Our role in protecting your data on our managed hosting products

A component of our Shared and Dedicated Managed hosting products is the storage of customers’ Website and Email data. As we store the data, under data protection law we are viewed as a processor (or operator) of the data for our customers who are called controllers (or responsible parties).

We have no knowledge of the actual data that our customers store on our hosting platform, which may include personal data. As we have no involvement with the data other than storing it, our obligations relating to data protection law in this context are limited.

Contrast this to the personal data identifying our customers that we store in our customer database; here we are fully obligated under the data protection law as a data controller.

An example:

When a customer signs up with us, they voluntarily provide us with their personal data as part of the signup process. We have full knowledge and control of this data. If a customer requests that we make visible to them what data of theirs we have, we are able to do so. Customers are able to independently access contact and banking details associated with their hosting accounts and update or remove this data via the control panel.

When a customer uploads their Web application and associated data to our managed hosting platform, we don’t know the type nor the content of the data uploaded. Should our customer, in turn, store their end customer’s personal data, only our customer can make visible to the end customer what data about them is stored. Here the end customer is the controller, our customer the processor and we are the sub-processor of any personal data.

Our security obligations and how we fulfill them

We are obliged to implement appropriate technical and organisational measures to prevent a breach into our managed hosting servers which may allow access to personal data stored on the servers.  We have always viewed this as an obligation on us, and therefore at a technology level, data protection law does not change anything for us in the context of these products.

Our servers are managed in accordance with security best practices for servers on the internet, providing a mass-market managed hosting service.

1. We do not run any services on our servers that are not required to deliver the hosting service. Having extraneous services active on a server increase the attack risk unnecessarily.
2. We apply software package security updates provided by our Linux distribution (Debian) as follows:
   1. Non-critical updates are applied within a week of release.
   2. Critical updates are aimed to be applied within 24 hours of release.
3. We do not store customer’s mailbox, FTP or MySQL database passwords in cleartext.
   1. Passwords are stored using a salted, one-way hashing algorithm.
4. Vulnerability scans and penetration tests are performed against our managed hosting servers and any critical issues exposed are resolved as a priority.
5. Firewalls are employed to restrict access to any services on the servers which are not purposed for public consumption.
6. Various intrusion detection mitigation systems are employed at the server level.
7. A basic Web Application Firewall is employed to mitigate a certain degree of relevant attacks.
   1. An advanced Web Application Firewall (Cloudbric) is available as an optional extra for customers who store particularly sensitive data.

Encryption of data stored by customers on our Managed Servers

We do not encrypt any data stored by customers on our managed servers. The reasons for this are:

1. The controller of the data (ie. our customer) is the only one positioned to know whether or not data should be encrypted.
2. Our view is that the most effective place to encrypt personal data is at the point where the controller is able to affect the encryption (and decryption).
   1. Sensitive emails should be encrypted at the source and decrypted only by the recipient (i.e. utilising asymmetric key pair encryption)
   2. Web application files and database tables should be encrypted and decrypted by the Web application itself

To help you protect yourself and your business, we’ve put together a guide outlining everything you need to know about phishing.