.
The following applies:

• We provide a template for the creation of the operations manual by the user and support the user in filling out the template.
• The user alone is responsible for the actions described in the operations manual and their effects that are carried out by us.
• For actions on the basis of an operations manual, we guarantee the execution without guaranteeing the success of the described actions.

To maintain the availability of the managed IT service, we can respond to unforeseeable situations without consulting the user and

• make configuration changes to the IT services and
• restart IT services
• view customer data, e.g. in log files

As a user, you agree to this in advance. This consent cannot be revoked, as it is a mandatory prerequisite for our provision of services.
The user agrees to billing on the basis of working hours performed according to the price list plus any material costs incurred for carrying out these measures. When carrying out these measures, we will ensure that the proportionality of the contract value and the costs of implementation as well as any consequential costs is maintained.
The user receives access data to a front end in which they can view how many resources are consumed by the software in use.

1.1.2. Tasks of the user

The user supports us in operating the IT services by providing documentation, personnel and other necessary information. In particular with

• troubleshooting throughout the entire period agreed in the Service Level Agreement for the availability of the IT service by providing a contact person
• the selection of the configuration of the IT service by specifying operating parameters such as quantity structures for the expected load on the IT service.

Should the support not be provided to the necessary extent, the user releases us from our tasks.

1.1.3. Forced termination of the product

If updates of software required for the IT service are no longer developed, the product is in the “End of Life” (EOL) status. This leads to restrictions in the operational responsibility assumed by us and can lead to the complete handover of operational responsibility to the user.
If the necessary prerequisites for the product are no longer met, we reserve a right of termination for this situation and this product.

1.2. Changes to the object of performance (change request procedure)

The object of our service sometimes requires changes to the configuration of the IT service or to the amount of resources assigned to the IT service. In the following, we describe how a change is carried out.

1. All change requests are to be requested directly via the standard reporting channel. Change requests are accepted on working days, from Monday to Friday between 9:00 a.m. and 5:00 p.m. and documented in the ticket system.
2. Such a change request must contain at least the following information:
   – Description of the desired change;
   – Purpose of the desired change;
   – Special circumstances and background to be considered with regard to the desired change;
   – Urgency of the desired change.
3. We then check without delay what effects the desired change will have on the contractual performance structure, in particular with regard to the agreed remuneration. If we determine that the change request can be implemented without further ado, the implementation is carried out and documented in the ticket system.
4. We check all change requests of the user to configurations or the type of service to be provided with regard to compliance with the provisions specified in the agreed SLA. If the user’s change request restricts availability, we have the right to reject the user’s change request and will, where possible, develop proposals that take up the user’s wishes but do not restrict availability.
5. If this is not possible, the user releases us from granting a credit due to non-compliance with the availability of the affected components.
6. If we determine that services to be provided cannot be carried out, or can only be carried out with delay, due to the expected review effort for the change, we inform the user of this and point out that the change request can only be reviewed further if the affected services are postponed accordingly. If the user consents to this postponement, we carry out the review of the change request. If, on the other hand, the user withdraws their change request, the initiated change request procedure ends.
7. Insofar as the change request cannot be implemented immediately and without additional consultation with the user, we will present the user with the effects of the change request on the agreements made after reviewing the change request. The presentation contains either a proposal for the implementation of the change request or information on why the change request cannot be implemented. The parties will coordinate without delay on the content of a proposal for the implementation of the change request and fix the result of successful coordination in a supplementary agreement. If no agreement is reached or the change request procedure ends for another reason, the original service content and scope remain. (Such supplements only exist in exceptional cases. The business is too dynamic for this in many cases.)
8. The user shall bear the expenses arising from the change request. This includes in particular the expenses for reviewing the change request, creating a change proposal and any downtime. The relevant hourly rate is based on the price list valid at the time the contract was concluded.
9. We are entitled, to ensure the provision of our services under this contract, to change their scope or deviate from them and in particular to enable larger volumes, even without a previously explicitly issued order from the user. We will notify the user of such changes without delay after they have been carried out. The user can reject the changes or deviations or additionally provided services after notification. If the user does not object to the changes or deviations within two weeks of receipt of the notification after corresponding notification by us, we bill the services provided according to the price list valid at the time. If the user does not object within the aforementioned period in text form, the change, deviation or additionally provided service is deemed approved.
10. If the service has to be modified due to a cooperation action not carried out by the user, in particular due to the correction of information already provided prior to acceptance or as a result of the subsequent submission of information, this is deemed a change of service in accordance with the above provisions.

