Terms, Privacy and Data Processing

Server Watch Terms of Service

Version: 2026-10-25-v10.5. Published on 25 October 2026. In force from: 25 October 2026.

Important — please read before you buy: 1. The Service is for businesses and professionals only (clause 2). 2. Server Watch is an AI-driven service. An AI model reads your server and, in the repair phase, may make changes, always after a backup of what it is going to touch and only within a plan of action that you have accepted; the process is supervised in general by people of Bitshard, but no person approves each command or each change before the AI runs it (clauses 7.1 and 7.6(b)). You decide which data are on your servers and, as controller of the personal data on them (or as the processor authorised by your own clients), you instruct us to use the AI models of the AI providers listed in the DPA, or our own model, which we choose and may change among those listed. Some providers keep part of the data for their own purposes and as controllers (for example, content that their systems flag as abuse), for the periods set by their own terms, which are linked in the DPA and which we do not control or guarantee; you authorise that disclosure on your own legal basis and you compensate us for the claims of third parties that arise from it (clause 18.1(f)). You are responsible for those data and for having informed the people concerned (clause 7.1(g)). 3. Once the work on a Health Check or an Emergency Clean-up has started (the first recorded diagnostic action on your server), the price is due also if you cancel; we deduct only what we save, and what we earn or could reasonably have earned from other work, by not finishing it. If you do not give us working read access and administrator access within 15 Business Days of the email in which we send you the instructions and the installation package, the Contract ends and the price is not refunded (clauses 11.2, 11.3 and 11.6). Your rights if we fail to perform are not affected. 4. If something is deleted or damaged by mistake, including by an error of the AI, the first remedy is that we restore it, at no cost, from the backup that we take before making changes, which covers what the Repair is going to touch and is kept on the disk of your own server (so it is lost if that disk fails or an attacker changes it) or, if there is no room there and you have backups of that server contracted with us, with those backups; beyond that, our liability is limited to the price of the service, and we are not liable for data that you chose not to back up. These limits do not apply in the cases of clause 17.1 (for example, gross negligence or intent). If the disk of your server does not have enough free space for that backup and you have no backups of that server contracted with us, you make your own backup or accept the risk in writing, and the Repair does not start until you do (clauses 7.6(c) and (d) and 17). 5. These Terms limit our liability to the price of the service concerned, with the exceptions of clause 17.1 (clause 17), choose Estonian law and the courts of Estonia (clause 26), and are applied with the protocols of Schedule 3. All prices are charged in euros (clause 10.1).

1. Who we are and what these Terms cover

1.1 Server Watch is a service of Bitshard OÜ, a private limited company registered in the Estonian Commercial Register under registry code 17275103, with its registered office at Kotkapoja tn 2a-10, 10615 Tallinn, Estonia, and VAT number EE102906167 (“Bitshard”, “we”, “us”). Contact: info@bitshard.eu.

1.2 These Terms of Service (“Terms”) apply to every service we sell under the Server Watch name. Your contract with us (the “Contract”) is made up of:

1. these Terms, including Schedule 1 (Service descriptions), Schedule 2 (Authorization Form) and Schedule 3 (Protocols);

2. your Order: the product, the number of servers and the price you choose at checkout or in a written quote we send you;

3. your Authorization Form (Schedule 2): for the Health Check and the Emergency Clean-up, the data and the acceptance box of our payment page, the information that you give us on our acceptance page or send us by email and your acceptance of each plan of action; for Watch and Managed, the complete form. It identifies the servers, IP addresses and domains we may work on, what we may do on each of them and the options you choose;

4. the Data Processing Agreement (the “DPA”) published at https://www.bitshard.eu/legal.html#dpa, which governs the personal data we process on your behalf;

5. our Price List published at https://www.bitshard.eu/legal.html#prices, in the version in force on the date of your Order.

1.3 If these documents conflict, this order applies: (1) the DPA, for anything concerning personal data; (2) the Authorization Form, for what we may do on each server; (3) the Order and the Price List, for price and quantity; (4) these Terms. A term agreed individually with you in writing prevails over all of them.

1.4 Services available now. At the date of this version, only the Health Check and the Emergency Clean-up can be ordered. Watch, Managed and the agency plan are described in Schedule 1 so that you know how they will work; they can be ordered only when we announce them and publish a new version of these Terms. Until then, the clauses that concern only those plans do not apply to you.

2. Business customers only

2.1 We sell only to businesses, professionals and other organisations that buy the Service for the purposes of their trade, business, craft or profession. By accepting these Terms you confirm that you are buying for those purposes and not as a consumer. This restriction does not take away any mandatory right that the law gives you if you are, in law, a consumer. The standard Service is not designed for organisations that are subject to Directive (EU) 2022/2555 (NIS2) or to sector rules with deadlines for notifying incidents to an authority; we provide it to them only under an individual written agreement that sets those obligations and their price.

2.2 Who you are. On the payment page you give us your company name and address and, if you are established in the European Union outside Estonia, your VAT identification number; by accepting these Terms you confirm that you buy as a business (clause 2.1). The work may start before we have checked these data. We may check them at any time, as described in Schedule 3, protocol P1, for example in VIES (the European Commission’s service for validating VAT numbers). If the VAT number is not valid, we invoice you with the VAT that applies, where the law allows it, or we cancel the Order and refund what has not been performed. We may refuse or cancel an Order if we have reason to believe that the buyer is a consumer; if we cancel for that reason, we refund everything you paid.

2.3 The person who accepts these Terms confirms that they are authorised to bind the organisation named in the Order.

2.4 Sanctions. You confirm that neither your organisation, nor any person that owns 50% or more of it or controls it, nor the Customer Servers or the services they host, are subject to sanctions or restrictive measures of the European Union, the United Nations, the United States or the United Kingdom, and that your organisation is not established in a country or territory under comprehensive sanctions of the European Union; you tell us at once of any change. We check this as described in Schedule 3, protocol P11. We may refuse an Order, or suspend or terminate the Contract immediately, if this confirmation is untrue or ceases to be true, or if providing the Service would breach those measures; we refund the price of what has not been performed to the extent that those measures allow it.

3. Definitions

Words in bold have the following meaning:

• Service: the services described in Schedule 1 that you order.
• Customer Server: each machine with its own operating system (a virtual private server, a virtual machine or a physical server) listed in your Authorization Form. Containers running inside it are not separate servers. Each Customer Server includes up to 5 websites or applications; each additional one is charged as shown in the Price List.
• AI Provider: a company other than Bitshard whose artificial-intelligence model Bitshard uses in the Service, with Bitshard’s account at that company, and which is listed as AI Provider in Annex IV of the DPA (at the date of these Terms, Anthropic, OpenAI and Mistral AI).
• Own Model: an artificial-intelligence model that Bitshard runs on infrastructure that it controls, without sending the data to an AI Provider; the provider of that infrastructure is listed in Annex IV of the DPA.
• AI Model: the artificial-intelligence model used in the Service: a model of an AI Provider or an Own Model. We choose the AI Model and the AI Provider among those listed in Annex IV of the DPA and may change them at any time without notice; you do not choose them, and the Service does not show which one is used. On request, we tell you which one processed the data of a given work (DPA, clause 11.1).
• Diagnosis: reading and analysing a Customer Server to find out its state, what is wrong and how it happened.
• Repair: the changes made on a Customer Server to fix what the Diagnosis found.
• Prior Backup: the copy of what a Repair is going to touch under its plan of action, taken before the Repair changes anything on a Customer Server and kept on the disk of that server or, in the case of clause 7.6(c)(i), with the backups of that server contracted with us (clause 7.6(c)).
• Large Data Volume: the case of clause 7.6(d): the free space on the disk of the Customer Server is not enough for the Prior Backup, and you have no backups of that server contracted with us.
• Bitshard Access: the two SSH accesses that you give us on each Customer Server (clause 6.7(a)): a read access, through a user without administrator rights, and a repair access, through a user with administrator rights (sudo). Each accepts only one key of Bitshard, and only from the IP address of Bitshard’s central server (Schedule 2, point 4). The keys have no end date on your server. In Watch and Managed we change them every 6 months and whenever we suspect that one may have been compromised (clause 6.7(a)(iii)), and the access is used for as long as the plan lasts. At the end of each order we destroy our copy of the private keys (clause 19.4(c)); from then on, the users that remain on your server let nobody in, and only you can remove them, with the removal program (uninstall). You can see the access and remove it at any time.
• Deep Check: a reading session on a Customer Server through the read access of the Bitshard Access, with the AI Model, to check what the Watcher cannot check with its fixed functions (clause 6.7(b)).
• Read-only command: a command run on a Customer Server through the read access, that is, by the read user, which has no administrator rights. Such a command cannot change the configuration, the programs, the users or the services of the server; it can read what that user can read (which may include files that every user of the server can read, such as a configuration file with a password) and, like any user of the server, it can run programs, write its own temporary files and open network connections.
• Watcher: the program of Bitshard that we ask you to install on each Customer Server for Watch and Managed (our website may call it “our agent”). It sends inventory, metrics and logs to the Platform over an encrypted connection that it opens itself, and it only runs the fixed read functions described in clause 7.2. It does not open any port on your server and does not run changes.
• Platform: the servers and software that we operate to provide Watch and Managed.
• AI Investigator: the part of the Platform that uses the AI Model to analyse alerts, gather evidence with read-only functions and draft reports.
• Action Catalogue: the closed list of pre-written and tested programs that can change something on a Customer Server, for example applying an update, blocking an IP address, stopping a process, moving a file to quarantine or restoring a snapshot.
• Approved Action: an action from the Action Catalogue, with its exact parameters, that you have permitted under clause 7.8 (or pre-authorised in the Authorization Form for the cases of clause 7.5) and that an operator of Bitshard has confirmed before it runs (clause 7.4).
• Patch Run: an Approved Action that takes a snapshot or copy, applies one or more updates, checks your sites and rolls back automatically if the checks fail.
• OS Automatic Updates: the automatic security-update function of your operating system (for example unattended-upgrades on Ubuntu and Debian).
• Maintenance Window: the weekly time slot set in your Authorization Form in which non-urgent changes are made.
• Business Hours: 09:00 to 18:00 Central European Time (CET/CEST, the time of Berlin, Paris or Madrid), Monday to Friday, except the national public holidays of Estonia. For most of the year this is 03:00 to 12:00 New York time.
• Business Day: a day with Business Hours.
• Customer Data: all data that the Watcher, our engineers, the AI Model or the Platform obtain from Customer Servers, and all data that you send us in connection with the Service.
• Central server: the virtual server that Bitshard rents from Contabo GmbH in the European Union (in France), with no service open to the Internet except Bitshard’s VPN; at the date of these Terms Bitshard has only one. On it run the orchestrator (the program that receives payments, acceptances and alerts, starts each work of the AI Model as the Linux user of that Customer and keeps the credential of the AI Provider) and the works of the AI Model, and on it are kept the keys and the working data. Each Customer has its own Linux user on it. Every night a copy of the orchestrator’s database, without the keys, is made on the central server itself and kept for 14 days. If Bitshard later adds a second central server, on standby, the database is copied to it continuously so that it can replace the central server if it fails.
• Operator: a person who works for Bitshard, under its instructions, and receives notices, confirms actions and supervises Repairs through Bitshard’s internal messaging group (clauses 7.6(b) and 22.2).
• Fees: the prices in your Order, taken from the Price List or from an accepted quote.
• Hourly Rate: the price per hour of work shown in the Price List (clause 10.7).
• Our engineer: each person who carries out the parts of the Service that need a person: answering you, reviewing alerts in Watch and Managed and confirming plans of action as operator. Our engineers work for Bitshard directly, under its instructions, without any intermediary company (clause 23.1), and we are responsible to you for their work.
• Billing Period: for monthly plans, one month starting on the date of your first payment, and each following month.

4. How the Contract is made

4.1 You can order (a) through our checkout page operated by Stripe, by ticking the box that accepts these Terms and the DPA and then paying, or (b) by accepting in writing (an email is enough) a quote that we send you. The Contract starts when we receive your payment or your written acceptance.

4.2 The steps to contract are: choose a product on our website, read the notices described below, complete the checkout page, tick the acceptance box and pay. Before paying:

1. you can read, save and print these Terms, the DPA and the Price List, and correct any data you have entered on the checkout page;

2. our website, before the payment button, and the payment page itself show you, highlighted and separately from the rest of these Terms, three notices: the AI-driven service, including your instruction to use the AI Models and AI Providers listed in the DPA, chosen by us, with their known conditions (including the retention that some providers carry out for their own purposes as controllers), and your responsibility for the data that the AI reads (clause 7.1, in particular 7.1(g)); for the Health Check and the Emergency Clean-up, that the price is due once the work has started, also if you cancel, less what we save and what we earn or could reasonably have earned from other work by not finishing it, and that the price is not refunded if you do not give us working read and administrator access within 15 Business Days of the email in which we send you the instructions and the installation package (clauses 11.2, 11.3 and 11.6); and that, if something is deleted or damaged by mistake, including by an error of the AI Model, the first remedy is restoration from the backup taken before the changes, that beyond that our liability is limited to the price of the service except in the cases of clause 17.1, and that in the case of a Large Data Volume you make your own backup or accept the risk (clauses 7.6(d) and 17). By ticking the acceptance box you confirm that you have read and expressly accept the three notices. Before any payment, also through a payment link that we send you by email, you receive the scope, the price, these Terms, the DPA and the Price List in a form that you can keep, together with the three notices; if you order by accepting a quote, the quote contains them and your acceptance covers them. We do not send a payment link before the documents to which it refers are published. We record your acceptance and the versions accepted. The Authorization Form (Schedule 2) identifies the technical scope; the boxes that you tick when you accept each plan of action (clause 7.8) repeat the notices for confirmation and add no new financial limitation after payment.

After the purchase we email you a confirmation with the date of acceptance, the three notices and links to the versions you accepted. The payment page, or the quote if you order by accepting one, lets you object to emails about our similar services, and the confirmation email also tells you how to object at any time, free of charge (one reply is enough). We keep the accepted version and the payment record, and we send them to you at any time on request. To the extent that the law allows it between businesses (Articles 10(1), 10(2), 11(1) and 11(2) of Directive 2000/31/EC and the national laws that transpose them), the parties agree that no other pre-contractual information or acknowledgement of receipt is required.

4.3 The Contract is available in English and Spanish. Clause 25.4 says which version prevails.

4.4 We start work on a Customer Server once you have paid, the access of Schedule 1, S1.2(b), works and we have told you by email that the work starts (clause 11.2). For Watch and Managed, we also need the complete Authorization Form for that server (clause 6).

5. The Service

5.1 What each product includes and excludes is set out in Schedule 1.

5.2 Unless Schedule 1 or your Order says otherwise, the Service does not include: (a) development, design or content work on your websites or applications; (b) fixing errors in your own software or in third-party software, other than applying updates published by its vendor; (c) work on servers not listed in your Authorization Form; (d) desktop computers, laptops, phones, email accounts, DNS, domain registrations or your hosting provider’s control panel; (e) legal or regulatory advice, or acting as an expert witness; (f) the costs of your hosting provider, licences or other third-party services. Work outside the Service can be ordered at the Hourly Rate (clause 10.7).

5.3 No service can make a server impossible to attack. The Service reduces risk; it does not remove it. We do not promise that: (a) every vulnerability, intrusion or malicious program will be detected; (b) updates or repairs will never change how your software behaves; (c) the analyses and proposals of the AI Model will always be complete or correct; or (d) the third-party sources that we rely on (vulnerability databases, your hosting provider, our AI Providers) will always be available or accurate. Our commitment is in clause 16.1.

5.4 We may change how we provide the Service (for example, replace a tool or a supplier) as long as the Service you pay for does not become materially worse. We will tell you in advance about any change that reduces what your plan includes, and you may then cancel under clause 11.4.

5.5 A small team. Server Watch is run by a small team; at the date of these Terms, by two people who work for Bitshard directly, one of them a member of its management board; they may work from outside the European Economic Area (the DPA, clause 12.2, explains what this means for personal data). The automated functions (inventory, vulnerability matching, monitoring, alerts and the first AI analysis) run around the clock. Tasks that need a person (confirming plans of action, supervising Repairs, planning upgrades, answering you) are done in Business Hours, and outside them only on a best-effort basis, except security notices (clause 22.1). We announce planned absences at least five Business Days in advance by email; if our engineers are unexpectedly unavailable for more than 2 Business Days, we tell you by email, and we tell you when the review of alerts resumes (Schedule 3, protocol P15). During an absence, or if our engineers are unexpectedly unavailable, the automated functions continue, OS Automatic Updates continue if you enabled them, and plans of action that need the confirmation of an operator wait until an operator is available. Absences give no right to a credit, a discount or a refund (clause 12.4).

6. Your authorization to work on your servers

6.1 Authorization before any access. Before we connect to, scan or act on a server, you authorise it as follows: (a) for the Health Check and the Emergency Clean-up, by giving the server on our payment page and accepting these Terms, which authorises the access check, the Diagnosis with the AI Model and the external checks of clause 6.3(f) during the work, and by installing yourself the access of Schedule 1, S1.2(b); (b) for each change, by accepting its plan of action (clause 7.8); (c) for Watch and Managed, also by completing the Authorization Form (Schedule 2) and sending it to us from an email address of your organisation, or signing it, before the plan starts; for each Customer Server, that form lists its public IP addresses and domains, the access you give us and, separately, what we may observe and what we may change. Only the servers and activities so authorised are covered.

6.2 Your promise. You confirm that, for every server, IP address and domain that you list: (a) you own or control it, or you have the written permission of its owner to give every authorization in this clause 6, and the person who signs the Authorization Form has authority to do so on behalf of the owner; (b) it is not a shared server of a hosting provider on which other customers’ services run, unless you tell us so in the form; on shared hosting we work only within the account that you authorise and we do not read data of other customers of that provider; and (c) the terms of your hosting provider allow the Watcher, the scans and the actions described here, and you have obtained its permission where those terms require it. If you are an agency or reseller acting for your own clients, you also confirm that each client has authorised you in writing to give this authorization, to use us as your subcontractor and to use the AI Providers and the transfers described in the DPA, and you send us that authorization, or a written confirmation of the client, before our first access to that client’s server. We check control and authority as described in Schedule 3, protocol P2, and we stop if they are disputed.

6.3 What you authorise. By ordering a service for a server, and for Watch and Managed by sending the Authorization Form, you authorise us, and the persons who carry out the Service on our behalf under clause 23.1, to do the following, within the service ordered and, in Watch and Managed, within the activities you have ticked for each server:

1. install, run, update and remove the Watcher on each Customer Server, or ask you to do it;

2. read on each Customer Server the information described in the DPA (inventory, metrics, logs, file fingerprints, lists of processes and connections), using the Watcher’s read-only functions;

3. carry out Approved Actions (clause 7.4), including Patch Runs and the automatic rollback that is part of them;

4. if you choose it in the Authorization Form, enable OS Automatic Updates or keep them enabled;

5. if you give us an API token from your hosting provider, use it only to create, keep and restore snapshots and to read the resource usage of the Customer Servers, as stated in the Authorization Form; we accept a token only if your provider allows limiting it to those permissions;

6. check your Customer Servers from the Internet: availability, content and headers of the web addresses and domains you give us, TLS certificates, DNS and mail records, public blocklists and, only in monthly plans, port scans of the listed IP addresses, provided that they belong to servers under your control and not to shared hosting, from the IP addresses we state in the Authorization Form: in monthly plans, weekly and only while the Watcher confirms that the IP address still belongs to the Customer Server; in one-time services, only during the work and without port scans; and whenever you ask (Schedule 3, protocol P13);

7. for the Health Check and the Emergency Clean-up, check the access of Schedule 1, S1.2(b) (with the read user and, for at most 10 minutes, with the repair user only to check that it can use sudo), connect to the Customer Server through it and run on it, with the AI Model and under the conditions of clauses 7.1 and 7.6, Read-only commands in the Diagnosis and, after your acceptance of its plan (clause 7.8), the commands of the Repair;

8. for Watch and Managed, keep the Bitshard Access on each Customer Server and use it as described in clause 6.7.

6.4 What we never do, even with your authorization: try to exploit a vulnerability, guess passwords, run load or denial-of-service tests, or scan or access a system that you have not authorised under clause 6.1. Excluded files. We do not ask the AI Model to read the files listed as excluded in Annex III of the DPA (private keys, password files and the other paths listed there). The read user cannot read those that only the administrator can read. If one of them can be read by every user of the server (for example, a configuration file with permissions 644), our tools try to block it and mask the secrets that they recognise, but it may reach the AI Model; the report then recommends restricting its permissions. If a step of the work needs the content of one of those files, the plan of action says so expressly, and you decide when you accept it.