1.3. Maintenance work

Planned maintenance work that impairs availability is communicated specifically to the affected users, 7 working days in advance as a rule.

1.4. Backups

We create backups for IT services operated by us and the customer data they contain in a 7-day, 4-week and 3-month scheme, provided this is supported by the software of the IT service.
The user releases us from creating the backups if, due to the type and amount of data, it is not possible to carry them out at the planned intervals. Should this case occur, the user is informed.

1.5. Customer data

Customer data refers to all information that the user transfers to our systems while using the product, or engages to be transferred by authorised persons or systems. The administration of customer data is the responsibility of the user.

1.5.1. Erasure of customer data

Each user will erase customer data independently and promptly when it is no longer required. If there is any remaining data after the end of the contract, we will erase this no later than after 7 days.

1.5.2. Unannounced access to customer data by us

If it becomes necessary due to unforeseeable events for us to inspect customer data in order to perform the contract and this was not authorised by the user in advance, we will inform the user afterwards regarding the following details according to the best effort principle:

• What was accessed?
• Who had access?
• When and for how long did access occur?
• Why was access necessary?

1.6. Support

We provide support for managed IT services that are not part of the user’s production environment (usually development (DEV) and staging (STAGE) environments) exclusively during daily working hours.

1.7. Cessation of use

On request and if included in the product, we provide the user with backups of the product’s customer data in a common format. This concerns exclusively such data that was stored on our systems by the user through the use of the product.
The handover of the data must be requested by the user no later than four weeks before the end of the contract or cessation of use – whichever occurs first. If no timely request is made, timely provision of the data by the end of the contract cannot be guaranteed. The handover itself can – depending on internal resource availability – also take place after the end of the contract. A claim to data provision only exists if the request was submitted in due time.

2. Sets of managed IT services

Last updated: 17 November 2025

With this product, the user can have several related IT services operated by us (hereinafter referred to as core setup). The added value compared to the operation of individual IT services lies in the agreement of an availability across the entire core setup.
This description supplements the product description “1 Service description for individual, managed IT services” with the necessary explanations for this.
Should content contradict in whole or in part, the content in this description takes priority.

2.1. Product description

The operation of the entire setup (core setup and all other IT services) takes place exclusively on our platforms and follows the model of shared responsibility.
The user uses our tooling to enable operation that is as smooth as possible.
Additional IT services outside the core setup are excluded from responsibility by us.
Installation or configurations of IT services by the user may only take place in consultation with us insofar as our area of responsibility is affected. In particular, the error-free interaction of all IT services following the changes by the user must be ensured here. Should this result in expenses on our part, these are charged to the user.

2.2. Areas of responsibility

As a rule, in addition to the core setup, there are further IT services (typically the applications) that are operated by the user. For this reason, the management of the entirety of services takes place in a model of shared responsibility, where the user and we each bear responsibility for the IT services taken over and act jointly and by arrangement at the interfaces of the IT services.

2.2.1. Our tasks

2.2.1.1 Retrievability of the data

We keep the data of the user’s core setup stored in accordance with the contract constantly, worldwide and generally publicly retrievable on the Internet via the network maintained by us and the Internet connected to it, unless otherwise agreed. Further provisions on this are laid down in the agreed Service Level Agreement.
We assume no responsibility for the success of the respective access to the website, insofar as not exclusively the network operated by us, including the interfaces to third-party networks maintained by it, is affected.

2.2.1.2 Provision of tooling

We provide tooling with which the core setup is jointly managed, for example an interface with which the user can independently install and manage further IT services of the setup.

2.2.2. Tasks of the user

All tasks for IT services outside the core setup remain fully with the user.

3 Glossary

See Service Level Agreement

secunet cloud (formerly SysEleven) Service Level Agreement

Part 1 – General

Last updated: 17 November 2025

This Service Level Agreement (hereinafter referred to as “SLA”) describes the service levels agreed between us and the user for the IT services provided by us. It applies in addition to the product-specific descriptions and the General Terms and Conditions.
Unless a separate SLA has been agreed for a product, the following general provisions apply.

Part 2 – Availability

2.1. Definition of availability

Availability describes the ratio of the actual operating time of an IT service to the agreed operating time within a calendar month, expressed as a percentage.

2.1.1. Availability of the infrastructure

The availability of the infrastructure of our Public Cloud is 99.9 % per calendar month, unless otherwise agreed in the contract.

2.2. Calculation of availability

Availability is calculated according to the following formula:
Availability (%) = (agreed operating time − downtime) / agreed operating time × 100
In particular, times in which the IT service is not available due to planned maintenance work, force majeure or due to circumstances within the user’s area of responsibility do not count as downtime.