6.5 Changes. You must tell us in writing, within two Business Days, when a listed IP address, domain or server stops being yours or under your control, and before you add a new one. We stop scanning a target as soon as we receive that notice. We are not responsible for scanning a target that you listed and that changed owner without your telling us.

6.6 Withdrawal and immediate stop. You may withdraw or narrow your authorization at any time. You can block each access route that you control, without waiting for us: stop and uninstall the Watcher; delete the lines with our keys from the authorised-keys files, or lock our users, and close any session in progress; and revoke the API token you gave us. Only you can remove our keys from your server; we cannot do it for you without access. To stop all access you must block every route that you granted and stop any work already running; these measures do not by themselves stop the external checks of clause 6.3(f), which stop when you withdraw your authorization as stated below. We give you instructions for each route. To stop us at once, press “Withdraw the authorisation”, which is in every email of your Order and in “Status of your order” (clause 22.3), or run on your server the removal program, which removes our access (clause 6.7(a)). With the button, our system stops automatically as soon as it receives your press: we stop the affected activities, close our sessions to the affected servers, unload their keys and cancel any scheduled change. If you ask us to withdraw by email to info@bitshard.eu, we apply it as soon as a person reads it, and at the latest by the end of the next Business Day. We confirm the withdrawal to you by email (Schedule 3, protocol P12). Stopping a work closes our connections and unloads the keys, but a program that a command started on your server before the stop may keep running there; the record shows what was started, and we tell you what to check. The plan of action states, for each change, whether and how it can be undone; if you withdraw your authorization during a Repair, the server may remain in an intermediate state, for which we are not responsible unless it is caused by a breach of ours; if, when withdrawing, you choose “Stop and undo what was done”, we first stop everything, then restore from the Prior Backup what the plan changed, as stated in clause 7.8(h), and when we finish we confirm the withdrawal to you with the result; if the restoration fails or cannot be done, the withdrawal stands. When the withdrawal is complete, after the restoration if you chose it, we destroy our copy of the private keys of the affected servers (clause 19.4(c)). If the withdrawal prevents us from providing a paid service, clause 11 applies as if you had cancelled; for the Bitshard Access, clause 6.7(e) applies.

6.7 The Bitshard Access. Watch and Managed need two kinds of access at the same time: the Watcher, which reports the state of the server continuously with its fixed functions, and the Bitshard Access, which allows Deep Checks and approved changes and stays installed for as long as the plan lasts. The Health Check and the Emergency Clean-up use the same Bitshard Access only for the work ordered (Schedule 1, S1.2(b)). Points (a) to (d) apply to all services.

1. What you install. You create on each Customer Server, by running as administrator the installation package that we send you only by email (Schedule 1, S1.2(b)), two users: a read user, without administrator rights, and a repair user, with administrator rights (sudo), each of whose commands run with sudo is recorded on your server. In the authorised-keys file of each one the package adds one public key of Bitshard (one for reading and another for repairs), accepted only from the IP address of Bitshard’s central server and without forwarding. Before installing anything, the package records an inventory of what gives access to your server, and it leaves on the server a removal program (/usr/local/libexec/serverwatch/uninstall) that you can run at any time (clause 19.4(c)). The private keys are kept encrypted on the central server until we destroy them at the end of the order (clause 19.4(c)); the read key is loaded in memory while the access is in use. The repair key is loaded only: (i) when we check the access, for at most 10 minutes and only to check that the repair user can use sudo, without changing anything; and (ii) for a Repair or an action whose plan you have accepted and an operator has confirmed (clause 7.8), for the time stated in the plan and at most 4 hours each time it is loaded; (iii) in Watch and Managed, while the plan lasts, to change our keys every 6 months or when we suspect that one may have been compromised, after telling you by email at least 2 Business Days before (or at once, if there is a suspicion) and with the confirmation of an operator; the change only replaces our two keys and changes nothing else on the server. When we check the access, a command that needs administrator rights is run with the read key and must be refused; we record the result. The keys have no end date on your server; they are changed only as stated in point (iii), and our copy of the private keys is destroyed at the end of the order (clause 19.4(c)). The central server has no service open to the Internet except Bitshard’s VPN, and each Customer has its own Linux user on it.

2. Automatic reading. The reading sessions with the read key are started by the orchestrator, without a person following them, at any time: in the Health Check and the Emergency Clean-up, after the access check; in Watch and Managed, when an alert needs it, for the scheduled Deep Checks (once a month) and when you ask. In them the AI Model only runs Read-only commands (clause 3), and what it reads is sent to the AI Provider as described in the DPA. No message through messaging channels starts a reading outside these cases (clause 22.2).

3. Changes. Apart from the change of keys of point (a)(iii), the repair key is used for changes only after your acceptance of the plan of action, the confirmation period and the confirmation of an operator (clause 7.8). Its first use is the Prior Backup, and nothing is changed until the Prior Backup has been checked (clause 7.6(c)).

4. Records. Every work of the AI Model (date, time, server, key used, and the commands run and their output as the AI tool reports them) is recorded on the central server; every command run with sudo is also recorded on your server. The reports summarise them. These records are partial evidence: they show what the AI tool reports and what passed through sudo, not every reading done by the read user. Recordings that contain data of your server follow the retention periods and the deletion rules of the DPA.

5. If you remove it. You can remove the Bitshard Access, or block our systems, at any time and without notice (clause 6.6). We then tell you by email which parts of the plan cannot be provided without it. Until the access is restored: the Watcher’s functions continue; Deep Checks and the manual work that needs the Bitshard Access do not take place; the response target of clause 12.3 does not apply to problems that need it; and we are not responsible for what a Deep Check would have detected during that time. If the access is not restored within 14 days of our email, either party may end the plan by email at the end of the current Billing Period; the Fees already paid are not refunded (clause 11.1).

6. At the end of the plan, clause 19.4(c) applies.

7. How the Service works on your servers

7.1 AI-driven service — please read before ordering. Server Watch is an AI-driven service. By ordering, you accept that:

1. The AI reads your server. The AI Model reads data of your Customer Servers: configuration, installed software, processes, network connections, users, scheduled tasks, logs, website files and, when an investigation needs it, records of databases. Before anything is sent to the AI Model, email addresses are replaced by pseudonyms and known secrets (passwords, keys, access tokens) by a marker; usernames remain visible (DPA, clause 11.2). The masking finds only the secrets that it recognises. In the Repair, the data that an action of the accepted plan needs in order to be carried out (for example, the email address of a fake administrator account that has to be removed) may reach the AI Model without masking. The excluded files are treated as stated in clause 6.4.

2. In the Diagnosis the AI only reads. In the Health Check, in the first phase of the Emergency Clean-up, in the investigation of alerts and in the Deep Checks of Watch and Managed, the AI Model only runs Read-only commands or read-only functions. It changes nothing.

3. In the Repair the AI may make changes. In the second phase of the Emergency Clean-up and in fixes ordered at the Hourly Rate, the AI Model runs the changes of the plan of action on your Customer Server with the repair key; in Watch and Managed, when available, the changes run as Approved Actions (clause 7.4) or, in the manual work included in Managed, as in the Repair of clause 7.6. Always: (i) after a backup of what will be changed: the Prior Backup in the Repair; in Watch and Managed, the snapshot of the Patch Run or the copy that the Approved Action keeps (for example, a file moved to quarantine instead of deleted); (ii) within the plan of action that you have accepted and that an operator of Bitshard has confirmed after the confirmation period (clause 7.8); the AI Model then runs the commands of that plan without a person approving each command or each change before it runs; the process is supervised in general by people of Bitshard (clause 7.6(b)); (iii) within the service ordered and, in Watch and Managed, within the activities you have ticked under “change” in the Authorization Form; and (iv) with a record of every command run (clause 7.7).

4. Every change is recorded and listed in the report: what was changed, when, under which plan, who confirmed the plan, and the result.

5. The AI can be wrong. It may misunderstand a situation or be misled by text that an attacker has written into logs or files (a technique known as prompt injection). Our safeguards against this are: the plan of action, which states each change, its risk and how to undo it, and which a second AI model checks before it is sent to you; your acceptance of that plan; the confirmation of an operator, who checks that your acceptance exists and that the plan that will run is the one you accepted (the same fingerprint), not each command; the general supervision of the process by people of Bitshard (clause 7.6(b)); the Prior Backup of what the Repair is going to touch; our instruction to the AI Model to carry out only the accepted plan, to move files to quarantine instead of deleting them and to stop when a step needs something that is not in the plan; the record of every command; and the comparison of the access inventory before and after the Repair, which a second AI model checks against the plan. No person approves each command or each change before it runs, nobody necessarily follows each step as it happens, and no technical barrier prevents the AI Model from running a command that is not in the plan: if it does, the record shows it and clause 17.2 applies. These safeguards reduce the risk; they do not remove it (clause 5.3). Clauses 17.2 and 17.3 set out what we do if an error of the AI Model deletes or damages something, or appears in a report.

6. Your data is not used to train AI. Under the terms of the AI Providers listed in the DPA, the data we send them is not used to train their models, and we do not train any model, including an Own Model, on your data (clause 13.4).

7. Your data and your instruction. You decide which data are on your Customer Servers and which sources and paths are excluded from the AI Model (Authorization Form, item 8). As controller of the personal data on your servers or, if you act for your own clients, as their processor authorised by them, you instruct us to use the AI Models and AI Providers listed in the DPA, as we choose and change them, under the conditions of the DPA (clause 11). Some AI Providers keep part of the data for their own purposes and as controllers (for example, content that their systems flag as abuse), for the periods set by their own published terms, linked in the DPA, which we do not control or guarantee, and transfer it under those terms; sending the data to them includes that disclosure, which you know and expressly authorise (DPA, clauses 11.1(c) and 11.3(a)). You confirm that you have a legal basis for that processing and for that disclosure, and that you have informed the people concerned, including of those providers as recipients (or, if you act for your clients, that they have confirmed it to you); you are responsible towards them and towards third parties for the data that you make available and for your instructions; and you compensate us under clause 18, including for the claims of third parties that arise from that retention (clause 18.1(f)). This does not cover a breach of our own obligations, including as processor, nor processing by us or by our suppliers outside your instructions and the conditions of the DPA (DPA, clause 11.3).

7.2 The Watcher. The Watcher opens the connection to the Platform itself; you do not open any port for it. It only runs read functions from a fixed list (for example: list processes, list open connections, read a log, read an allowed file) and does not run changes. The Bitshard Access (clause 6.7) uses your server’s own SSH service, which must accept connections from Bitshard’s central server stated in the Authorization Form.

7.3 The AI Investigator (Watch and Managed). When an alert is raised, the AI Investigator may gather evidence with the Watcher’s read-only functions and draft a report and a proposal. The AI Investigator:

1. cannot change anything on a Customer Server: it can only read, through the Watcher’s read-only functions or through Read-only commands in the automatic reading sessions of clause 6.7(b), and propose actions from the Action Catalogue, which run only as Approved Actions (clause 7.4);

2. in each investigation, only has access to the servers of one customer;

3. may be wrong or incomplete, as described in clause 7.1(e).

7.4 Approved Actions. Every change that we make on a Customer Server in Watch and Managed is an Approved Action: it runs through the repair access, only after your permission of its plan (clause 7.8) or, for the urgent cases of clause 7.5(b) and the updates of your Maintenance Window, after your pre-authorisation in the Authorization Form, and always after the confirmation of an operator. A Patch Run is approved as a whole, including the snapshot that comes first and the automatic rollback that follows a failed check.

7.5 Updates.

1. Non-urgent updates are applied through Patch Runs in your Maintenance Window.

2. Urgent updates. If a vulnerability is being actively exploited or has a public exploit, and it affects a component that can be reached from the Internet, we may carry out a Patch Run or a temporary containment action (for example, disabling a vulnerable plugin or blocking the attacked web path) outside your Maintenance Window. We email you before we do it. If you choose “ask me first” in the Authorization Form, we will not act outside the window until you have answered our email, and we are not responsible for the consequences of that delay.

3. OS Automatic Updates are a function of your operating system, not an Approved Action. If you enable them in the Authorization Form, they install the security updates published by your distribution without our individual approval and without a snapshot taken by us; we monitor their result.

4. Major upgrades (for example, a new operating-system release or a new major version of PHP or of a database) are never automatic. They are included only in Managed and are carried out on a date agreed with you, after a test where possible.

7.6 Work with the AI Model in one-time services. In the Health Check, the Emergency Clean-up, work ordered at the Hourly Rate and the manual work included in Managed, the AI Model works on the server through the Bitshard Access (clause 6.7; Schedule 1, S1.2(b)), in two phases:

1. Diagnosis. The AI Model runs only Read-only commands, with the read key (clause 3). The reading sessions are started by our systems after the access check, at any time of day, without a person following them (clause 6.7(b)). A second AI model checks the report and the plan of action against the evidence before they are sent to you. Nothing is changed on the server, except the access components that you install (Schedule 1, S1.2(b)), which are listed in the report. The Health Check consists only of this phase.

2. Repair (Emergency Clean-up and fixes ordered at the Hourly Rate). The AI Model runs the commands that change the server, with the repair key, only to carry out the plan of action that you have accepted, each command in its own call to sudo, which records it on your server. Read-only commands may also run. The process is supervised in general by people of Bitshard; no person approves each command or each change before it runs, and nobody necessarily follows each step as it happens (clause 7.1(c) and (e)). For that supervision Bitshard may use internal measures, for example notices of the progress of the work to its operators, a way of stopping the work or a confirmation before certain actions; Bitshard may change them or stop using them, they are not obligations towards you, and their failure or absence is not a breach of the Contract. If the Repair is interrupted for any reason, including the loss of access or a time limit of our own systems, we tell you within 1 hour of becoming aware of it, describing the state of the server as far as we know it and what remains to be done; continuing needs another loading of the repair key within the number of loadings stated in the plan, or a new plan.

3. Prior Backup. Before the Repair changes anything, the first work with the repair key takes a copy of what the Repair is going to touch under the plan of action: the files, configuration and scheduled tasks that the plan changes and, if the plan changes a database, a dump of all the databases of the server (when it is restored, all of them go back to the date of the backup; clause 7.8(h)). The copy is stored on the disk of the Customer Server itself, in a folder that only its administrator can read, if that disk has enough free space; Bitshard keeps no copy of it, except in the case of point (i) below. The copy is yours and stays on your server: the report says where it is and how to delete it when you no longer need it, and we do not delete it. Because it is on the same disk as the data, the Prior Backup does not protect against the failure or loss of that disk or of the server, the deletion of the server or of your hosting account, or an attacker with administrator access who changes or deletes it; for those cases you need your own backup outside the server (clause 8.1). The Prior Backup does not cover data that the plan does not touch: if the AI Model changes something outside the plan (clause 7.1(e)), there may be no backup to restore it from. If you want other data covered, make your own backup before accepting the plan (clause 8.1). Before the Prior Backup we change nothing on your server: if an attack is in progress, we tell you which containment measures you can take yourself from outside the server (for example, in your hosting provider’s firewall or control panel) while the backup is made. Before the first change we check that the backup is complete and can be read (for example, that the database dump opens and that the copy lists its files) (Schedule 3, protocol P5); if it cannot be checked, nothing is changed. A full restore test is not part of the service; the report says that the restoration has not been tested. One backup covers the changes of the same plan; a new plan has its own backup. If the disk does not have enough free space for the Prior Backup: (i) if you have contracted with us backups of that server stored outside it (today, the daily backups of Managed, Schedule 1, S1.4(b)(2)), you have already authorised us to take its content out of the server, so we store the Prior Backup outside the server, encrypted, at the same place as those backups (Contabo GmbH (Germany), in the European Union) and delete it 35 days after the copy in an Emergency Clean-up and 14 days after the copy in other work; it is processed as described in the DPA, and the Repair does not wait for a backup of yours; (ii) otherwise, clause 7.6(d) applies, and the Repair does not start until you have chosen. If no adequate backup can be taken for another reason, we make no changes.

4. Large Data Volume. If the free space on the disk of the Customer Server is not enough for the Prior Backup while leaving the server the room that it needs to keep working, and you have no backups of that server contracted with us (clause 7.6(c)(i)), we stop when we find it out, before or while taking the Prior Backup, and tell you in writing the size of the copy and the free space. In that case we do not take the Prior Backup of those data, and the Repair does not start until you choose, with the button of the email in which we tell you (our page keeps the text that you saw when choosing) or by email to info@bitshard.eu, which a person reads: (i) to make your own backup of those data and confirm to us that it is complete; or (ii) to accept that they are changed without a backup, with the risk of their loss or damage. Before you choose, we state in writing which data will have no backup of ours, the scope of the change, the alternative we offer and the risk you accept. Your choice does not authorise us to breach our legal security obligations or to carry out an intervention that we consider unsafe; if the Repair cannot be done safely, we do not do it. We still keep, where the Repair allows it, a copy of each file that it changes or removes (for example, by moving it to quarantine instead of deleting it). Until you choose, the Repair waits, and the waiting time does not count towards the hours included. If you have not chosen within 5 Business Days, we deliver the report of the work done, which is not the final report: the order stays open, and the included hours not yet used remain available to you for 30 days from that report; after that the service ends, and the price is settled as in clause 11.2 for a cancellation.

5. Records. Every command run, the plan under which it ran, who confirmed the plan and the result are listed in the report or in the record attached to it.

7.7 Records and reports. We keep a record of every Approved Action, every work of the AI Model and every command it ran (what, on which server, when, under which plan, who confirmed it and the result). The monthly report or the final report summarises them; the final report of a Repair includes the SHA-256 fingerprint of the record of commands, and you may ask for the full record while we keep it (DPA, Annex II.G). Reports follow Schedule 3, protocol P14: where there are fixed automatic checks (in Watch and Managed), they separate their results from the analysis of the AI Model; they state that they were prepared by an AI model and checked by a second AI model before delivery (no person reviews every report before delivery), and do not present as a fact that an identified person did something unless the evidence shows it.

7.8 Your permission for each plan of action. Before each Repair, and before each Approved Action that you have not pre-authorised, we prepare a plan of action with a unique reference: what will be changed, why, the risk of each change and how to undo it, the maximum time with the repair key and how many times it may be loaded. In the plan, user accounts and other data of your server that identify a person are named by references (for example, “account U1”); the table that links each reference to the real value goes with the report that we send you, is used to carry out the plan and is deleted with the working data.

1. The link. We send by email, only to the address for permissions (Schedule 2, point 1), a unique link to a page where that plan can be accepted. Opening the link only shows the plan: it does not accept it and does not use up the link, so a mail filter that opens links automatically accepts nothing. The link is used up only when the plan is accepted, by ticking all the boxes and pressing the accept button, in the language of the page (“I accept”, “Acepto”, “J’accepte”, “Ich stimme zu” or “Accetto”). It expires 72 hours after it is sent; a used or expired link gives no permission, and we send a new one if you ask.

2. The page. It shows the full text of the plan, its reference, the version of these Terms that applies and the date; the boxes that must be ticked to accept, none of them ticked in advance: that the plan and its risks have been read; that the person accepting is authorised by the Customer to permit these changes on that server; and that the changes are made under these Terms in the version shown, by the AI Model, with the process supervised in general by people of Bitshard and without a person approving each command or each change; and, next to the button, a declaration that summarises what is accepted, on whose behalf and what is kept as proof. The permission is given by ticking the boxes and pressing “I accept”. The page runs on a web server of Bitshard in the European Union that is separate from the central server.

3. What we record. When the plan is accepted, we record: the exact text shown and its fingerprint (SHA-256 hash), the reference of the plan, the version of these Terms, the boxes ticked, the date and time of our server, the IP address and the identification of the browser (user agent) from which it was accepted, and the email address to which the link was sent. On the page we register only versions of these Terms and of the legal notice that have been published; for each one we keep a complete copy that is never changed, and each record points to the copy of the version in force at that moment. We keep these records as proof of the permission for 3 years from the end of the calendar year in which the Contract ended, and longer only while a claim about that plan is pending (DPA, clause 17.3).

4. Copy of what was accepted. As soon as the plan is accepted, we send a copy of what was accepted, with the full text of the plan, its fingerprint and the data recorded, to the address for permissions and to the second email address of Schedule 2, point 2 (required for the Emergency Clean-up). If within 5 Business Days of receiving the copy you do not tell us in writing that it does not match what was accepted, the parties take the copy as an accurate record of the acceptance; the copy says so.

5. Confirmation period. The copy also says that, unless you tell us within 2 Business Hours of receiving it that the acceptance was not yours, we will carry out the plan. The period is 2 hours of Business Hours, counted from when the copy is received under clause 22.1: a copy sent outside Business Hours is received at the start of the next Business Day, and the period starts then. To tell us that the acceptance was not yours, press “It was not me” in the copy, which goes to both addresses; a reply by email is read by a person and does not stop the plan by itself (clause 22.3). We do not start (neither the Prior Backup nor any change) until one of these has happened: (i) the period has ended without your having pressed “It was not me”; or (ii) you confirm the acceptance with the “I confirm” button of the copy sent to the second email address of Schedule 2, point 2 (that button goes only in that email, not in the one sent to the address for permissions). If you press “It was not me”, we do not start, and before sending any new link we check it by email with the second address of Schedule 2, point 2; if you do it after we have started, we stop at once: we close our connections and unload the repair key; a command that was already running may leave the server in an intermediate state, and we tell you in writing what was done, what remains to be done and what to check (point (h) applies to restoration).

6. Who accepts. The address for permissions is the email address of your Order unless you give us another one on our acceptance page before the first plan (clause 22.3). It should be the individual mailbox of a person with authority to approve changes, not a shared list, and it must not forward automatically to third parties. For an Emergency Clean-up it must not be hosted on any of the servers of the Order: before sending the first link we check which server receives the mail of that address (its MX records); if it is one of those servers, we ask you for another address, and we send nothing until we have it and the second email address of Schedule 2, point 2. Once the confirmation period of point (e) has ended, we treat an acceptance made through a link sent to the address for permissions as given by you, unless before that you told us that the address was no longer under your control, or we had clear signs that the person was not authorised (clause 17.11).

7. Execution. An operator of Bitshard confirms the acceptance; the repair key is loaded only after that confirmation and after the confirmation period. The process of the Repair is then supervised as stated in clause 7.6(b). A change outside the plan needs a new plan and a new permission. Replies by email, the buttons of our emails (other than those of point (e)) and messages or buttons through WhatsApp, Telegram or other channels are not a permission (Schedule 3, protocol P20).

8. Restoration. Your acceptance of a plan also authorises us to restore from its Prior Backup what that plan changed, if you ask us to or if the Repair goes wrong (clause 17.2); we tell you in writing before restoring, and no new confirmation period applies. You can ask for it with the “Stop and undo what was done” button when you withdraw your authorization (clause 6.6), which is offered only when there is a Prior Backup of a plan that you accepted and an operator confirmed; the restoration then starts at once, without waiting. If the Prior Backup has a database dump, restoring it takes all the databases of the server back to the date of the backup, and what was written in them afterwards is lost. A restoration that fails or cannot be done (for example, because the backup is no longer on your server or does not match its fingerprints) does not stop the withdrawal, and we tell you in writing the state in which the server has been left, as far as we know it. If you have locked our users, the restoration needs you to unlock them.

8. Your obligations

8.1 Backups. You remain responsible for keeping your own backups of your data and systems, stored outside the Customer Server and outside the same hosting-provider account, and for checking that they can be restored. The Prior Backup stays on the disk of your server (or, in the case of clause 7.6(c)(i), with your contracted backups for a limited period), with the limits of clause 7.6(c), and the snapshots that we take before a Patch Run are kept only for the periods stated in these Terms and in the Authorization Form; neither is a backup service. The daily backups included in Managed are described in Schedule 1; even then, you should keep at least one copy that does not depend on us. In the case of a Large Data Volume, clause 7.6(d) applies.

8.2 Access and cooperation. You must: (a) for Watch and Managed, keep the Watcher installed and running, without modifying it, and keep the Bitshard Access installed and our access available (clause 6.7); (b) give us, and keep valid, the access listed in the Authorization Form, with no more permissions than needed; (c) name a contact person who can be reached by email during Business Hours; (d) answer within a reasonable time when we need a decision from you (for example, to approve a major upgrade or a change outside the window); (e) tell us about other people or companies who make changes on your servers, so that we can coordinate with them.

8.3 Information. In the Authorization Form you give us the Maintenance Window, the web addresses that must keep working after an update, the ports and services that should be open, and whether a server processes special categories of personal data (for example, health data) or is subject to sector rules (for example, payment-card rules). You must keep this information up to date.

8.4 Your software and your legal obligations. You are responsible for having the licences for the software on your servers, for the content and lawfulness of your websites and applications, and for your own legal obligations, including notifying authorities or affected people of a security breach. We help you as described in the DPA and in Schedule 1.

8.5 Credentials. Keep confidential any credentials or keys that we give you, and tell us at once if you think one has been compromised.

9. Acceptable use

You must not use the Service, or ask us, to: (a) monitor, scan or act on systems that you are not authorised to; (b) attack, test or probe third parties; (c) monitor individuals (for example, employees) instead of the security and operation of your servers; (d) hide or facilitate illegal activity, including on the Customer Servers; (e) copy, decompile or resell the Watcher or the Platform, except under an agency plan (Schedule 1, S1.6); (f) send us personal data that the Service does not need, such as the contents of databases, unless a task requires it and we agree; (g) attack Bitshard’s systems through the Service, or use it to obtain our methods or tools. If you use information from the Service about the access of your employees or of other people to your servers, you are responsible for complying with the employment and data-protection rules that apply to that use; we do not provide those data for monitoring people. We may suspend the affected part of the Service immediately if we have good reason to believe that this clause has been breached, and we will tell you why. For the Exposure Report, Schedule 1, S1.1(h) also applies.

10. Fees and payment

10.1 The Fees are those of the Price List in force on the date of your Order, or those of the quote you accepted. All prices are in euros, do not include VAT or other taxes, and we charge them in euros to every customer. Our website may also show an approximate equivalent in US dollars, for reference only: it is not a price, and the amount due is always the amount in euros. If the payment page offers you the amount in another currency, that is a conversion made by our payment provider, Stripe, at its own exchange rate, which includes a conversion fee of 2% to 4% that you pay; you can choose on that page to pay in euros, without that fee. A quote that you accepted keeps its amount in euros. Where the reverse-charge rule applies to a business customer established in another EU country, that customer accounts for the VAT. If a tax authority determines that an invoice should have included VAT or another tax, we issue a corrected invoice and you pay that tax, unless the error is exclusively ours.

10.2 Monthly plans (Watch, Managed and agency plans, when available under clause 1.4) are charged per Customer Server, in advance, at the start of each Billing Period, to the card or other payment method that you give our payment provider, Stripe. They renew automatically every month until you cancel (clause 11.1). If you add servers during a Billing Period, the additional amount is charged pro rata; if you remove servers, the change takes effect from the next Billing Period.

10.3 One-time services. The Exposure Report, the Health Check and the Emergency Clean-up are paid in full before we start. The Emergency Clean-up has a closed price for the tier you choose (Schedule 1, S1.5); work beyond what is included is charged at the Hourly Rate, only after you accept a written quote.

10.4 Price changes. We may change the Fees of monthly plans by giving you at least 30 days’ notice by email, explaining the reason. Price changes reflect changes in our costs (suppliers, use of AI, hosting, taxes) or in what the plan includes. The new price applies from the first Billing Period that starts after the notice period. If you do not accept it, you can cancel before it applies, without any cost. A price change never affects a Billing Period that you have already paid, nor a one-time service that you have already ordered.

10.5 Late payment. If a payment fails, Stripe retries it automatically and we tell you by email. If it is still unpaid 14 days after the due date, we may suspend the Service after giving you 3 more days’ notice by email; during a suspension the automated monitoring may stop and we carry out no actions. If it is still unpaid 30 days after the due date, we may terminate the Contract under clause 19.3. Unpaid amounts bear late-payment interest at the statutory rate of Estonian law (§ 113 of the Law of Obligations Act: the rate of the European Central Bank’s main refinancing operations plus eight percentage points a year).

10.6 Invoices. We issue invoices electronically through Stripe. If you disagree with a charge, tell us within 30 days of the invoice.

10.7 Hourly Rate. Work that your plan or service does not include is charged at the Hourly Rate, in blocks of 30 minutes. Before any such work that will take more than 2 hours we send you a written quote, and we start only when you accept it.

10.8 Discount codes. We may give promotional codes that reduce the price on our payment page. Each code states the products to which it applies, its expiry date, the number of times it can be used and, for monthly plans, the number of Billing Periods to which the discount applies; after them the full Fee applies. Each code can be used, in total, the number of times that it states and, unless the code says otherwise, each customer may use it only once; if a customer uses it more times than allowed, we may charge the difference or refuse the order. Codes cannot be combined with each other or with other offers and cannot be exchanged for money. Where these Terms calculate a refund, a deduction, a penalty or a limit of liability from the price or the Fees of a service, the amount used is what you actually paid for it, after the discount.

11. Cancellation and refunds

11.1 Monthly plans. You can cancel at any time from the Stripe customer portal or by emailing info@bitshard.eu. Cancellation takes effect at the end of the current Billing Period. The Service continues until then, and we do not refund partial months, except as set out in clauses 11.4 and 19.

11.2 Health Check — no refund once started. The work starts with the first diagnostic action on your server, by our engineer or by our automatic tools, which is recorded and which we notify to you by email at that moment; installing or checking the access (Schedule 1, S1.2(b)) is not the start. Until then, you can cancel and we refund everything you paid, even if you have already given us access, except when the Contract ends under clause 11.6 (access not given in time); before the start we tell you of any impediment that we know of concerning the access, the volume of the data or the backup needed. Once the work has started, the price is due, also if you cancel. The price is fixed for the service described, not a set of refundable hours: if we complete the service in less time, the full price is due. If you cancel after the start for a reason not attributable to us, in line with § 655(1) of the Estonian Law of Obligations Act we deduct from the price what we actually save by not completing the work (for example, the cost of the AI Model not used) and what we actually earn, or could reasonably have earned, from other paid work in the hours that your cancellation freed; we state both amounts in the final invoice, and if there are none the full price is due. This rule does not reduce your rights if we fail to perform. If we have not delivered the report within a reasonable time and do not deliver it within 5 Business Days after your written notice, you may cancel and receive a full refund.

11.3 Emergency Clean-up — no refund once started. The start of the work is defined as in clause 11.2. Until then, you can cancel and we refund everything you paid, also if the start time that we expected (Schedule 1, S1.5(a)) has passed, except when the Contract ends under clause 11.6. Once the work has started, the price of the tier is due, also if you cancel, with the same deductions as in clause 11.2. If, for a reason attributable to us, the Repair has not started within 5 Business Days of the end of the confirmation period of its plan (clause 7.8(e)), you may cancel the rest of the Emergency Clean-up by email, and we refund the price paid less the price of a Health Check, which corresponds to the Diagnosis already delivered (both amounts reduced in the same proportion as any discount on your Order; clause 10.8); this does not limit your rights if we fail to perform. If the clean-up is not finished when the included hours are used up, we stop and send you a quote for the rest; if you do not accept it, we deliver the report of the work done until then.

11.4 When we refund pro rata. If we terminate without cause (clause 19.3(a)), if you terminate because of our breach (clause 19.2), or if you cancel because of a change under clause 5.4, 10.4 or 21, we refund the Fees paid for the unused part of the current Billing Period and, for one-time services, the price of the part not yet performed.

11.5 Clauses 11.2 to 11.4 regulate cancellation. They do not limit the rights that the law gives you if we fail to perform, or perform defectively, within the limits of clause 17. Refunds are made to the original payment method through Stripe.

11.6 Access that you must give (Health Check and Emergency Clean-up). Within 15 Business Days of the email in which we send you the instructions and the installation package (Schedule 1, S1.2(b)) you must give us, working, the two accesses of Schedule 1, S1.2(b), in both services: read access and administrator access (sudo). In the Health Check the administrator access is used only to check, for at most 10 minutes, that it works, and for fixes only if you order them. We check the access automatically every hour and when you press “I have installed it” in our emails or in “Status of your order”, and we tell you in writing what works and what does not; we remind you in writing at least 5 Business Days before the period ends. The period does not run while we are the ones who must act, and it is extended by any delay attributable to us. If, at the end of the period, the two accesses are not working for a reason not attributable to us, we cannot act: after an operator has checked the case, the Contract ends, we tell you so in writing, and the price is not refunded, because the parties agree that amount in advance as compensation for the capacity reserved for you and for the preparation and the checks (§ 158(3) of the Estonian Law of Obligations Act; § 162 of that Act allows a court to reduce it if it is unreasonably high). This rule is an exception to the refund before the start of clauses 11.2 and 11.3. Having technical access to the server, even as administrator, does not prove that you are authorised by its owner: that remains covered by your declaration when ordering (clause 6.2) and by clause 18.1.

12. Service levels

12.1 The automated functions run continuously, but we do not guarantee that they will never be interrupted. We carry out maintenance of the Platform outside Business Hours where possible, and we tell you in advance if maintenance will stop the monitoring for more than 2 hours.

12.2 Watch. Alerts are sent automatically. Our engineer reviews alerts, AI reports and proposed actions in Business Hours. Our target is to review each alert by the end of the next Business Day.

12.3 Managed. Our target is to give a first human response, within 4 Business Hours, to a critical alert or to a problem that you report by email or through the channel stated in the Authorization Form. “First human response” means that the engineer has looked at the problem and has told you what is happening and what will be done next. Only Business Hours count.

12.4 Targets, not commitments. The first-response times of clauses 12.2 and 12.3, any response time shown on our website, the delivery time of the Health Check (Schedule 1, S1.2(d)) and the start times of the Emergency Clean-up (Schedule 1, S1.5(a)) are targets. We aim to meet them, and most of the work is automated so that we can respond sooner; but they are not contractual commitments. Missing them is not a breach of the Contract and gives no right to a credit, a discount or a refund for the delay itself, including while our engineer is absent or unavailable (clause 5.5), while the Service is suspended under clause 9 or 10.5, or while the access we need is not available. This does not change: (a) our obligation to provide the Service with the care described in clause 16.1 and within a reasonable time; (b) your right to cancel a Health Check under clause 11.2 if the report is not delivered within a reasonable time; (c) your right to cancel an Emergency Clean-up with a full refund before it starts (clause 11.3); nor (d) your right to terminate under clause 19.2 if we fail to provide the Service. An absence of our engineer does not extend these limits.

13. Customer Data, reports and our software

13.1 Customer Data belongs to you. You allow us to use it only to provide the Service, as set out in the DPA.

13.2 The reports that we deliver to you are yours to use and share in relation to the servers to which they refer, including with your own clients, advisers, insurers and authorities. Their format, structure, standard texts and our methods remain ours, and you may not use them to produce reports on other servers. Agencies may present them under their own brand (Schedule 1, S1.6).

13.3 The Watcher, the Platform, the Action Catalogue and our methods belong to Bitshard or its licensors. During the Contract you may install and run the Watcher only to receive the Service. Some components are open-source software (for example, the Wazuh agent) and are licensed to you under their own licences, a list of which we send you on request (info@bitshard.eu).

13.4 Neither we nor any AI Provider use Customer Data to train artificial-intelligence models; we do not train an Own Model with them either.

14. Personal data

14.1 When we process personal data contained in Customer Data, we do so as your processor (or as sub-processor, if you are an agency acting for your clients) under the DPA, which is part of the Contract.

14.2 Our privacy policy at https://www.bitshard.eu/legal.html#privacy explains how we handle, as controller, the personal data of your contact people and of other people who deal with us.

15. Confidentiality

15.1 Each party keeps confidential the non-public information that it receives from the other in connection with the Contract (including Customer Data, reports, credentials, security findings, unpublished prices and our methods), uses it only to perform the Contract, and discloses it only to its staff and subcontractors who need it and are bound by equivalent duties.

15.2 Clause 15.1 does not apply to information that is or becomes public without a breach of the Contract, that the receiving party already had or develops independently, or that must be disclosed by law or by order of a court or authority; in this last case, where the law allows it, the disclosing party tells the other party first.

15.3 These duties last during the Contract and for 5 years after it ends; for credentials and security findings, for as long as they remain confidential. For personal data, the DPA also applies.

16. Our commitment

16.1 We will provide the Service with the care and skill of a diligent professional provider of server-security services, following generally accepted practices, and as described in these Terms and in Schedule 1.

16.2 Apart from what the Contract says, and to the extent that the law allows, we make no other promises about the Service. Clause 5.3 explains what we cannot guarantee.

16.3 Protocols. We provide the Service following the protocols summarised in Schedule 3. Where Schedule 3 allows us to refuse, stop, suspend or postpone a work, doing so for the reason stated there is not a breach of the Contract; the protocols do not reduce our obligations under the law or under the DPA. For the price: if we refuse or stop before the work starts, we refund it in full; if we stop after the start for a reason attributable to you (an untrue statement, an authority or ownership disputed on your side, access not given, a payment disputed), clauses 11.2, 11.3 and 11.6 apply as if you had cancelled; if we stop for any other reason, we refund the price of the part not performed.

17. Liability — please read carefully

17.1 What is never limited. Nothing in the Contract limits or excludes the liability of either party: (a) for intentional non-performance of an obligation, fraud or damage caused intentionally; (b) for damage caused by gross negligence; (c) for death or personal injury; or (d) for any other liability that cannot be limited or excluded under the applicable law. The other provisions of this clause 17 apply to the extent that the law allows, and never in the cases of this clause 17.1.

17.2 Data deleted or damaged: restoration first. If a change made in the Service, by our engineer, by the AI Model or by an Approved Action, deletes, damages or alters data, files or configuration of a Customer Server, or stops a website or application from working, including because of an error of the AI Model:

1. the first remedy is that we restore, at no cost to you, the affected data, files or configuration from the backup taken before that change (the Prior Backup, or the snapshot or copy of clause 7.1(c)(i)), and check with you that the server works again;

2. we are not liable for data that you excluded from the backup, nor for data that were changed without our backup at your choice under clause 7.6(d)(ii). For any other loss or damage arising from that change, including data written or changed after the backup was taken and the time during which the website or application did not work, our liability is limited to the amount of clause 17.4, excludes the losses of clause 17.5 and is reduced under clause 17.7 to the extent that your own backups under clause 8.1 would have avoided the loss;

3. restoration is possible only while the backup exists and is intact: the Prior Backup, while it remains on your server or, if it was stored outside it, for the period of clause 7.6(c)(i); a snapshot, for as long as you keep it in your hosting account. If the Prior Backup has been lost with the disk or the server, or changed by a third party, restoration from it is not possible, and point (b) applies. If you notice a problem, tell us as soon as possible. If we have already destroyed our private keys (clause 19.4(c)), the restoration needs you to run a new installation package, at no cost to you. The deletion of a backup at the end of its retention period does not by itself extinguish a claim for our non-performance.

If the restoration does not reasonably restore the affected data and operation, is not possible or is not done within a reasonable time, you keep the rights to a reduction of the price and to terminate that the law gives you, and claims for damages are subject to clauses 17.4 and 17.5, except in the cases of clause 17.1.

17.3 Errors of the AI Model. The AI Model can produce results that look correct and are not, including invented facts (often called “hallucinations”). The safeguards of clause 7.1(e) apply to it, and the use of AI does not reduce our duty of care. For an error of the AI Model:

1. if it deleted or damaged something, clause 17.2 applies;

2. if it is an error or an omission in a report, an analysis or a proposal, the first remedy is that we correct the report, or repeat the affected part of the work, at no cost; if we have already destroyed our private keys (clause 19.4(c)), the work is repeated with a new installation package, also at no cost; if we cannot, we refund the price of the affected one-time service or, for a monthly plan, the Fees of the affected Customer Server for that Billing Period;

3. errors of the AI Model do not by themselves create a liability in addition to that for the service ordered: for any other loss or damage caused by an error of the AI Model, our liability is limited by clauses 17.4 and 17.5, as for any other error in the Service, except in the cases of clause 17.1.

17.4 Maximum amount. Except in the cases of clause 17.1, and without prejudice to the exclusions of clause 17.2(b) for what you chose not to protect, the total liability of each party for all claims under or in connection with the Contract, whether in contract, in tort or otherwise, is limited to the Fees paid for the service that gave rise to the claim: for a one-time service, its price; for a monthly plan, the Fees paid for the affected Customer Server in the 12 months before the event that gave rise to the first claim.

17.5 Excluded losses. Except in the cases of clause 17.1, neither party is liable for: (a) loss of profit, revenue, business, contracts or anticipated savings; (b) loss of goodwill or reputation; (c) indirect or consequential loss.

17.6 Clauses 17.4 and 17.5 do not limit your obligation to pay the Fees, nor your obligations under clause 18.

17.7 Your contribution. Our liability is reduced to the extent that the damage was caused or increased by you, for example by not keeping backups (clause 8.1), by not making the backup that you chose under clause 7.6(d), by not following a written recommendation of ours to fix a critical risk, by refusing or delaying an approval that we asked for, or by changing the server in a way that we were not told about. The same applies when the damage is caused or increased by untrue information that you gave us under Schedule 3, protocols P1 or P2, by data that you knew required special treatment and did not flag (Schedule 2, item 8), or by a late notice of the problem (Schedule 3, protocol P10).