Part 3 – Response and service times

3.1. Service times

The service time (daily working hours) comprises working days from Monday to Friday, 9:00 a.m. to 5:00 p.m., excluding nationwide public holidays as well as 24 December and 31 December.
For malfunctions affecting availability, an emergency hotline is also available.

3.2. Response times

The response time is the period between receipt of a malfunction report via the standard reporting channel and the first qualified response by us.

3.3. Prioritisation

The classification of the priority is carried out by us based on the effect of the malfunction on the operation of the IT service. The user contributes to the classification by describing the malfunction as precisely as possible.

Part 4 – Maintenance

4.1. Planned maintenance

Planned maintenance work is generally announced 7 working days in advance, at least on the status page. Planned maintenance work does not count as downtime within the meaning of the availability calculation.

4.2. Emergency maintenance

In urgent cases, in particular to avert security risks, we reserve the right to carry out maintenance work even without prior announcement. The user is informed as soon as possible.

Part 5 – Credits for non-compliance

5.1. Entitlement to a credit

If the agreed availability is not reached in a calendar month, the user can claim a credit. The claim must be asserted within ten (10) working days of the end of the affected calendar month via the standard reporting channel.

5.2. Amount of the credit

The amount of the credit is based on the extent of the shortfall in the agreed availability and is regulated in the respective product-specific description. Credits are exclusively offset against future fees and are not paid out.

Part 6 – Obligations of the user to cooperate

The user provides us with the information, access and contact persons required to provide the service. If the user fails to fulfil their obligations to cooperate, response and service times are extended accordingly, and a claim to a credit lapses for the affected period.
The user names to us the contact persons relevant for the operation of the applications and keeps their contact details up to date.

Part 7 – Liability

Liability is governed by the provisions of the General Terms and Conditions Cloud. Credits under Part 5 are conclusive and constitute the user’s sole claim due to non-compliance with the agreed availability, unless we are at fault through intent or gross negligence.

Part 8 – Changes to the SLA

Changes to this SLA are governed by the provisions on the amendment of the contractual provisions in the General Terms and Conditions Cloud.

Part 9 – Glossary

Working day
Working days are the days Monday to Friday within the service time. Public holidays do not count as working days.
Service level
The service level is the description of the type and scope of the service, its quality and availability.
Service Level Objective (SLO)
An SLO consists of metric, target (availability) and period.
Year
A period of 365 calendar days or 8,760 hours in which the service is provided. The first year begins on the day the service is made operationally available and ends 365 days later.
Recovery time
The recovery time is the period within which the availability of a product is restored to its initial state within our area of responsibility. Restoring the state at the time of the failure, e.g. by importing user data from a backup, is not included.
The times for restoring the state at the time of the failure depend, among other things, on the type and scope of the data in the setup and the cooperation of the user and can therefore not be defined in a generally valid manner.
Response time
Refers to the time that elapses until confirmation of an incoming malfunction report by an employee authorised by us.
Start of work
Is defined as the time that may elapse after the response notification by us until the resolution of the malfunction begins.
Malfunctions (incident)
A malfunction (incident) is an unplanned interruption or reduction in quality of a service.
Contract value
For invoice items paid monthly in advance, the contract value is the amount to be paid monthly for the IT service to be provided.
Service times
The service times correspond to normal office hours and apply Monday to Friday from 9:00 a.m. to 5:00 p.m., excluding public holidays in Berlin. We reserve the right to adjust the service times after prior announcement.
Night and weekend times
All times outside the defined service times (see above).
Best effort
We strive to achieve the best possible result within the scope of the available technical possibilities and resources.
Replacement solution
Replacement solutions are all products held redundantly by us (including in other regions) or specific alternatives offered in the event of a malfunction which remove the impairment of a malfunction of error class A or reduce it to such an extent that error class A is no longer present.
A replacement solution also exists if the control plane allows the user to set up new instances of the software affected by a malfunction and import their data.
Dev environment
Dev environment refers to software installations used by the user’s developers to develop their production environment.
Stage environment
Stage environments serve the acceptance of changes to the production environment. These can be used both by the user and by us for testing purposes.
Production environment
The production environment comprises all software installed by the user or by us on behalf of the user that is required to realise the user’s service.
Control plane
Control plane refers to the interfaces that the user uses to set up and modify their environments.
Service handover point
The service handover point defines the point at which our area of responsibility ends. As a rule, this is the communication interface of a software via which it can be used.
Emergency
A malfunction of category A.