17.8 Why these limits. They reflect the price of the Service, the fact that the risk of an attack exists independently of the Service, and the fact that we take a backup of what the Repair is going to touch before making changes, so that a mistake within the plan can be undone, and the general supervision of the process by people of Bitshard. You accept them expressly and separately before ordering (clause 4.2(b)) and confirm them when you accept each plan of action (clause 7.8). You may ask us for a quote with a higher limit.

17.9 Our subcontractors and staff. The limits and exclusions of this clause 17, and clause 26, also apply to claims for the Service against our subcontractors and against the persons who work for us and the members of our management board; you bring any claim for the Service against Bitshard and not against them, except in the cases of clause 17.1.

17.10 No rights for third parties. The Contract creates no rights in favour of your users, clients or other third parties, except those that the law or the DPA gives them.

17.11 Reliance on your statements. We are not liable for acting on a statement, an authorization or an instruction that you gave us (in particular under clauses 2, 6.2 and 7.1(g) and Schedule 2), unless we knew that it was untrue or disregarded clear signs that it was; in that case this clause does not apply. Relying on your statements does not reduce the checks that we promise in Schedule 3 (in particular protocols P1, P2 and P11, and the check of control of the domain of the Exposure Report, protocol P13) or our duty of care.

18. Your responsibility for third-party claims

18.1 You will compensate us for the reasonable costs, including reasonable costs of defence in civil, administrative or criminal proceedings, and for the damages that we have to pay to third parties, to the extent that they are caused by: (a) the untruth of your statements in clauses 2.1, 2.3, 2.4 and 6.2 or in the Authorization Form (for example, if we scanned or acted on a server because you listed it and you were not authorised); (b) unlawful content or activity on your servers, an unlawful instruction from you, or claims of your users or customers arising from your own legal obligations towards them; (c) if you are an agency, a breach of your own obligations towards your clients, including the reasonable costs of defence in the country of your client; or (d) the data that you make available on your servers and your instructions on personal data (DPA, clause 11.3), including the disclosure to AI Providers that you authorise (except their retention for their own purposes, which point (f) governs) and the lack of a legal basis or of the information to the people concerned that you confirmed, including amounts imposed on Bitshard as a sanction to the extent that they are caused by those facts and the law allows them to be passed on; or (e) the untrue declarations, the lack of authorisation and the prohibited uses of the Exposure Report, only on the terms and with the exclusions of Schedule 1, S1.1(h)(5) and (7), which prevail for that service; or (f) the retention or use by an AI Provider, for its own purposes and under its own terms, of data whose sending you authorised (DPA, clause 11.1(c)), only on the terms and with the exclusions of DPA clause 11.3(f), which prevail for those claims. This clause does not cover the part attributable to a breach by Bitshard of its own obligations, including as processor, nor processing by Bitshard or by its suppliers outside your instructions and the conditions described in the DPA. It does not limit the rights of the people concerned or the powers of the authorities.

18.2 We will tell you promptly about any such claim. You may take over the defence of a claim that you have to pay for; we will not agree a settlement that binds you without your consent, and you will not agree one that admits fault on our behalf without ours.

19. Term and termination

19.1 Monthly plans continue until cancelled. One-time services end when delivered. The DPA lasts for as long as we process personal data on your behalf.

19.2 By you, for our breach. You may terminate the Contract by email if we commit a serious breach of it that we do not remedy within 14 days of your written notice; immediately, if the breach cannot be remedied; and in the cases provided for in the DPA.

19.3 By us. We may terminate the Contract: (a) without cause, by giving you 30 days’ notice by email, with a pro-rata refund; (b) by email, if you commit a serious breach that you do not remedy within 14 days of our written notice; (c) immediately, if you seriously breach clause 6.2 or 9, if a payment remains unpaid as described in clause 10.5, or if continuing would put us in breach of the law.

19.4 What happens at the end.

1. We stop collecting data and carrying out actions.

2. Within 14 days, unless you have chosen deletion without return under the DPA, we send you an export of all the Customer Data that we still hold on your behalf: inventory, history of alerts and reports, record of actions, logs still within their retention period and working data of manual services, in common machine-readable formats (JSON or CSV), with the reports in PDF.

3. We destroy our copy of the private keys of your servers (the read key and the repair key, which we keep encrypted on the central server): (i) in the Health Check, when we send you the report; (ii) in the Emergency Clean-up, when we send you the final report or, if clause 7.6(d) applies, when the service ends under that clause (30 days after the report of the work done, or earlier if the remaining hours are used and the final report is sent); (iii) if you withdraw your authorization, when the withdrawal is complete, after the restoration if you chose it (clause 6.6); (iv) if the order ends without work (for example, because the access did not work within the period of clause 11.6), when we close it; and (v) in Watch and Managed, when the plan ends. An encrypted copy may remain for up to 14 days in the internal logs of our database, which delete it automatically. Without those private keys, the users that remain on your server let nobody in, even if you never run the removal program. We send you the instructions to remove the Watcher and ask you to run the removal program that the installation package left on your server (/usr/local/libexec/serverwatch/uninstall): it closes and removes our two users, their public keys and their sudo rules, compares the access inventory with the one taken before installation and gives you the result. Only you can remove our access from your server. Any later work on your server (for example, fixes at the Hourly Rate after the report, or a restoration under clause 17.2) needs a new installation package, with new keys. We stop using any API token that you gave us; you should also revoke it.

4. We delete the Customer Data as set out in the DPA (in summary: within 30 days of sending you the export, and from our backups within the rotation period stated in the DPA), except what the law requires us to keep.

19.5 Clauses 10 (for amounts due), 13, 15, 17, 18, 19.4, 25 and 26 continue to apply after the Contract ends. After the end of the Contract we use no access to your servers, because we no longer have their private keys (clause 19.4(c)), except through a new installation package that you run.

20. Events beyond our control

Neither party is liable for a delay or failure caused by an event beyond its reasonable control that it could not reasonably have foreseen or avoided, such as a widespread failure of the Internet or of the electricity supply, an outage of a hosting or AI provider used by us that we did not cause, a natural disaster, war, an epidemic or an act of government. Attacks against Customer Servers are not such events, because detecting them is part of the Service. The affected party tells the other promptly and does what it reasonably can to limit the effects. If the event lasts more than 30 days, either party may terminate the affected service, and you receive a pro-rata refund.

If an AI Provider suspends or restricts our account for a reason that is not attributable to us, we continue with another AI Provider listed in the DPA or with an Own Model where one is available. If none is available, the affected services are suspended until one is; you receive a pro-rata refund for the time of the suspension, and you may terminate the affected service if the suspension lasts more than 14 days. Except in the cases of clause 17.1, these are your remedies for that interruption.

21. Changes to these Terms

21.1 We may change these Terms only for one of the following reasons: a change in the law or in a decision of an authority or court; a change in the Service, in our suppliers or in our costs; the addition of new products (for example, the plans of clause 1.4); or the correction of an error or an ambiguity.

21.2 We give you at least 30 days’ notice by email, explaining what changes and why, and we keep every version accessible. If you do not accept the change, you can cancel before it takes effect, without any cost, and clause 11.4 applies. Changes required by law may take effect sooner if the law requires it; changes to the list of sub-processors follow the procedure of the DPA.

21.3 No change: (a) reduces what you receive in a Billing Period that you have already paid; (b) changes the conditions or the price of a one-time service that you have already ordered, unless you agree in writing; or (c) reduces our legal obligations of data protection.

22. Communications

22.1 Notices under the Contract are given by email: to you, at the address in your Order or Authorization Form; to us, at info@bitshard.eu. Our emails are sent from no-reply@bitshard.eu, with info@bitshard.eu as the reply address. An email is treated as received when it reaches the recipient’s mail server, or at the start of the next Business Day if it arrives outside Business Hours. This last rule does not apply to security notices (alerts, notices of personal data breaches): we send them as soon as possible, also outside Business Hours.

22.2 Messaging channels. We write to you by email and, for short summaries and buttons, by WhatsApp or Telegram if you give us a number or a user for it; our operators receive notices and confirm actions through an internal group on Telegram or a similar service. Through these channels we send only summaries without Customer Personal Data (an internal identifier of the server, the type and severity of the event, the reference of a plan and, during a Repair, summaries of its progress built from the type of action and the references of the plan; and, when a plan is accepted, the IP address and the type of browser from which it was accepted, so that the operator can check its origin, Schedule 3, P20), written from fixed templates; never logs, keys, passwords, installation packages, commands to run on your server or other content of your servers, never the links to permit plans of action (clause 7.8) and never formal notices, which go by email. Through these channels our operators can only confirm or stop what already exists (a plan that you have accepted, an access check, a work that you have ordered, a step of a Repair that our internal measures hold for confirmation), with fixed buttons or commands; no message from these channels starts a reading of your server outside a service that you have ordered, and no free text from them reaches the AI Model. You agree that those summaries, which may reveal that a server of yours has an incident, pass through the providers of these channels (clause 15.1). Do not send us notices, credentials or Customer Data through them; if you send us data of your server or passwords through WhatsApp or Telegram, we delete them from the chat within 24 hours and do not use them.

22.3 Buttons in our emails. Our system does not read the emails that we receive: what you write to info@bitshard.eu, including a reply to one of our emails, is read by a person in Business Hours and does nothing by itself until then (for a withdrawal, clause 6.6 applies). Our emails carry unique links (buttons) that open our acceptance page (clause 7.8(b)): opening a link only shows the action and a button, and the action happens when you press it. With them you can withdraw your authorization (clause 6.6); tell us that an acceptance or data that we have recorded did not come from you (“It was not me”, clause 7.8(e)); confirm an acceptance from the second address (clause 7.8(e)); give us the data that the installation package shows (the fingerprint of your server and the access inventory), the IP address of the server, your contacts and the data of Schedule 2, point 8; choose what to do when the Prior Backup does not fit (clause 7.6(d)); tell us that you have installed the access (“I have installed it”, clause 11.6); and follow your Order in “Status of your order”. Each link belongs to your Order and to the address to which we sent it; if you lose one, “Lost your link?” on that page sends to that address the links that are valid at that moment. We record each press with the IP address and the browser from which it was made (our privacy policy says for how long). When the page receives the fingerprint of your server, we send to the address of your Order an email with the fingerprint that we have recorded, so that you can compare it with the one that the installation package showed you; and if the email addresses of your Order are changed on the page, we tell the address of your Order and the previous addresses. If you did not do it, press “It was not me” in that email or write to us.

23. Subcontractors and transfer of the Contract

23.1 We may use subcontractors to provide the Service; for personal data, the DPA applies. Our engineers are not subcontractors: they work for Bitshard directly, under its instructions (clause 3, “Our engineer”). We remain responsible to you for the work of our subcontractors, and for their compliance with the DPA, as for our own (Article 28(4) GDPR).

23.2 We may transfer the Contract to a company that takes over the Server Watch business, by telling you at least 30 days in advance; you may cancel before the transfer. You may transfer the Contract only with our written consent, which we will not refuse without good reason.

24. References

We will not name you as a customer, or use your name or logo, without your written consent.

25. General

25.1 The Contract is the entire agreement between the parties about its subject matter and replaces earlier discussions, except for any statement made fraudulently.

25.2 If a provision is invalid or unenforceable, the rest of the Contract remains valid. If a provision can be divided into independent parts and only one of them is invalid, the other parts remain valid (§ 39(2) of the Estonian Law of Obligations Act). The parties intend each exclusion and each limit of clause 17, and each sentence of clause 26.2, as an independent part; this clause does not ask anyone to reduce or reinterpret an invalid part to make it valid.

25.3 A party that does not enforce a right immediately does not waive it.

25.4 Language. The Contract exists in English and Spanish. If the two versions differ, the Spanish version prevails for customers who ordered through our Spanish website or in Spanish, and the English version prevails for all other customers, including those who ordered through our French, German or Italian pages; those pages say so next to the payment button.

26. Governing law and courts

26.1 The Contract is governed by the law of the Republic of Estonia. Non-contractual obligations arising out of or in connection with the Contract are governed by the same law to the extent that Article 14 of Regulation (EC) No 864/2007 (Rome II) allows this choice.

26.2 The courts of Estonia, with Harju County Court (Harju Maakohus) in Tallinn as the court of first instance, have exclusive jurisdiction over any dispute arising out of or in connection with the Contract. Bitshard may also bring claims against you in the courts of the Member State of the European Union, or of the State party to the Lugano Convention of 30 October 2007, in which you are domiciled. For a customer domiciled elsewhere, the courts of Estonia have exclusive jurisdiction for both parties, and Bitshard may not bring claims in any other court. This clause does not affect rules of jurisdiction that the law makes mandatory.

26.3 Before going to court, the parties will try for 30 days to settle the dispute by written negotiation. This does not prevent either party from asking for urgent interim measures, nor from bringing an action when it is needed to avoid the expiry of a limitation period.

Schedule 1 — Service descriptions

Supported systems. Watch and Managed: Ubuntu and Debian versions that receive security updates from their publisher. Health Check and Emergency Clean-up: any version of Ubuntu or Debian, also without security support (the report then says so and recommends upgrading). Other Linux distributions, for any service, only by written agreement before payment.

S1.1 Exposure Report

1. What it includes. For one domain, a report made from the Internet and without logging in to anything, of what the domain shows publicly to any visitor: the software versions announced by the web server on ports 80 and 443, the TLS certificate, the DNS records and the public content of the website. We also look up the domain and its IP address in public services (for example, certificate-transparency logs, RDAP and WHOIS registries, services that identify the network of an IP address, public blocklists, and databases of vulnerabilities and end-of-support dates). The price is that of the Price List. It is sold only to businesses and professionals: when you order it you make the declarations of clauses 2.1 and 2.2 and of point (h); for this product, point (h) takes the place of clause 6.2.

2. What it does not include. We do not scan ports, try any access, log in or analyse anything that is not public; we do not look inside the server, fix anything or give advice beyond the report. We do not analyse a domain that resolves to a private, internal or reserved address (for example, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 or 127.0.0.0/8) or to an address of our own systems; in that case we cancel the order and refund the amount paid.

3. Automatic, without human review. The whole service is automatic: the payment, the check of control of the domain, the analysis, done with automatic tools and, where we use one, the AI Model, and the sending of the report by email. No person reviews the report before it is sent. The report is for information only, may contain errors or be incomplete and is not a security audit; it lists the sources consulted and their date. Do not take security decisions based only on it.

4. Proof of control of the domain. Before analysing, our system checks automatically that you control the domain, in one of these ways: a TXT record in its DNS, a meta tag on the home page of its website or a file under /.well-known/ on its website, with the value that we send you by email. The report is sent only to the email address of your order, and never to another address. You have 7 days from the payment to prove control, and halfway through that period we remind you by email. If control is not proved within the period, the order ends without a report and the amount paid is not refunded, because checking control of the domain is part of the service that you bought.

5. Liability. Except in the cases of clause 17.1, our total liability for an Exposure Report is limited to the amount that you paid for it, and clause 17.5 applies.

6. Retention. We keep the report, the proof of control of the domain and the data of the order for 6 months after we send the report or cancel the order, and then delete them, unless you are or become a customer of another service, in which case clause 14 and our privacy policy apply. Point (h)(6) says when some evidence is kept longer. Invoices are kept for the period that accounting law requires.

7. Other conditions. The Exposure Report is provided under this S1.1, which you accept when you order it; the payment page, the order form and the email with the report refer to it, with a link to these Terms. While online payment is not available, you order it through the form on our website, which includes the declarations of point (a) and the acceptance of this S1.1; we then send you a payment link by email, and the order starts when you pay (clause 4.1). Discount codes apply as in clause 10.8. Buying it creates no obligation to buy other services. We may refuse an order; if we refuse after the payment, we refund the amount paid, except in the cases of points (d) and (h)(4). Clauses 2, 5.3, 6.4, 9, 10, 14, 15, 16, 17, 18, 25 and 26 of these Terms and protocols P10 and P13 of Schedule 3 apply to it.

8. Your declaration, the use of the report and your liability.

1. What you declare. When you order the report, and when you tick the box on the payment page or on the order form, you declare and warrant that: (i) you buy for your business or profession (clause 2.1) and can bind the organisation identified as the buyer (clause 2.3); (ii) the domain belongs to your organisation, or its owner has authorised you in writing, with an authorisation in force, to order this report about it from Bitshard and to receive it; if you are an agency or a provider, that authorisation covers ordering this service and receiving the result for the owner; (iii) you do not intend to attack the domain and you order the report only to know and improve the security of the systems covered by your authorisation; and (iv) the information in the order (name, organisation, email address and domain) is true. If you act under an authorisation, you keep it for the period of point (f), send it to us within 3 Business Days if we ask for it because of a justified doubt or a claim, and tell us at once if it is withdrawn. Being able to read a mailbox of the domain, manage its website or publish a code on it does not replace that authorisation when your organisation is not the owner. We rely on these declarations (clause 17.11).

2. What you authorise us to do. Only the public checks of points (a) and (b) and the sending of the report to the email address of the order. This does not include logging in, trying passwords, exploiting vulnerabilities, load tests or port scans, and it does not extend to other domains or to the systems of the hosting provider.

3. Prohibited use. You must not use the report, the information in it or the proof of control of the domain to: (i) access, or attempt to access, a system without authorisation; (ii) attack, interfere with, disrupt or damage the domain, its server or its services; (iii) prepare, facilitate or help another person to do any of those things, including by giving them the report or part of it; (iv) extort, blackmail or pressure the owner of the domain or its provider; or (v) any other unlawful purpose. You may share the report with the owner of the domain, its authorised security advisers and the authorities when the law allows it. Clause 9 also applies.

4. Withholding and cancellation. If, before we send the report, there are objective and reasonable signs that a declaration of point 1 is untrue or that the report would be used against point 3 (for example: the owner of the domain or its provider tells us so; the proof of control comes from a person other than the one in the order; the same buyer orders reports on several unrelated domains; the domain belongs to a public authority or to an entity of an essential sector and you do not show the authorisation; our payment provider flags the payment as fraudulent), we may stop the analysis and withhold the report. An automatic alert alone is not proof of a breach. We tell you why and how to clarify it, unless the law or a risk to an investigation prevents it, and you have 7 days from that notice to do so. If the signs persist after that opportunity, or the unlawful use is established, we may cancel the order. A cancellation for a serious breach by you of point 1 or 3 gives no right to a refund, to the extent that the law allows; if we cancel as a precaution without being able to show such a breach, we refund the amount paid. This is separate from the end of the order without refund of point (d); the refunds of points (b) and (g) and those due to a breach by us remain. If a delay of ours prevents you from proving control, the period of point (d) is extended by that delay.

5. Your liability. Under clause 18, you will compensate us for the proven damages and for the amounts that we have to pay to third parties as a result of an untrue declaration, a lack of authorisation or a prohibited use for which you are responsible, including the necessary, reasonable and documented costs of defence and legal advice, lawyers included, in civil, administrative or criminal proceedings related to those facts, to the extent that the law allows. We must prove the fact, the damage or cost and the link between them; there is no fixed amount and the same loss is not charged twice. This does not include fines or sanctions imposed on Bitshard, nor the part of the damage or cost caused by a breach, lack of care or unlawful act of Bitshard or of persons for whom it is responsible; if both of us contributed, you pay only your share. This liability may exceed the price of the report: it is part of clause 18 and, under clause 17.6, the limits of point (e) and of clauses 17.4 and 17.5 do not apply to it. Clause 18.2 applies, and these rights and obligations survive the delivery or cancellation of the report.

6. Evidence and authorities. We keep your declaration, the version of these Terms that you accepted, the time, the domain, the proof of control and the report for the period of point (f). If before their deletion a specific claim arises or is reasonably foreseeable, we keep only the evidence needed for it, with restricted access, for as long as it is needed. We may give them to the police, a prosecutor, a court or an administrative authority that requests them with a legal basis, or use them to report facts where the law allows it, after checking the recipient, the need and the scope; we tell you unless the law or the authority forbids it. None of this reduces our obligations under the privacy policy.

7. What this point does not exclude. This point does not remove our own obligations or liability, does not limit the rights of persons who have not signed this Contract (clause 17.10) and does not affect the cases of clause 17.1, criminal or administrative liability, data protection or the powers of the authorities. It does not allow us to ignore signs of abuse or to skip the checks that we promise. Your declaration does not prove by itself that you own the domain, does not guarantee its security and does not prevent a third party from claiming.

S1.2 Health Check (one-time review of one server)

1. Includes, for one Customer Server with up to 5 websites or applications: a complete inventory of the software; a report of known vulnerabilities and end-of-support dates; a check for signs of compromise (cryptocurrency miners, backdoors, unknown users, keys and scheduled tasks); a check from the Internet of what the domain that you give us shows publicly (web server, TLS certificate, security headers, DNS, mail records and public blocklists), without a port scan (the services listening on the server are listed from inside it); and a report in plain language with a prioritised list of fixes. Each additional website or application is charged as shown in the Price List. It is a Diagnosis carried out with the AI Model (clauses 7.1 and 7.6(a)). The report follows Schedule 3, protocol P14.

2. Access and preparation: you run as administrator the installation package (install.sh, with the command sudo sh install.sh) that we send you only by email, together with its SHA-256 fingerprint. Each package carries keys of its own, so its fingerprint changes with each order; before running it, you can compare the fingerprints of the fixed programs that it installs (access-fingerprint, compare-fingerprints and uninstall) with those that we send you with the installation package, which you can also ask us for at info@bitshard.eu. It creates the read user and the repair user of clause 6.7(a), each with one key of Bitshard accepted only from the IP address of our central server. Both are needed also for the Health Check (clause 11.6): in it the repair user is used only to check, for at most 10 minutes, that it can use sudo, and for fixes only if you order them. The keys have no end date on your server (clause 6.7(a)), but we destroy our copy of the private keys when we send you the report (in the Emergency Clean-up, the final report or, in the case of clause 7.6(d), when the service ends under that clause; clause 19.4(c)); fixes at the Hourly Rate that you order after the report therefore need a new installation package, with new keys. The preparation is documented in the report, it does not authorise any Repair, and it is not the start of the work under clause 11.2. The period for giving these accesses is that of clause 11.6. When we finish, we ask you to run the removal program (uninstall, clause 19.4(c)) to remove our users from your server; without our private keys they let nobody in, even if you do not run it.

3. During a Health Check we make no repair changes. The only preparation changes are the access components that you install under point (b) and remove with the removal program; we document them in the report. Fixes are not included; you can order them at the Hourly Rate (clause 10.7), and they are carried out as a Repair (clause 7.6(b)); after the report they need a new installation package (point (b)).

4. Delivery: the review starts automatically as soon as the access is verified. Our target is to deliver the report within about 1 hour; it is a target, not a commitment (clause 12.4).

5. A Health Check or an Emergency Clean-up of the server delivered in the previous 30 days is the required first step to order Watch or Managed for that server (S1.3 and S1.4). An Emergency Clean-up can be ordered directly, without a Health Check.

S1.3 Watch (monthly, per server; available under clause 1.4)

1. It can be ordered for a server that has had a Health Check or an Emergency Clean-up delivered in the previous 30 days. It requires the Watcher and the Bitshard Access installed on the server for as long as the plan lasts (clause 6.7).

2. Includes, for one Customer Server with up to 5 websites or applications: an inventory refreshed every few hours; matching against new vulnerabilities and end-of-support dates; alerts; Patch Runs for the security updates of the operating system, PHP and other distribution packages, and of WordPress core, plugins and themes, with automatic rollback; temporary containment when no fix exists yet (clause 7.5(b)); monitoring of resources, files, users, processes, scheduled tasks and network connections; external checks (clause 6.3(f)); AI analysis of anomalies, supervised by an operator; Deep Checks through the Bitshard Access (clause 6.7(b)); Approved Actions from the Action Catalogue to contain an incident (for example: block an IP address, stop a process, quarantine a file); and a monthly report.

3. Not included: major upgrades; backups; full clean-up of a compromised server (available as Emergency Clean-up); hardening beyond the containment actions; guaranteed response times.

S1.4 Managed (monthly, per server; available under clause 1.4)

1. It can be ordered under the same conditions as Watch (S1.3(a)).

2. Includes everything in Watch, plus:

1. major upgrades of the operating system, PHP and databases, planned with you and carried out on an agreed date, after a test where possible;
2. daily backups stored outside the server, encrypted, at Contabo GmbH (Germany), in the European Union, kept for 30 days, with a monthly restore test in a temporary environment that is deleted after the test; when the disk of the server has no room for a Prior Backup, that backup is also stored there (clause 7.6(c)(i));
3. hardening of the firewall, SSH, web server and WordPress;
4. incident clean-up at no charge when the cause is on our side, as set out in point (d);
5. a target of a first human response within 4 Business Hours (clause 12.3), which is not a contractual commitment (clause 12.4).

3. A major upgrade may require changes to your own applications; adapting them is not included and can be ordered at the Hourly Rate.

4. Incident clean-up: who pays. In Managed we are responsible for keeping the operating system and the Managed Software up to date and working. “Managed Software” means the operating system and the packages of its distribution (including PHP, the web server and the database server) and, if they are listed in the Authorization Form, WordPress core and the plugins and themes that we update through Patch Runs.

1. When the cause is on our side, the clean-up is free. If an intrusion into a Customer Server is caused by our action or omission, we clean up the server at no charge, as described in S1.5(b) to (e) but without the limit of 8 hours. It is caused by our omission, in particular, when the attacker used a vulnerability of the Managed Software for which its vendor had published a fix that we had not applied within the period of point 4, or a configuration that we set, or should have set, under point (b)3. Clause 17 applies to any other loss.

2. When it is not, you order an Emergency Clean-up. If the intrusion is caused by (i) an action or omission of yours or of people for whom you are responsible (for example, weak or reused passwords, accounts that you created, software, plugins or themes that you installed or that are not Managed Software, your own code, or not following a written recommendation of ours), or (ii) a vulnerability (for example, one with a CVE identifier) for which no fix that could be applied within the period of point 4 existed, or that is in software that is not Managed Software, the clean-up is not included: we contain the incident (S1.3(b)), and you can order an Emergency Clean-up at the price of the Price List.

3. Who determines the cause, and with what evidence. Our engineer determines the cause in the report of the investigation, with the evidence on which it is based: the entry point, the relevant log entries, the timeline of the intrusion and the inventory history showing which version of the affected software was installed and when its fix was published and applied. The investigation that determines the cause is part of Managed and is not charged. If you disagree, tell us within 30 days of the report, with your reasons; the parties then follow clause 26.3 and may agree to appoint an independent expert, whose fees are paid by the party whose position the expert rejects. If it is later established, by agreement, by that expert or by a court, that the cause was on our side, we refund the price of the Emergency Clean-up.

4. Period for applying fixes. For this point (d), a fix has been applied in time if it was applied: for urgent updates under clause 7.5(b), within 2 Business Days of its publication by the vendor; for other updates, in the first Maintenance Window that starts at least 2 Business Days after its publication. The period does not run while an update is held back for a reason not attributable to us (for example, because it breaks one of your sites, because you asked us to wait, or because our access was not available).

5. If the cause cannot be determined. If the evidence does not allow the cause to be determined, the clean-up is charged as an Emergency Clean-up at the normal-tier price, unless the cause cannot be determined because records that we had to keep under the DPA (Annex II.G) are missing for a reason attributable to us; in that case it is treated as caused on our side.

6. Concurrent causes. The presence of a vulnerability, even one without an available fix, does not by itself exclude an action or omission of ours as a cause. Software that you installed but that is listed as Managed Software is treated as Managed Software. If several causes concur, the report states the contribution of each one; when an action or omission of ours contributed causally to the intrusion, the included clean-up is not refused by invoking only another concurrent cause. The 30 days of point 3 start the review procedure and do not extinguish the rights that the law gives you; our report does not bind you and does not change the legal rules of proof. Any delay of an update because of an incompatibility is documented, communicated to you and accompanied by the containment measures that are due.

S1.5 Emergency Clean-up (one-time, one server)

1. Two tiers, at the prices in the Price List. Normal: our target is to start on the Business Day after we have received the payment and working access. Urgent: ordered only by written quote; before you pay, we confirm in writing that we can take your clean-up and the start time that we expect, normally within 4 Business Hours of receiving those two things, and we give it priority over all our other work: its plans are confirmed by an operator, and its Repair started, before those of any normal work waiting at the same time. That start time is a target, not a commitment (clause 12.4): if we have not started by then, you can cancel and we refund everything you paid (clause 11.3); if you let us start later, the price of the urgent tier remains due. We take only one urgent clean-up at a time.

2. Each tier includes up to 8 hours of work in two phases (clause 7.6): a Diagnosis (containment needs, analysis of how the attacker got in and what they did), in which the AI Model only reads; and a Repair (removal of what the attacker left, closing the entry point, applying the necessary updates), in which the AI Model runs the changes of the plan of action that you accept, after the Prior Backup; the process is supervised in general by people of Bitshard, without a person approving each command or each change (clauses 7.1(c) and 7.6(b)). Hours of work are the time during which our AI works are running on your server plus the time that our staff spend on your clean-up; the time spent waiting for your decisions does not count. It also includes recommendations (for example, changing passwords and keys) and a report in plain language. If more than 8 hours are needed, clause 11.3 applies. Before the included hours run out, we tell you what remains to be done and an estimate, so that you can decide.

3. A compromised server can never be declared clean with complete certainty. While the attacker keeps any access, our work may provoke a reaction (for example, deleting or encrypting data); that is why the Prior Backup comes before any change, and we recommend that you keep your own backups outside the server during the clean-up. Damage caused by the attacker is not caused by us, except to the extent that a breach of our obligations contributed to it. If the evidence shows that the attacker obtained administrator privileges, we recommend in writing, in our first findings, rebuilding the server; the rebuild is quoted at the Hourly Rate, and if you decide not to rebuild, you accept the risk that remains.

4. We do not take a separate copy of the evidence of the attack. The Prior Backup (clause 7.6(c)) keeps the files that the clean-up changes or removes, and the record of commands shows what was done. If you need a forensic copy of the server (for example, for your insurer or the police), make it, or ask us for it at the Hourly Rate, before accepting the plan.

5. The decision to notify authorities, the police or affected people is yours; we can help you with it.

S1.6 Agency and reseller plan (available under clause 1.4)

1. Available from 10 Customer Servers of the same customer, at the agency prices in the Price List, including the Health Check, or the Emergency Clean-up, that is the required first step for each server (S1.2(e)).

2. The agency is our customer. It is responsible for its own clients, for having their written authorization for our access, for the use of AI Providers and for the transfers described in the DPA (clause 6.2), and for its contracts with them; it sends us that authorization, or a written confirmation of the client, before our first access to each client’s server, and it passes on to its clients the notices about Sub-processors (DPA, clause 2.2). We do not contract with or contact the agency’s clients unless the agency asks us to, or in an emergency in which we cannot reach the agency and there is a serious risk to the server.

3. Reports can carry the agency’s name and logo instead of ours. The agency must describe the Service to its clients as these Terms do, including that the AI Model carries out the accepted plans with the process supervised in general by people of Bitshard, without a person approving each command (clause 7.6(b)), and must not promise its clients more than these Terms provide.

4. For personal data, we act as the agency’s sub-processor under the DPA.

Schedule 2 — Authorization Form (contents)

How it is given. For the Health Check and the Emergency Clean-up, the Authorization Form is made up of: (A) the fields and the acceptance box of our payment page (points 1, 3 for the server, 11 to 14); (B) the information of points 2 and 8 and the IP address of the server, which you give us on our acceptance page with the links of our emails (clause 22.3), and that of points 3 and 9, which you send us by email, before the work or, at the latest, before the first plan of action; and (C) your acceptance of each plan of action (clause 7.8), which authorises each change (point 5(b)). Until you give us the information of (B), the rules stated in each point for that case apply. For Watch and Managed, the complete form, with all the points, is sent as a document or an online form from an email address of the customer’s organisation, or signed, before the plan starts. It contains:

1. Customer (payment page): legal name, address, tax or VAT number; the email address of the Order, which is also the address for permissions, to which the links to permit plans of action are sent (clause 7.8), unless you give us another one on our acceptance page before the first plan; for companies of the jurisdictions stated in Schedule 3, protocol P11, the persons who own 50% or more or control the company (by email, when we ask).
2. Contacts (on our acceptance page, clause 22.3): a second email address, in a mailbox other than that of the address for permissions, for the copy of the accepted plans and the confirmation of clause 7.8(e) (required for the Emergency Clean-up before the first plan); and the people who may approve major upgrades (Watch and Managed). A withdrawal of authorization is made with the “Withdraw the authorisation” button of our emails or as stated in clause 6.6. The box “I do not want to receive emails about Bitshard’s similar services” is on the payment page, with a link to the privacy policy.
3. For each Customer Server: public IP address or domain (payment page; if we ask you for the IP address, on our acceptance page); by email: name; other IP addresses and domains; web addresses to check after updates; operating system; hosting provider; ports that are expected to be open; whether the hosting provider’s permission is needed for scans and, if so, confirmation that it has been obtained. We do not work on shared hosting (Schedule 3, protocol P2).
4. Access given: Watcher (yes/no, Watch and Managed); the Bitshard Access (read user and key; repair user and key), accepted only from the IP address of Bitshard’s central server (stated in the installation package), which you give by running the installation package (Schedule 1, S1.2(b); clause 6.7(a)); hosting-provider API token (optional; permissions limited to snapshots and resource metrics, only if the provider allows that limit).
5. Activities authorised, for each server: (a) observe: read data, including with the AI Model, and external checks, authorised by ordering the service for the server; port scans in monthly plans, by the box of the form; (b) change: each Repair with the AI Model, authorised only by accepting its plan (clause 7.8); in Watch and Managed, also the boxes of the form for Approved Actions, Patch Runs and OS Automatic Updates.
6. Prior Backup: a copy of what the Repair will touch, on the disk of the Customer Server or, if there is no room and backups of that server are contracted with us, with those backups (clause 7.6(c)). In the case of a Large Data Volume (not enough free space on that disk and no contracted backups), the choice of clause 7.6(d) is made in writing before the Repair.
7. Options (Watch and Managed): Maintenance Window (day, time and time zone); urgent actions outside the window (“act and inform me” or “ask me first”); OS Automatic Updates (enable / leave as they are / disable); period for keeping rollback snapshots (7 days); external port scans (weekly, from the IP addresses that we state in this form); sharing of attacking IP addresses with CrowdSec SAS (France) to receive shared blocklists: no (default) / yes.
8. Special data and rules (on our acceptance page, before the work): whether the server processes special categories of personal data (for example, health data), data of children or payment-card data; log sources and paths that must not be read or sent to the AI Model; whether the organisation is subject to NIS2 or to sector rules with incident-notification deadlines (clause 2.1). If you give us nothing, we treat the server as not processing such data and you remain responsible for that information (clause 7.1(g); Schedule 3, protocol P3).
9. Transfers (customers outside the European Economic Area, by email when we ask): whether the customer acts as controller or as processor for others, whether its processing of the data is itself subject to the GDPR and, for Module Three of clause 12.4 of the DPA, a description of the customer’s own security measures and of its sub-processors; the safeguard that applies to that transfer (DPA, clause 12.4).
10. For agencies: confirmation that each client has authorised the agency in writing to give this authorization and to use Bitshard, the AI Providers and the transfers described in the DPA, with a copy of that authorization or a written confirmation of the client for each server (clause 6.2).
11. Declaration (included in the acceptance of these Terms on the payment page and repeated in the boxes of each plan of action): “The organisation named in the Order owns or controls the servers, IP addresses and domains given, or has the written permission of their owner, and authorises Bitshard OÜ, and the persons who carry out the Service on its behalf under clause 23.1 of the Server Watch Terms of Service, to carry out on them the activities of the service ordered, as described in clauses 6.3, 6.7, 7.1 and 7.6 of those Terms.”
12. Confirmation of the notice on liability: the third notice of clause 4.2(b), accepted with its own text on the payment page, and repeated in the boxes of each plan of action. For Watch and Managed it is also ticked in the form.
13. Confirmation of the instruction on the AI Model: the first notice of clause 4.2(b), with the instruction to use the AI Models and AI Providers listed in Annex IV of the DPA under the conditions of clause 11 of the DPA, accepted on the payment page. For Watch and Managed it is also ticked in the form.
14. Confirmation of status and authority: the organisation buys the Service for its business; it is not subject to sanctions (clause 2.4); and the person who orders has authority to do so for it and, where they are different, for the owners of the servers. It is accepted on the payment page with these Terms, and the person who accepts each plan confirms their authority in its boxes.

Schedule 3 — Protocols (summary)

We provide the Service following written protocols. This Schedule summarises what they mean for you; our internal procedures describe each step in more detail, and only what this Schedule says binds us towards you. Where a protocol allows us to refuse, stop, suspend or postpone a work, clause 16.3 applies. The protocols do not reduce our obligations under the law or under the DPA.

P1. Business customers. At payment you give us your company name and address and, in the European Union outside Estonia, your VAT number, and you confirm that you buy as a business. The work may start before we check these data. We check them within 5 Business Days of the payment: in the European Union outside Estonia, that your VAT number is valid in VIES and, where VIES shows the name, that it matches (where it does not, we compare it with a public register or an invoice of yours); outside the European Union, a public register entry or a tax identifier if we ask for it. If we learn, before or during the work, that the buyer is a consumer, we stop, cancel the Order and refund everything paid; if the VAT number is not valid, clause 2.2 applies.

P2. Control of the server and authority. You show that you control the server, and not only the domain, by running yourself, as administrator, the installation package that creates our users and adds our keys; we check the access before starting. If at any moment we see signs that the person who ordered may lack authority (for example, a personal email address, a server that appears to belong to another organisation, or an employee acting alone), we stop and ask for confirmation by a second person of the organisation or, if it has a single representative, by the representative registered in the commercial register, and we do not continue until we receive it. Agencies send the authorization of each client before our first access (clause 6.2). We do not work on shared hosting. If anyone else claims rights over the server or disputes the authority, we stop, keep the evidence of the authorization and do not continue until the matter is clarified. Having technical access, even as administrator, does not prove authority.

P3. Special data. Tell us before the work, on our acceptance page with the link of our instructions email (clause 22.3), whether a server processes special categories of personal data (for example, health data), data of children or payment-card data, and which sources or paths must not be read (Schedule 2, point 8); the restrictions of clause 9.2 of the DPA then apply to those sources. Our tools do not detect such data automatically before the AI Model reads them; if signs of them appear during the work, the report says so and the restrictions apply from then on. You remain responsible for flagging what you know (clause 7.1(g)).

P4. Errors of the AI Model and prompt injection. Logs and files of your server are treated as untrusted content: our instructions tell the AI Model that everything it reads on the server is data and never an order. In the Diagnosis, the AI Model works in jobs that no person follows, only with the read key; in the Repair, with the process supervised in general by people of Bitshard (clause 7.6(b)), only to carry out the accepted plan, moving files to quarantine instead of deleting them and stopping when a step needs something that is not in the plan. A second AI model checks the plan before it is sent to you and checks the result of the Repair against the plan. Every command is recorded, the access inventory is compared before and after the Repair, and any difference that the plan does not explain is reported to you. No person approves each command or each change before it runs (clause 7.1(e)).

P5. Prior Backup. Before the Repair, our system checks the free space on the disk of the Customer Server. The first work with the repair key takes the copy of what the Repair is going to touch (the files, configuration and scheduled tasks that the plan changes and, if the plan changes a database, a dump of all the databases of the server, which, when restored, all go back to the date of the backup), stores it on that disk in a folder that only its administrator can read, and checks that it is complete and can be read; if it cannot be checked, nothing is changed. Before the backup nothing is changed on the server. If there is not enough free space and you have backups of that server contracted with us, the copy is stored outside the server, encrypted, with those backups and for their period (clause 7.6(c)(i)); if you have none, the Repair does not start until you make your own backup or accept the risk in writing (clause 7.6(d)). Data that the plan does not touch are not covered, and a copy on the same disk is lost if the disk fails or an attacker changes it; a full restore test is not part of the service. Clause 7.6(c) and (d) apply.

P6. Incidents and breaches at Bitshard or at a provider. If we become aware of a personal data breach that affects your data, at Bitshard or at a Sub-processor, we tell you without undue delay and at the latest within 48 hours (DPA, clause 15), with what we know at that moment, and we complete the information as we learn more. If the central server may be compromised, we switch it off and ask you to delete the lines with our keys, because only you can remove them. In Watch and Managed we give you new keys when the cause has been corrected; in the Health Check and the Emergency Clean-up, we stop the work and refund the price of the part not performed (clause 16.3). If an AI Provider suspends or restricts our account, clause 20 applies.

P7. Requests from authorities outside the European Union. If an authority of a country outside the European Economic Area asks Bitshard or a person who works for it for Customer Data, we disclose nothing unless an international agreement or the law of the European Union or of a Member State requires it, or a law binding on the person asked compels it after reasonable means to contest the request have been used; we disclose only the minimum, tell you unless the law prohibits it, and record the request and the answer (DPA, Annex III, section 4, point 5).

P8. A person stops working on the Service. If a person who works on the Service for Bitshard stops doing so, we revoke on the same day their user of the VPN and of the central server, their credentials for the AI Provider and their access to the messaging group, change the passwords that protect the keys, and obtain the return or deletion of any Customer Data that they hold, with their written confirmation. Bitshard is the holder of the accounts of the AI Provider, of the central server and of the VPN.

P9. Payment disputes. If you dispute a payment with your bank or card issuer, we send the payment provider the evidence of your acceptance and of the work performed. A dispute does not cancel the amount due for work performed; if the dispute is resolved in our favour or withdrawn, you pay the reasonable fees that the payment provider charged us for it. While a dispute about a work is open, we may suspend further work on it at once, which may leave the server in an intermediate state, and we tell you its state in writing.

P10. Problems and claims. Tell us of any problem or claim in writing as soon as you discover it, and within 30 days; a later notice does not extinguish your claim, but you bear any increase of the damage caused by the delay (clause 17.7). From the moment a claim is announced, or one of us tells the other in writing that a claim about a specific work is reasonably foreseeable, both parties keep the relevant evidence (records, reports, backups, emails); you instruct us to keep, for that purpose and only for as long as the claim lasts, the data concerned, even beyond the normal retention periods, and we tell you what we keep.

P11. Sanctions. When you order and when your details change, we check the name of your organisation and of the signatory against the consolidated lists of financial sanctions of the European Union and of the United States, and the country of your organisation and of the servers. For companies registered in jurisdictions where ownership is not public (for example, the British Virgin Islands, Cyprus, the State of Delaware, the United Arab Emirates or Hong Kong) we ask who owns 50% or more or controls them. If there is a match that we cannot exclude, we suspend the work and deal with the money received only as the law allows (clause 2.4).

P12. Withdrawal and closing of access. When you withdraw your authorization, we stop the works for the affected servers, close our sessions, unload their keys from memory, cancel scheduled work and confirm it to you by email; a program that a command started on your server before the stop may keep running, and we tell you what to check (clause 6.6). When the withdrawal is complete (after the restoration, if you chose it), we destroy our copy of the private keys of those servers and ask you to run the removal program (uninstall) to remove our users (clause 19.4(c)).

P13. External checks. We scan only the IP addresses of the servers that you have authorised (clause 6.1), from the addresses stated in Schedule 2, point 7; in monthly plans, only while the IP address still corresponds to the Customer Server according to the Watcher; in one-time services we scan no ports, and we make the checks from the Internet of clause 6.3(f) only during the work. We stop scanning a target at once if its owner or its hosting provider objects, until you confirm in writing that it is still yours. The Exposure Report (Schedule 1, S1.1) scans no ports: it only does what any visitor of the website can do and consults public services; it is made by a process on our central server that has no access to the keys of customer servers; it does not analyse domains that resolve to private, internal or reserved addresses; and it is sent automatically, without human review, only after proof of control of the domain and only to the email address of the order. The payment page, the order form and the email with the report refer to S1.1 of these Terms.

P14. Reports. Where there are fixed checks (in Watch and Managed), reports separate their results from the analysis of the AI Model. Reports state that they were prepared by an AI model and checked by a second AI model before delivery, and describe the evidence and its limits: they do not present as a fact that an identified person did something unless the evidence shows it. No person reviews every report before delivery; if you ask, our engineer answers your questions about it. If we discover an error in a report, we correct it and tell those to whom we sent it.

P15. Interruptions (Watch and Managed). If the review of alerts by our engineer, or our access through the central server, is interrupted for more than 2 Business Days, other than during an absence announced under clause 5.5, we tell you by email, with the alerts pending and what you can do in the meantime, and we tell you when the service resumes.

P16. AI Providers and AI tool. Before the first use of an AI Provider, we document its terms, the AI tool and its version, the configuration used, the retention that applies to each kind of data and the safeguard for its transfers (DPA, clause 11.1). The AI tool is used only with Bitshard’s account at the AI Provider, with telemetry, error reporting and the sending of session transcripts to the provider disabled. We record which AI Provider or Own Model processed each work, and to add a new AI Provider we follow clauses 10.2 to 10.4 of the DPA.

P20. Permission for each plan of action. Each plan of action has a unique reference and names the data that identify a person by references. We send by email, only to the address for permissions, a unique link that expires after 72 hours; opening it only shows the plan, and the link is used up only when the boxes are ticked and “I accept” is pressed. We record the acceptance, send a copy of it to the two addresses, wait for the confirmation period (2 Business Hours from receipt of the copy) or for your confirmation with the button of the email sent to the second address, and need the confirmation of an operator before loading the repair key (clause 7.8); the process of the Repair is then supervised as stated in clause 7.6(b).

P21. Access not given. We send the installation package only by email, with its SHA-256 fingerprint. We check the read access and the administrator access every hour and when you press “I have installed it”, and tell you in writing what works; we remind you at least 5 Business Days before the period of clause 11.6 ends, and when it ends we tell you in writing that the Contract has ended.

P22. Messaging channels. WhatsApp, Telegram and similar channels carry only summaries without Customer Personal Data, written from fixed templates (during a Repair, also summaries of its progress; when a plan is accepted, the IP address and type of browser of the acceptance, for the operator), and buttons; never logs, keys, passwords, installation packages, commands to run, the links to permit plans of action or formal notices. From them our operators can only confirm or stop what already exists, with fixed buttons or commands; no message from them starts a reading outside a service that you ordered, and no free text from them reaches the AI Model. What you send us through them with data of your server or passwords is deleted from the chat within 24 hours (clause 22.2).

Privacy Policy

Last updated: 25 October 2026 (version 2026-10-25-v10.5, published on 25 October 2026).

In short: our website sets no cookies and loads nothing from third parties. We use your data to answer you, to carry out the checks you ask for, to provide and bill our service, and to keep our website secure. We do not sell your data and we do not use it to train artificial-intelligence models. You can ask us at any time to see, correct or delete it: info@bitshard.eu.

1. Who is responsible for your data

The controller of the personal data described in this policy is Bitshard OÜ, a private limited company registered in the Estonian Commercial Register under registry code 17275103, with its registered office at Kotkapoja tn 2a-10, 10615 Tallinn, Estonia, and VAT number EE102906167. Server Watch is a service of Bitshard OÜ.

Contact for any privacy matter: info@bitshard.eu.

2. What this policy covers

This policy covers the personal data of:

• visitors of our website www.bitshard.eu;
• people who contact us by email, WhatsApp or Telegram;
• people who buy an Exposure Report;
• people who fill in a form in one of our ads, or visit our social-media profiles;
• our customers and the contact people of our customers.

It does not cover the data stored on our customers’ servers, which we process only on their behalf (section 8).

3. Our website

3.1 No cookies and no third parties. Our website does not set cookies and does not load scripts, fonts, statistics or advertising from other companies. Everything it shows comes from our own server.

3.2 What your browser saves. If you click on a language, choose the currency in which approximate prices are shown (euros or US dollars) or switch between the light and dark themes, your browser saves that choice on your device (in its “local storage”, under the names sw-lang, sw-currency and sw-theme) so that the website remembers it on your next visit. We do not receive this information, and no cookie is used for it. We charge all prices in euros; the amount in US dollars is only an approximate reference. The choice stays on your device until you delete it or choose again; you can delete it at any time by clearing the site data of www.bitshard.eu in your browser. We store it only because you asked for that function; storing information that is strictly necessary for a service that you have explicitly requested does not need consent (Article 5(3) of Directive 2002/58/EC).

3.3 Server logs. Like any web server, ours automatically records each visit: IP address, date and time, the page requested (including any campaign tags in the address, such as utm_source), the browser identifier (user agent), the page you came from and the response code.

• Why, and on what legal basis: we use these logs for two purposes, each based on our legitimate interest (Article 6(1)(f) GDPR): (a) to deliver the website and protect it against attacks and errors; Recital 49 GDPR recognises network and information security as a legitimate interest; and (b) to count visits per page and per advertising campaign. For (b) we only produce totals (for example, “120 visits from campaign X”), with a program on our own server; the totals do not contain IP addresses, browser identifiers or any other data about individual visits. We have weighed these interests against your rights: the logs are kept for a limited time, are not combined with other data and are not used to identify or profile visitors.
• How long: 90 days. The server starts a new log file every day and deletes each file when it is 90 days old. We keep them for that long because some attacks are discovered weeks after they happen, and the logs are needed to find out how they started. The totals of point (b) are kept longer.
• Where and who has access: the logs are stored on our web server, located in a data centre in St. Louis, Missouri (United States). Our contractual provider is Contabo GmbH (Germany), which stores them on our behalf as our processor. Contabo may use other entities (its sub-processors) to operate that data centre; you can ask us for their list, their countries and a copy of the safeguard of each transfer (section 10).

3.4 Links to other services. Payment links, when we publish them on our website or send them to you, take you to Stripe’s payment page, and the WhatsApp link opens WhatsApp. What you do there is governed by the privacy policies of those companies, and by sections 4 and 7 of this policy for the data we receive.

4. When you contact us

4.1 Contact form. The form on our website sends nothing to us: it only prepares an email in your own email program. If you send that email, we receive what you wrote in it. Name and email address are needed for us to answer you; the domain, the service you are interested in and the message are optional, but without them we may need to ask you again.

4.2 Email. We use the data you send us to answer you and, if you ask for it, to prepare an offer.

• Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) when you act for yourself, for example as a sole trader; our legitimate interest in answering enquiries (Article 6(1)(f) GDPR) when you write on behalf of a company.
• How long: 12 months after our last exchange if no contract follows. If you become a customer, section 7 applies.

4.3 WhatsApp. If you write to us on WhatsApp (at the corporate number published on our website), WhatsApp processes your messages under its own terms (in the European Economic Area, WhatsApp Ireland Limited). We see your phone number, your profile name and your messages. We use them, and keep them, as described in section 4.2. The app on our phone has no permission to access its contacts, so we do not upload an address book to WhatsApp. Please do not send us passwords or data from your servers through WhatsApp; if you do, we delete them from the chat within 24 hours and do not use them. If you are a customer and give us a WhatsApp number or a Telegram user for it, we also send you there short summaries and buttons about your service (never logs, keys, passwords or permissions, which go by email). Telegram processes those messages under its own terms as controller (Telegram Messenger Inc.; according to its privacy policy, the data of users who signed up from the European Economic Area are stored in data centres in the Netherlands). The people who work for us (our operators) receive notices and confirm actions in an internal Telegram group; those messages do not contain the data of our customers’ servers.

5. Exposure Report

If you buy an Exposure Report of a domain (a paid automatic report of what the domain shows publicly; Terms of Service, Schedule 1, S1.1):

• Data: your name, your email address, your company name and address and, where it applies, your VAT number; the domain; the payment data that Stripe processes (we do not see your card number); the proof that you control the domain (a TXT record in its DNS, a meta tag on its home page or a file under /.well-known/ on its website); and the results of the report. The report only does what any visitor of the website can do, and consults public services: the software versions and headers shown by the web server, the TLS certificate and the public certificate logs (crt.sh), the DNS records, the RDAP and WHOIS registry data of the domain and of its IP address, the network to which the IP address belongs (from its RDAP registry record), its presence on public blocklists (SpamCop, PSBL and DroneBL), and public databases of vulnerabilities and end-of-support dates (WPVulnerability, endoflife.date, OSV, the CISA list of known exploited vulnerabilities and WordPress.org). We do not scan ports. Those services receive the domain, its IP address or the names and versions of the software found, not your name or your email address.
• Why: to check that you control the domain, to prepare the report automatically and to send it to the email address of your order. While online payment is not available, you order it through the form on our website and we send you a payment link. No person reviews the report before it is sent.
• Legal basis: performance of the contract that you conclude when you buy the report (Article 6(1)(b) GDPR); invoicing, a legal obligation (Article 6(1)(c)).
• How long: we keep the report, the proof of control of the domain and the data of the order for 6 months after we send the report or cancel the order, and then delete them, unless you become a customer of another service; in that case section 7 applies. Invoices are kept as stated in section 11.

6. Advertising and social networks

6.1 Forms in our Instagram ads. If you fill in a form inside one of our ads on Instagram, Meta (in the European Economic Area, Meta Platforms Ireland Limited) collects the data in its app and makes it available to us: your name and email address (pre-filled by Meta from your profile; you can change them), the domain of your website, whether it is your own server or shared hosting, the number of servers, your hosting provider and your main concern. Name, email and domain are needed to answer you; the rest is optional.

• Why: to answer what you asked in the form and, if you want it, to send you the link to buy the Exposure Report of your domain.
• Legal basis: as in section 4.2. If the form includes a separate, optional box to receive our commercial emails and you tick it, we also use your email address for that purpose, on the basis of your consent (Article 6(1)(a) GDPR), which you can withdraw at any time; if you do not tick it, we only contact you about the check you asked for.
• How long: 6 months from the date you submitted the form, if no contract follows. Meta keeps the forms for its own period, and processes your use of Instagram under its own privacy policy: https://www.facebook.com/privacy/policy.
• We do not upload lists of customers or contacts to Meta, and our website does not use the Meta pixel or any other tracking tool.

6.2 Our profiles on Instagram and Facebook. When you visit our profiles, Meta processes data about your activity under its own privacy policy. For the visit statistics that Meta offers us about our Facebook page (“Insights”), Meta and Bitshard are joint controllers (Article 26 GDPR) under Meta’s Page Insights Controller Addendum, in which Meta takes primary responsibility for informing you and for handling your requests (Meta’s summary for users, “Information about Page Insights”): https://www.facebook.com/legal/terms/page_controller_addendum. We only see aggregated statistics. The joint-controller arrangement described in this paragraph refers to our Facebook page.

6.3 Ads on search engines. If you arrive at our website from an ad on a search engine, the address may contain campaign tags that appear in our server logs (section 3.3). We do not install tags or cookies of search engines on our website.

7. Customers and their contact people

7.1 Data and where we get it from. Name, position, email address and phone number of the contact people; company name, address and tax or VAT number; orders, invoices and payments; the content of the Authorization Form (servers, IP addresses, domains, options); our communications; and, when a contact person accepts a plan of action on our acceptance page, the record of that acceptance (the plan shown and its fingerprint, the boxes ticked, the date and time, the IP address and browser identification from which it was accepted, and the email address to which we sent the link). Our emails also carry buttons that open that page, with which our customers withdraw their authorisation, tell us that something was not done by them, confirm a plan, give us the data of the installation, the IP address of the server and their contacts, choose what to do when a backup does not fit, tell us that they have installed our access and follow their order (Terms of Service, clause 22.3). When you press one, the page keeps what was pressed, when, and the IP address and browser identification from which it was pressed, and deletes them after 90 days; our central system keeps its own copy in its record for the same period as the records of acceptance (section 7.4). The page “Status of your order” shows a snapshot of the order: its stages, the actions of the plan and how many commands of each category have been run, never the commands, their output, the email addresses or the IP address of the server; the page deletes it 30 days after the order is closed. The acceptance page uses no analytics tools and only one technical cookie, which protects its forms against submissions from other websites and lasts 12 hours; it does not need your consent because the forms cannot work safely without it. If you are a contact person of one of our customers, we received your data from your organisation when it ordered the Service or completed the Authorization Form. Your organisation should show you this policy; we also send you a link to it in our first email to you and, in any case, within one month of receiving your data, or earlier if we disclose your data to another recipient.

7.2 Payments. Payments are processed by Stripe Payments Europe, Limited (Ireland) and, where its terms provide for it, Stripe Technology Europe, Limited (Ireland). Stripe collects your card details directly; we never see the full card number. Stripe processes payment data on our behalf, and also as an independent controller for its own purposes, such as preventing fraud and complying with financial regulation: https://stripe.com/privacy.

7.3 Purposes and legal bases.

You have the right to object at any time to the processing based on our legitimate interest, and in particular to our commercial emails (section 12).

7.4 How long. Contract data, communications, the record of services performed and the records of acceptance of plans of action: for the duration of the contract and 3 years from the end of the calendar year in which it ended, which covers the general limitation period for claims arising from a transaction (Estonian General Part of the Civil Code Act, § 146(1)); if a claim is pending at that date, until it is resolved. This period does not extend the retention of logs, copies or reports with data that we process on behalf of our customers, also when they are attached to an email: those are deleted as the data processing agreement provides. Invoices and accounting records: 7 years from the end of the financial year in which they were recorded, as required by Estonian accounting law.

7.5 Do you have to give us this data? The data of the contract, of the Authorization Form and of invoicing is necessary to contract with us; without it we cannot provide the service.

8. Data on our customers’ servers

When we provide Server Watch, we process logs and other data stored on our customers’ servers on their behalf and following their instructions, as a processor under a data processing agreement. Server Watch is an AI-driven service: on those servers, and on the instructions of our customer, who is responsible for those data, the data are analysed with an artificial-intelligence model, after email addresses and the passwords that our tools recognise have been hidden; in a repair, the data that an action needs may be sent without hiding them. We choose that model, and may change it, among those of the AI providers in our list of sub-processors (https://www.bitshard.eu/legal.html#subprocessors; at the date of this policy, Anthropic Ireland, Limited, OpenAI Ireland Ltd. and Mistral AI SAS), or we run a model on our own infrastructure; under their terms, those providers do not use the data to train their models. Under their own terms, some of them keep part of the data for their own purposes and as controllers (for example, content that their systems flag as abuse), for the periods that those terms set, which we do not control; the terms of each provider are linked in our list of sub-processors, and our customer decides to use the service with that condition. The data processing agreement describes this in detail. The plans of action that we keep as proof of our customers’ permission name the people concerned by references, not by their names or usernames. If your data appears there (for example, because you visited the website of one of our customers), the controller is our customer or, if our customer acts as processor for another organisation, that other organisation: please send your requests to them. If you write to us, we will forward your request to our customer so that it can handle it with the controller concerned.

9. Who receives your data

We do not use the data described in this policy to train artificial-intelligence models. We do not use an AI assistant to read or answer your emails or forms: they are read by a person, and our system does not read emails.

10. Transfers outside the European Economic Area

Some of the recipients above process data outside the European Economic Area:

• Contabo (our website): our website and its logs are stored in the United States. For servers located outside the European Union, Contabo’s terms offer its data processing agreement together with the standard contractual clauses of the European Commission (Contabo General Terms and Conditions, effective December 2025, clauses 2(2) and 12(3)).
• Zoho (our email): our email, from which we also send our automatic emails, is stored in Zoho’s data centres in the European Union, because our account was created in its European domain. According to Zoho, employees of Zoho Corporation Private Limited (India) may access it remotely, on rare occasions, to provide technical support, under standard contractual clauses between Zoho’s Dutch and Indian companies.
• Stripe: Stripe, LLC states that it complies with the EU-U.S. Data Privacy Framework (https://stripe.com/legal/data-privacy-framework); Stripe also uses standard contractual clauses approved by the European Commission where the framework does not apply.
• Meta and WhatsApp transfer data to Meta Platforms, Inc. in the United States. Meta Platforms, Inc. states that it is certified under the EU-U.S. Data Privacy Framework (https://privacycenter.instagram.com/policies/data_privacy_framework).
• Telegram states in its privacy policy that it may transfer data to Telegram Group Inc and Telegraph Inc. (British Virgin Islands) and to Telegram FZ-LLC (Dubai) under standard contractual clauses approved by the European Commission. You use Telegram with us only if you choose to.

Access by the people who work for us from outside the European Economic Area. The people who provide our service work for Bitshard directly, under its instructions, without any intermediary company, and may work from outside the European Economic Area and access from there the data described in this policy. Because that access is made by Bitshard itself and not by another organisation, it is not a transfer of your data to a third party: the same protection applies, together with the security measures of section 15. Before they work habitually from a new country, we assess its risks.

The EU-U.S. Data Privacy Framework is based on an adequacy decision of the European Commission of 10 July 2023 (Article 45 GDPR), which only covers the organisations included in its official list. Standard contractual clauses are a safeguard under Article 46(2)(c) GDPR. You can ask us for a copy of the safeguards that apply.

11. How long we keep your data: summary

12. Your rights

You have the right to: access your data; rectify it; erase it; restrict its processing; receive it in a portable format (portability); object to processing based on our legitimate interest, and at any time to direct marketing; and withdraw your consent at any time, without affecting earlier processing. These rights apply in the cases and with the limits that the GDPR sets.

To exercise them, write to info@bitshard.eu. We answer within one month. For complex or numerous requests this period can be extended by two more months; if so, we tell you within the first month and explain why. We may ask you to confirm your identity. Exercising your rights is free.

13. Complaints

If you think that we have not handled your data correctly, you can complain to a supervisory authority, in particular in the country where you live or work or where the problem occurred:

• Estonia: Andmekaitse Inspektsioon (Data Protection Inspectorate), Tatari 39, 10134 Tallinn; info@aki.ee; https://www.aki.ee.
• Spain: Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid; https://www.aepd.es (electronic office: https://sedeagpd.gob.es).

You may also write to us first: info@bitshard.eu.

14. Automated decisions

We do not take decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Article 22 GDPR), and we do not profile visitors of our website. If a customer does not give us working access within the period of clause 11.6 of the Terms, the order is closed only after one of our operators has checked the case; if you are a professional acting as a natural person, you can ask us to review that decision, give your point of view and contest it by writing to info@bitshard.eu.

15. Security

We protect personal data with measures appropriate to the risk: encrypted connections, access limited to the person who needs it, and deletion at the end of the periods in section 11.

16. Data protection officer

We have not designated a data protection officer. The GDPR requires one when the core activities consist of regular and systematic monitoring of individuals on a large scale, or of large-scale processing of special categories of data (Article 37(1) GDPR). Our assessment considers the people whose data appear on the servers of all our customers (in their logs of access and activity), the volume, the duration, the geographic scope and the systematic nature of that monitoring, even though its purpose is the security of the machines; with the services we provide today (one-time reviews and clean-ups) we have concluded that no officer is required. We document the conclusion and review it whenever those factors change, in particular before we open continuous monitoring (Watch and Managed). For any privacy matter, write to info@bitshard.eu.

17. Minors

Our services are for businesses and are not directed at people under 18.

18. Changes to this policy

We publish any change on this page with its date. Before we use your data for a purpose different from those described here, we will inform you of that purpose and of any other information required by law, and, if the new purpose needs your consent, we will ask for it first. If a change significantly affects our customers, we also tell them by email.

19. Visitors from the United States

This policy applies to all visitors, wherever they are. We are a company registered in the European Union and apply the GDPR to all the data described in this policy; our website is hosted in the United States. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Server Watch Data Processing Agreement

Version: 2026-10-25-v10.5. Published on 25 October 2026. In force from: 25 October 2026.

This Data Processing Agreement (the “DPA”) is part of the contract between the customer named in the Order (the “Customer”) and Bitshard OÜ, registry code 17275103, Kotkapoja tn 2a-10, 10615 Tallinn, Estonia (“Bitshard”), under the Server Watch Terms of Service (the “Terms”). It is entered into to comply with Article 28(3) and (4) of Regulation (EU) 2016/679 (the “GDPR”). Its structure follows the standard contractual clauses for controllers and processors adopted by the European Commission in Implementing Decision (EU) 2021/915, but it is not those clauses.

The Customer accepts this DPA by ticking the acceptance box at checkout, by accepting a quote that refers to it, or by signing it. Electronic acceptance is acceptance in writing (Article 28(9) GDPR). Bitshard keeps a record of the version accepted, the date and the identity of the Customer.

1. Definitions and scope

1.1 Terms defined in the GDPR (such as “personal data”, “processing”, “controller”, “processor”, “personal data breach” and “supervisory authority”) have the same meaning in this DPA. Words with a capital letter that are not defined here have the meaning given in the Terms.

1.2 “Customer Personal Data” means the personal data contained in the Customer Data that Bitshard processes on behalf of the Customer. “Sub-processor” means another processor engaged by Bitshard to carry out processing of Customer Personal Data.

1.3 This DPA applies to every Server Watch service that involves access to Customer Servers: Health Check, Emergency Clean-up and, when available under clause 1.4 of the Terms, Watch, Managed and the agency plan. It does not apply to the free exposure check, nor to the data of the Customer’s contact people that Bitshard processes as controller; these are covered by Bitshard’s privacy policy.

1.4 If this DPA and the Terms conflict on a matter concerning personal data, this DPA prevails.

2. Roles of the parties

2.1 The Customer is the controller of the Customer Personal Data and Bitshard is its processor.

2.2 If the Customer acts as a processor on behalf of its own clients (for example, an agency or a hosting reseller), Bitshard is a sub-processor. In that case the Customer confirms that: (a) its controllers have authorised in writing the use of Bitshard and of the Sub-processors listed in Annex IV; (b) the instructions it gives Bitshard are consistent with the instructions of its controllers; and (c) it will pass on to its controllers the information and notices that Bitshard gives it under this DPA.

2.3 The Customer is responsible for having a legal basis for the processing of the personal data on its servers and for having Bitshard process it, and for informing the data subjects (for example, in its own privacy policy) that its servers and logs are monitored for security purposes by service providers. If the Customer uses information from the Service about the access of its employees or of other people to its servers, it is responsible for complying with the employment and data-protection rules that apply to that use; Bitshard does not provide those data for monitoring people.

2.4 Bitshard is a company registered in Estonia (European Union). This DPA binds Bitshard to the data-protection obligations that it contains, which follow those that the GDPR imposes on processors, for all processing under this DPA, wherever the persons who work for it are and also when the Customer is established outside the European Economic Area (EEA). Whether the GDPR applies to Bitshard under its Article 3, whether a representative is needed under Article 27 and which supervisory authority is competent under Articles 55 and 56 depend on how the processing is actually organised, not only on the country of registration. Before the processing starts, and whenever its organisation changes, Bitshard documents whether the GDPR applies to these operations, where it is effectively established, which supervisory authority is competent and whether a representative is needed. Where there is a transfer, the parties formalise beforehand the safeguard that applies to the role of each recipient and to whether it is subject to the GDPR; offering it is not enough. The Modules of Implementing Decision (EU) 2021/914 are used only where the case is within the scope of that Decision. No data flow starts or continues without the safeguard that it needs.

3. Description of the processing

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex II, for each service.

4. Instructions (Article 28(3)(a) GDPR)

4.1 Bitshard processes Customer Personal Data only on documented instructions from the Customer, including with regard to transfers to third countries. On the date of acceptance, the Customer’s complete instructions are the Terms, the Order, the Authorization Form and this DPA. They include the AI-driven service of clause 7.1 of the Terms: the Customer instructs Bitshard to have the AI Model read the Customer Servers and, in the Repair, run the changes of the plan of action that the Customer accepts and an operator confirms (clause 7.8 of the Terms), after a backup of what the Repair will touch, with the process supervised in general by people of Bitshard and without a person approving each command or each change, and to use the AI Providers of Annex IV, as Bitshard chooses among them, or an Own Model, under the conditions of clause 11, including the disclosure of clause 11.1(c) (clause 11.3). The Customer may give further instructions in writing (an email is enough) during the processing. If an instruction goes beyond the Service, Bitshard may refuse it or offer to carry it out at an additional price.

4.2 Bitshard may process Customer Personal Data without an instruction only if the law of the European Union or of a Member State that applies to Bitshard requires it. In that case Bitshard informs the Customer of that legal requirement before the processing, unless that law prohibits it on important grounds of public interest.

4.3 Bitshard informs the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data-protection provisions of the European Union or of a Member State. Bitshard does not carry out that instruction while the infringement it has identified persists: it asks the Customer to correct it, or for the information that shows that there is no infringement. A mere confirmation of the instruction by the Customer does not authorise Bitshard to carry it out. Clause 11.1(c) and Annex IV identify the Provider Terms that the Customer could read and accepted before giving the instruction of clause 11.3.

5. Purpose limitation

5.1 Bitshard processes Customer Personal Data only for the purposes described in Annex II.

5.2 Bitshard does not: (a) sell Customer Personal Data or give it to third parties other than the Sub-processors of Annex IV and the recipients that the Customer authorises in the Authorization Form; (b) use it for its own purposes; (c) use it to train artificial-intelligence models, including an Own Model, or allow any AI Provider to use it for that purpose; (d) combine it with the data of other customers.

5.3 Bitshard may produce operational metrics about the Service (for example, number of alerts, duration of investigations, error rates of updates) that contain no personal data, in order to operate and improve the Service.

6. Duration

The processing lasts for as long as the Contract is in force and, after it ends, until the return and deletion described in clause 17 are completed.

7. Confidentiality of personnel (Article 28(3)(b) GDPR)

Bitshard gives access to Customer Personal Data only to the members of its staff who strictly need it to perform, manage and monitor the Contract. Every person authorised to process Customer Personal Data has committed to confidentiality in writing or is subject to a statutory obligation of confidentiality. At the date of this DPA, those persons are the two persons referred to in clause 5.5 of the Terms, one of whom is the member of Bitshard’s management board; both work for Bitshard directly, without any intermediary company, and act only on its instructions (Article 29 GDPR).

8. Security of the processing (Article 28(3)(c) and Article 32 GDPR)

8.1 Bitshard applies at least the technical and organisational measures of Annex III that correspond to the services the Customer has ordered: section 0 for the Health Check and the Emergency Clean-up; sections 1 to 6 for Watch, Managed and the agency plan. When choosing them, the parties have taken into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks for the data subjects.

8.2 Bitshard may update the measures of Annex III as technology evolves, provided that the overall level of protection is not reduced.

8.3 The Customer remains responsible for the security of its own servers, accounts and credentials, except for the tasks that Bitshard carries out under the Contract.

9. Special categories of data

9.1 The Service is not designed to process special categories of personal data (Article 9 GDPR). Such data may nevertheless be present on the Customer Servers, appear incidentally in logs (for example, in the web addresses visited on a health website) or be included in the full backups of Managed.

9.2 The Customer indicates in the Authorization Form whether a server processes special categories of personal data or data of children, and which log sources must not be collected. For those servers Bitshard: (a) does not collect the excluded sources; (b) instructs the AI Model, whoever provides it, not to read the data of the flagged sources (for example, the application’s database or the web access logs of a health website), because the AI Providers’ terms do not provide for special categories of data and an authorization of the Customer does not replace a condition of Article 9 GDPR; this reduces the risk but does not guarantee that no data of those sources reach the AI Model, because the read user can read what the server allows (clause 6.4 of the Terms); if the work needs a flagged source, the plan of action says so and the Customer decides when accepting it; and (c) keeps no copies of those sources beyond the Prior Backup. If signs of special categories of data or of data of children appear during the work in a source that the Customer has not flagged (protocol P3 of Schedule 3 of the Terms), Bitshard applies this clause to that source without waiting for the Customer and tells the Customer.

10. Sub-processors (Article 28(2), (3)(d) and (4) GDPR)

10.1 General authorization. The Customer gives Bitshard its general written authorization to engage the Sub-processors listed in Annex IV, including every AI Provider listed there. The current list is published on Bitshard’s website at https://www.bitshard.eu/legal.html#subprocessors, with the information of Annex IV. Bitshard adds to the list only AI Providers that: (a) act as processors, for the processing that they carry out on Bitshard’s behalf, under a written agreement that meets Article 28(3) GDPR; where their terms reserve a retention for the provider’s own purposes, clause 11.1(c) refers to those terms and clause 11.3 applies; (b) do not use the data that Bitshard sends them to train their models; (c) are used with an account of Bitshard; and (d) contract with Bitshard through an entity established in the European Union or, otherwise, transfer the data with a safeguard under Chapter V GDPR.

10.2 Changes made by Bitshard. Bitshard informs the Customer by email at least 14 days in advance of any intended addition or replacement of a Sub-processor, including a new AI Provider, stating its name, location, function, the data concerned, its retention conditions and any exception to deletion, the transfer safeguard, the date from which it will process data and the deadline for objecting. Choosing among the AI Providers already listed in Annex IV, or among their models, is not an addition or a replacement and needs no notice.

10.3 Changes made by a Sub-processor in its own list. Bitshard keeps identified the Sub-processors of the whole chain: those of Annex IV and their own sub-processors, whose lists are published at the links of Annex IV. When a Sub-processor informs Bitshard of a change in its list, Bitshard informs the Customer without undue delay and at the latest within 5 Business Days, with the same information as in clause 10.2, and always early enough for the Customer to be able to object before the new access; the maximum of 5 Business Days never allows the notice to be given after that moment. If Bitshard cannot guarantee that prior opportunity, or cannot prevent the access while a reasonable objection is being resolved, it suspends the affected processing beforehand under clause 10.4.

10.4 Objection. The Customer may object in writing, on reasonable data-protection grounds, before the deadline stated in the notice. The parties then look for a solution in good faith. Bitshard does not authorise or keep processing by the new provider while a reasonable objection is pending; if it cannot prevent that provider’s access, it suspends beforehand the affected processing and the services that need it, and the time of the suspension is not charged. The Service requires the AI Model: a suspension does not create a service without AI. If the objection concerns a new AI Provider, Bitshard may instead keep providing the Service to that Customer with the AI Providers already listed, without using the new one with that Customer’s data. If there is no solution, the Customer may terminate the affected services, without penalty and with a refund of the Fees for the unused part of the Billing Period and of the price of one-time services not yet performed.

10.5 Obligations of the Sub-processors. Bitshard engages each Sub-processor by means of a contract that imposes on it, in substance, the same data-protection obligations as this DPA. The Sub-processors of Annex IV are large providers that contract on their own standard terms (linked in Annex IV). Under those terms certain rights, such as audits, are exercised mainly through certifications and reports, and on-site inspections only under the conditions of those terms. Bitshard exercises those rights on behalf of the Customer when needed and passes the resulting information on to the Customer. Before the first access of a Sub-processor, Bitshard checks that its contract and measures allow Bitshard to meet its own obligations under this DPA in that chain, including deletion, assistance and audits; the size of the provider and its standard terms do not dispense with that check. Where a provider’s terms contain an exception to those obligations, this DPA states it or, for the AI Providers, refers to the Provider Terms that contain it (clauses 11.1(c) and 17.6).

10.6 Responsibility. Bitshard remains fully responsible to the Customer for the performance of the obligations of its Sub-processors, and informs the Customer of any breach of those obligations by a Sub-processor.

10.7 At the Customer’s request, Bitshard provides a copy of the data-protection terms agreed with a Sub-processor and of the transfer instruments it has received from it; it may remove commercial secrets or other confidential information from the copy.

11. AI Providers and Own Model: authorization and conditions

11.1 The Customer authorises Bitshard to use, in all services and under the AI-driven service described in clause 7.1 of the Terms, the AI Providers listed in Annex IV (at the date of this DPA, Anthropic Ireland, Limited, in use, and OpenAI Ireland Ltd. and Mistral AI SAS, authorised and not yet in use) and an Own Model. Bitshard chooses which AI Model and which AI Provider is used for each task and may change them at any time among those listed, without notice to the Customer; the Customer does not choose them, and the Platform, the reports and the alerts do not show which one was used. Bitshard records which AI Provider or Own Model processed the data of each work, investigation or Deep Check, and tells the Customer on request (clause 16.1), so that the Customer can answer the data subjects (Article 15(1)(c) GDPR). The Customer confirms that it has been informed of the following:

1. What is sent. In the Health Check and the Emergency Clean-up: the output of the commands that the AI Model runs on the Customer Server during the Diagnosis and the Repair, which may include configuration, lists of software, processes, connections, users and scheduled tasks, excerpts of logs (with IP addresses, usernames, web addresses and browser identifiers), website files and, when an investigation needs it, records of databases. In Watch and Managed: the details of the alert and the results of the Watcher’s read-only functions that the investigation needs, and the output of the commands run in the Deep Checks and in manual work through the Bitshard Access (clause 6.7 of the Terms). In all services: the data are masked as described in clause 11.2 before they are sent; Bitshard does not ask the AI Model to read the files excluded in Annex III or the data of sources flagged under clause 9.2, and its tools try to block them; such data may nevertheless reach the AI Model when the read user can read them (clauses 9.2 and 11.2; clause 6.4 of the Terms).

2. Why and how. To analyse the server, find what is wrong and prepare the Repair. The AI tool runs on Bitshard’s central server in the European Union, with the Linux user of the Customer, and runs the commands on the Customer Servers through the keys of clause 6.7 of the Terms; the AI Provider receives the commands and their output, never Bitshard’s keys, and neither does an Own Model; credentials stored on the Customer Server (for example, a database password in a configuration file that every user can read) may appear in that output, and are masked only when the tools recognise them (clause 11.2). Reading sessions run automatically, without a person following them, in all services (clause 6.7(b) of the Terms). In the Repair, the AI Model runs the commands of the plan of action that the Customer has accepted and an operator has confirmed (clause 7.8 of the Terms), after a backup of what the Repair will touch, with the process supervised in general by people of Bitshard and without a person approving each command or each change (clauses 7.1 and 7.6 of the Terms); every command is recorded.

3. How long the AI Providers keep it. Each AI Provider keeps the data under the terms that the provider publishes and that apply to Bitshard’s account with it (the “Provider Terms”), linked in Annex IV. The Provider Terms set how long the provider keeps the data that it processes on Bitshard’s behalf and whether, and for how long, it keeps data for its own purposes, for example to detect or prevent abuse of its services, to protect its services or third parties, to resolve its own disputes or to comply with the law; some of those periods are long or have no stated maximum, and the provider may change them. The Customer can read the Provider Terms through the links of Annex IV, knows them and accepts them for the data that it makes available to the Service. Bitshard does not control the Provider Terms or how each provider applies them, does not guarantee their periods and does not reproduce them in this DPA. For an Own Model, Bitshard keeps the inputs and outputs only for the periods of Annex II.G, as working data of the service concerned, and deletes them under clauses 13.2 and 17 without any other exception.

Retention by an AI Provider for its own purposes under the Provider Terms, other than storage required by Union or Member State law, is not processing on behalf of Bitshard or of the Customer: the provider decides its purpose and its means, so for that retention the provider acts as a controller (Article 28(10) GDPR), and sending the data to it includes a disclosure to that recipient. The Customer, as controller, expressly authorises that disclosure in clause 11.3(a), on its own legal basis, and communicates it to the data subjects as a recipient (Articles 13(1)(e) and 14(1)(e) GDPR); clause 11.3(f) governs the claims of third parties that arise from that retention. Before the first use of each AI Provider, Bitshard documents the Provider Terms that apply to its account, including the purposes and means of that retention, the data affected and the way in which the provider deletes the data processed on Bitshard’s behalf. Bitshard’s obligations of deletion and return (clauses 13.2 and 17) cover everything that Bitshard and its Sub-processors hold on the Customer’s behalf, with no exception other than Union or Member State law. The data that an AI Provider processes on Bitshard’s behalf are deleted by that provider within the periods that the Provider Terms set for that processing, without any further action; before sending personal data to an AI Provider, Bitshard checks that its agreement and the configuration used provide for that deletion, and if a term of a provider prevented it, the affected data are not sent to that provider and Bitshard uses another AI Provider listed or an Own Model, or does not start or suspends that part of the Service. As measures that reduce the data disclosed, and not as conditions for providing the Service, Bitshard asks each AI Provider that it uses for a zero-data-retention arrangement and for the waiver, for its account, of retention for the provider’s own purposes, uses the models and the configuration of point (f), applies the masking of clause 11.2 and, when it is available, additional pseudonymisation of the data sent.

4. No training. Bitshard configures its account with each AI Provider so that the content it sends is not used to train or improve the provider’s models, and does not opt in to any such use. Bitshard does not train any model, including an Own Model, on Customer Personal Data (clause 5.2(c)).

5. Where. Bitshard contracts with Anthropic Ireland, Limited (Ireland) and, when it uses them, with OpenAI Ireland Ltd. (Ireland) and with Mistral AI SAS (France), all in the European Union; while Bitshard is established in the European Union (clause 2.4), there is no transfer between Bitshard and any of them. Each AI Provider processes the data with its affiliates and its own sub-processors, in the United States and other countries, and transfers them with the safeguards that the Provider Terms provide for (lists of sub-processors linked in Annex IV; Annex V). An Own Model processes the data where the infrastructure provider of Annex IV processes them. Before the first sending of personal data to an AI Provider, and before any relevant change of its recipients or countries, Bitshard has sufficient documented information to check the safeguard that applies to the transfers and onward transfers needed for the Service: it identifies the recipients, countries, functions and data and the coverage of the adequacy decision or of the instrument that applies, and assesses additional measures when they are needed. A complete copy of each contract is not required if other reliable documentation allows that check, without prejudice to clause 10.7 and to the rights of information and audit; Bitshard requests the specific instruments as an additional measure. If a valid route cannot be shown, the affected flow does not start or is suspended. The Customer’s instruction does not replace these requirements. The privacy policies of the AI Providers do not govern the data processed on Bitshard’s behalf; the retention that a provider carries out as controller under point (c), and its transfers, are governed by the Provider Terms and its privacy policy.

6. Models, configuration and account. Before using an AI Provider, Bitshard documents the Provider Terms that apply to its account (point (c)), the model, how its program connects to the provider, the options that are active and all the kinds of retention that apply: responses, safety logs and derived technical data. Bitshard may use models whose Provider Terms set a minimum retention period (for example, 30 days); that period is part of the Provider Terms of point (c), which the Customer accepts. Bitshard does not activate, by its own choice, optional functions that add retention beyond what the Provider Terms require for the model (for example, OpenAI’s stored responses or conversations). Disabling the storage of responses is not presented as a guarantee that nothing is retained. At the date of this DPA, OpenAI and Mistral AI are authorised but not used, and neither is activated until this check and that of point (e) are complete for it. With Mistral AI, Bitshard does not use models in preview or from its “Labs”, because the Provider Terms allow the content sent to them to be used for training (point (d)). Choosing among the AI Providers of Annex IV and their models needs no notice; adding an AI Provider that is not listed follows clauses 10.2 to 10.4. The AI tool (for example, Claude Code or Codex) is used only with Bitshard’s account at the AI Provider. Its telemetry, its error reporting and the sending of session transcripts to the provider are disabled; the local transcripts that the tool keeps on the central server, and the record of each work kept by Bitshard’s launcher, stay on the central server, accessible only to its administrator and, for the transcripts, to the Linux user of that Customer, and are deleted within the periods of Annex II.G.

11.2 Hiding email addresses and secrets. The excluded files and sources (Annex III, section 1, point 5, and clause 9.2) are treated as stated in clause 6.4 of the Terms: Bitshard does not ask the AI Model to read them, the read user cannot read those that only the administrator can read, and Bitshard’s tools try to block those that every user can read; such a file may nevertheless reach the AI Model. In the data that may be sent, before any of them is given to the AI Model, whoever provides it, Bitshard’s tools:

1. replace each email address, also where it is used as a username, by a pseudonym that is the same for the same address within one work and different in another work (for example, user-7f3a@example.com); the domain is not kept, so the AI Model can compare addresses within a work but not recognise suspicious domains from the pseudonym;

2. replace the known secret values (passwords, private keys, access tokens and similar credentials) that appear in the data that may be sent, for example in command lines, logs or error messages, by a marker;

3. leave the other usernames visible, because they are needed to detect unauthorised accounts.

Images and documents (for example, PDF files) that the AI tool reads are sent without masking. In the Repair, the data that an action of the accepted plan needs in order to be carried out (for example, the email address of a fake administrator account that has to be removed) may be sent to the AI Model without masking (clause 7.1(a) of the Terms). When the Diagnosis needs a hidden value (for example, to confirm whether a specific email address belongs to an attacker), the report says so, and the value is checked by the Customer or in a Repair under a plan that says so. The pseudonyms, and the domains that are kept, can still be personal data (Recital 26 GDPR): this masking reduces the personal data sent, it does not anonymise them, and it cannot guarantee that every personal data item is detected (for example, a person’s name inside a free-text line of a log). Before the first service with the AI Model, the masking is tested with test data, including email addresses used as usernames, secrets in logs and error output, excluded files and unexpected sensitive content.

11.3 The Customer’s instruction and responsibility. By accepting this DPA, expressly and separately before paying (clause 4.2(b) of the Terms), and by confirming it in the Authorization Form (item 13), the Customer, as controller or, under clause 2.2, as processor authorised by its controllers:

1. decides and instructs in writing that Bitshard uses any AI Provider listed in Annex IV and its models, as Bitshard chooses and changes them, and an Own Model, under the conditions described in this clause 11, and the onward transfers of clause 11.1(e); and expressly authorises the disclosure to each AI Provider of the data sent to it, for the retention that the provider carries out for its own purposes, as controller, under the Provider Terms in force at each time (clause 11.1(c); Article 28(10) GDPR), with the periods that those terms set, which Bitshard does not control or guarantee; this instruction also covers an AI Provider added under clause 10.2 to which the Customer has not objected, with the conditions stated in the notice; it does not authorise Bitshard or its Sub-processors to breach this DPA or the law;

2. declares that it has a legal basis for that processing and for that disclosure (Article 6 GDPR and, where applicable, Article 9) and that it has informed the data subjects as Articles 13 and 14 GDPR require, including of the AI Providers as recipients; if it acts as processor under clause 2.2, it declares that it is authorised by its controllers to give these instructions and that they have confirmed those points to it, and it passes on to them the notices and objections that concern them;

3. decides which data are on its Customer Servers and which sources and paths are excluded or flagged (clause 9.2; Authorization Form, item 8), and is responsible for flagging special categories of data;

4. is responsible towards the data subjects and towards third parties for the data that it makes available on its servers and for its instructions, without prejudice to Article 82 GDPR;

5. compensates Bitshard under clause 18 of the Terms for claims, damages, costs and, to the extent that the law allows them to be passed on, sanctions, to the extent that they are caused by the data that it makes available, by its instructions or by the untruth of its declarations; the claims that arise from the retention referred to in point (f) are governed only by point (f); this does not limit the rights of data subjects nor the powers of the supervisory authorities;

6. holds Bitshard harmless against the claims of third parties, in particular of data subjects and of the Customer’s own clients, that arise from the retention or use by an AI Provider, for its own purposes and under the Provider Terms, of data whose sending the Customer authorised in point (a): it pays the compensation that Bitshard has to pay for them and the reasonable costs of defending them. Where Bitshard has paid full compensation to a data subject for that damage (Article 82(4) GDPR), it may claim it back from the Customer (Article 82(5) GDPR), and, between the parties and subject to the last paragraph of this clause, the responsibility for that damage corresponds to the Customer. Point (f) does not cover: (i) Bitshard’s liability towards the Customer, under Article 28(4) GDPR and clause 10.6, when an AI Provider fails to fulfil its obligations as Sub-processor in the processing that it carries out on Bitshard’s behalf, including the deletion of those data within the periods of the Provider Terms; (ii) administrative fines or other sanctions imposed on Bitshard; (iii) damage caused by Bitshard’s own intent or gross negligence (clause 17.1 of the Terms). Clause 18.2 of the Terms applies to the defence of those claims. This does not limit the rights of data subjects nor the powers of the supervisory authorities.

This clause does not cover the consequences of a breach by Bitshard of its own obligations as processor, nor of processing by Bitshard or by its Sub-processors outside the Customer’s instructions and the conditions described in this DPA.

12. International transfers (Article 28(3)(a) and Chapter V GDPR)

12.1 Bitshard transfers Customer Personal Data to a third country or an international organisation only as described in Annex V or on documented instructions of the Customer, and always in compliance with Chapter V of the GDPR.

12.2 The Platform and its backups are hosted in the European Union; the provider that hosts the Platform is added to Annex IV, following clause 10.2, before Watch and Managed can be ordered (clause 1.4 of the Terms). The persons who work for Bitshard on the Service (clause 5.5 of the Terms) may access Customer Personal Data remotely from outside the EEA. They work for Bitshard directly, under its authority and only on its instructions (Article 29 GDPR), without any intermediary company; that access is made by Bitshard itself and not by another company or person, so it is not a transfer under Chapter V GDPR (European Data Protection Board, Guidelines 05/2021, version 2.0 of 14 February 2023, example 8). Bitshard remains responsible for that access and applies the measures of Annex III (section 0, point 11, and section 4, points 5 and 6). The central server that reads the Customer Servers, and the nightly copy of its database, which is kept on that same server, are in the European Union, at Contabo GmbH, in France (Annex IV; Annex III, section 0, point 12).

12.3 The Customer agrees that, where a Sub-processor’s processing involves a transfer under Chapter V of the GDPR, Bitshard and the Sub-processor may ensure compliance by means of standard contractual clauses adopted by the Commission under Article 46(2) GDPR, or of an adequacy decision of the Commission under Article 45 GDPR, including, for organisations listed under it, the EU-U.S. Data Privacy Framework.

12.4 Customers outside the EEA. When Bitshard returns or makes Customer Personal Data available to a Customer established in a third country that has no adequacy decision, the parties document, before the first return or access, the country and the recipient, their roles for that processing and whether the Customer’s processing is itself subject to the GDPR (Authorization Form, item 9). If it is not, the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914 apply to that transfer and are incorporated into this DPA by reference, with Bitshard as data exporter and the Customer as data importer: Module Four (processor to controller) if the Customer is the controller; Module Three (processor to processor) if the Customer is itself a processor for its own clients. The choices are: Clause 7 (docking clause) does not apply; for Module Three, Clause 9(a), Option 2 (general written authorisation), with a period of 30 days, with the information on the Customer’s controllers and sub-processors given in the Authorization Form; the optional wording of Clause 11(a) does not apply; under Clause 17, the clauses are governed by the law of Estonia; under Clause 18, disputes are resolved by the courts of Estonia; the competent supervisory authority is the one determined under Clause 13; Annex I.A of those clauses is Annex I of this DPA and Annex I.B is Annex II (including the frequency stated in Annex II.F); for Module Three, the technical and organisational measures of the importer are those that the Customer describes in the Authorization Form, not those of Annex III. The clauses and their completed annexes are available in a form that can be kept. Where those clauses require an assessment of the laws of the country of destination, the parties document it before the first transfer. If the Customer’s processing is subject to the GDPR, a valid safeguard for that case under Chapter V GDPR is identified and formalised before any return, sending of a report or access; that flow does not start while it does not exist. The assessment of the country and the security measures complement the safeguard but do not replace it. The Order or the Authorization Form (item 9) states the solution that applies; if it cannot be obtained, the part of the Service that needs it is not contracted. The derogations of Article 49 GDPR are not used for the ordinary provision of the Service.

13. Assistance with data subjects’ requests (Article 28(3)(e) GDPR)

13.1 Bitshard forwards to the Customer, within 3 Business Days, any request it receives from a data subject about Customer Personal Data, and does not answer it unless the Customer authorises it to do so.

13.2 On the Customer’s written instruction, Bitshard searches all the Customer Personal Data it holds (the Platform, the working data and reports of manual services, the backups it keeps, and the data held by its Sub-processors, through their own procedures) for the data relating to an identifier (for example, an IP address or an email address), and exports, corrects, restricts or deletes it within 10 Business Days, or sooner if the Customer needs it to meet the legal deadline it tells Bitshard. Bitshard does not refuse or postpone a deletion or restriction without a legal cause that it documents and communicates to the Customer. The same applies to the data held by the AI Providers on Bitshard’s behalf.

14. Assistance with the Customer’s other obligations (Article 28(3)(f) GDPR)

Taking into account the nature of the processing and the information available to it, Bitshard helps the Customer to comply with: (a) its security obligations (Article 32 GDPR); (b) the notification and communication of personal data breaches (Articles 33 and 34), as set out in clause 15; (c) carrying out a data protection impact assessment and consulting the supervisory authority (Articles 35 and 36), by providing the information about the processing and the measures of this DPA; and (d) keeping personal data accurate, by informing the Customer without delay if Bitshard discovers that data it processes is inaccurate or out of date.

15. Personal data breaches (Article 33(2) GDPR)

15.1 Notice. If Bitshard becomes aware of a personal data breach affecting Customer Personal Data that it or a Sub-processor processes, Bitshard notifies the Customer without undue delay, also outside Business Hours, and at the latest within 48 hours of becoming aware of it, by email to the contact in the Authorization Form. The 48 hours are a maximum, not a period that Bitshard may wait for. Bitshard does not first assess whether the breach is likely to result in a risk; that assessment is the Customer’s. Bitshard sends what it knows at that moment and completes the information as it learns more (protocol P6 of Schedule 3 of the Terms).

15.2 Content. The notice includes at least: (a) a description of the nature of the breach, including, where possible, the categories and approximate number of data subjects and of records concerned; (b) the details of a contact point where more information can be obtained; (c) its likely consequences and the measures taken or proposed to address it, including measures to mitigate its possible adverse effects. Where and to the extent that not all the information can be provided at the same time, the first notice contains the information then available, and further information is provided without undue delay as it becomes available.

15.3 Cooperation. Bitshard cooperates with the Customer and documents the breach. It does not notify the supervisory authority or the data subjects on the Customer’s behalf, unless the Customer instructs it to or the law requires it.

15.4 Incidents detected on the Customer Servers. When the Service detects an intrusion or other security incident on a Customer Server, Bitshard informs the Customer without undue delay, also outside Business Hours, through the alert of the Service. Bitshard assesses, with the information available to it, which personal data may have been affected. If the incident is a personal data breach affecting data that Bitshard processes for the Customer (for example, logs it collects, data it accesses during a manual service, or backups it keeps), clauses 15.1 to 15.3 apply in full, regardless of where the incident occurred and of who caused it. In any case, the Customer, as controller, decides whether it must notify the supervisory authority or the data subjects; Bitshard helps as described in Schedule 1 of the Terms.

16. Information and audits (Article 28(3)(h) GDPR)

16.1 Information. Bitshard makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and with this DPA, including: this DPA and its Annexes; the part of Bitshard’s record of processing activities (Article 30(2) GDPR) that concerns the Customer; the certifications and audit reports of the Sub-processors, where they publish them; and the results of Bitshard’s own reviews of its measures. Bitshard answers the Customer’s questions about the processing promptly.

16.2 Audits and inspections. The Customer may audit the processing of Customer Personal Data, itself or through an independent auditor that it mandates, which must be bound by confidentiality and must not be a competitor of Bitshard. Audits may include inspections. They are carried out:

1. with 30 days’ written notice, during Business Hours; the notice and the hours are shortened as far as the urgency requires, in particular after a personal data breach, when there are reasonable indications of non-compliance or when a supervisory authority requests it;

2. one ordinary audit every 12 months; additional audits justified by the nature of the processing, organised proportionately; and, without that annual limit, whenever one of the situations mentioned in point (a) occurs;

3. limited to the processing carried out for the Customer, without access to the data of other customers or to confidential information that the audit does not need;

4. by examining documents and by demonstrations of the configuration of the systems and, where that is not enough, by inspection at the place where Bitshard’s staff work. The premises of the Sub-processors are audited through their certifications and reports and, where needed, through the inspection rights that their terms give Bitshard, which Bitshard exercises on the Customer’s request.

16.3 Costs. Each party bears its own costs. Additional ordinary audits beyond one every 12 months are charged for the time reasonably needed, at the Hourly Rate, after a prior estimate. Audits needed because of one of the situations of clause 16.2(a) are never charged and are not subject to the annual limit. A disagreement about the price does not delay a check that is legally necessary or urgent.

16.4 Bitshard makes the information of this clause, including the results of audits, available to the competent supervisory authority on request, and cooperates with it (Article 31 GDPR).

17. End of the processing: return and deletion (Article 28(3)(g) GDPR)

17.1 When the Contract ends, the Customer chooses between: (a) return and deletion: Bitshard returns all the Customer Personal Data that it still holds on the Customer’s behalf, in the export described in clause 19.4(b) of the Terms (including logs within their retention period, working data of manual services and backups it keeps), and then deletes them; this is what happens if the Customer does not choose; or (b) deletion without return.

17.2 Bitshard deletes the Customer Personal Data from the Platform and from its own working storage, including the reports and attachments kept in its email, within 30 days of sending the export (or of the end of the Contract, if the Customer chose deletion without return). The backups that Bitshard makes of its own systems (at the date of this DPA, the nightly copy of the database of the central server, kept on that same server; Annex III, section 0, point 12) are deleted in their rotation within 14 days of that deletion. While the data remains in backups, it is protected by the measures of Annex III and is not used.

17.3 The only exception is data whose storage is required by the law of the European Union or of a Member State; Bitshard tells the Customer which data and which law. After the end of the Contract, Bitshard keeps, as controller and for the defence of legal claims, a record of the services performed that contains only the date, an internal identifier of the server, the type of action, the engineer and the result, without IP addresses, usernames or other content of the Customer Servers. Bitshard does not treat that record as anonymous, informs about it in its privacy policy and keeps it for 3 years from the end of the calendar year in which the Contract ended; it keeps no copies of the content of the Customer Servers for that purpose. In the same way, Bitshard keeps, as controller and for the defence of legal claims, the records of acceptance of each plan of action (clause 7.8 of the Terms): the text of the plan shown, its fingerprint, the boxes ticked, the date and time, the IP address and browser identification from which it was accepted and the email address to which the link was sent. In the plans, data that identify a person are named by references, and the table of references is deleted with the working data (clause 7.8 of the Terms), so the records kept for 3 years contain no names of the Customer’s users. Bitshard does not treat these records as anonymous and keeps them for the same 3 years. Data that the Customer instructs Bitshard to keep for an announced or reasonably foreseeable claim (protocol P10 of Schedule 3 of the Terms) are kept by Bitshard as processor, only for that purpose and only while the claim may be brought or lasts; without that instruction, Bitshard deletes them as provided in this clause 17.

17.4 For one-time services (Health Check and Emergency Clean-up), Bitshard returns or deletes the working data within 30 days of delivering the report, as the Customer chooses; the Prior Backup stays on the Customer Server, under the Customer’s control, and Bitshard keeps no copy of it, except when it is stored with the Customer’s contracted backups because it does not fit on the disk (clause 7.6(c)(i) of the Terms), in which case it is deleted 35 days after the copy in an Emergency Clean-up and 14 days after the copy in other work; a forensic copy ordered by the Customer is kept as set out in Annex II.G.

17.5 Bitshard confirms the deletion in writing at the Customer’s request.

17.6 Bitshard makes the Customer’s choice of return or deletion effective also with respect to all its Sub-processors and their copies, including the AI Providers and the recordings of sessions (Annex II.G). The only exception, for every Sub-processor including the AI Providers, is storage required by Union or Member State law, which Bitshard identifies to the Customer. What an AI Provider keeps for its own purposes as controller is governed by the Provider Terms (clause 11.1(c)) and is not a copy held on the Customer’s behalf.

18. Records and cooperation

Bitshard keeps a record of all categories of processing carried out on behalf of its customers (Article 30(2) GDPR) and cooperates, on request, with the supervisory authorities (Article 31 GDPR).

19. Liability

Clause 17 of the Terms applies to claims between the parties under this DPA. A loss or alteration of Customer Personal Data caused by a change made in the Service is also handled as a personal data breach under clause 15, whatever remedy applies under clause 17 of the Terms. This does not limit the rights of data subjects under Article 82 GDPR, nor the rules of Article 82(4) and (5) GDPR on the allocation of liability between controller and processor.

20. Non-compliance and termination

20.1 If Bitshard breaches this DPA, the Customer may instruct Bitshard to suspend the processing until it complies again, or terminate the Contract with regard to the affected services. Bitshard informs the Customer promptly if, for whatever reason, it cannot comply with this DPA.

20.2 The Customer may terminate the Contract with regard to the processing of personal data if: (a) the processing has been suspended under clause 20.1 and compliance is not restored within a reasonable time and, in any event, within one month of the suspension; (b) Bitshard is in substantial or persistent breach of this DPA or of its obligations under the GDPR; or (c) Bitshard fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under this DPA or the GDPR.

20.3 Bitshard may terminate the Contract with regard to the processing of personal data if the Customer maintains an instruction that Bitshard has identified as infringing the law under clause 4.3 and does not correct it.

20.4 In these cases clause 17 applies, and the Customer receives a refund of the Fees for the unused part of the Billing Period and of the price of one-time services not yet performed.

21. Duration, changes and governing law

21.1 This DPA remains in force for as long as Bitshard processes Customer Personal Data.

21.2 Annex IV changes according to clause 10. Other changes follow clause 21 of the Terms, except changes required by law, which may apply sooner. No change reduces Bitshard’s legal obligations of data protection.

21.3 This DPA is governed by the law and subject to the courts set out in clause 26 of the Terms, without prejudice to clause 12.4.

21.4 This DPA exists in English and Spanish; clause 25.4 of the Terms decides which version prevails.

Annex I — List of parties

Controller (or processor, under clause 2.2): the Customer named in the Order and in the Authorization Form: legal name, address, contact person (name, position, email, phone), role (controller, or processor for its own clients) and, if it has one, data protection officer. Accession: by accepting the Terms and this DPA at checkout, by accepting a quote or by signature, on the date of that acceptance.

Processor: Bitshard OÜ, registry code 17275103, Kotkapoja tn 2a-10, 10615 Tallinn, Estonia. Contact person: Juan Pedro Vila Fernandez, member of the management board, info@bitshard.eu and, for urgent matters, Bitshard’s corporate WhatsApp or Telegram published on www.bitshard.eu. Data protection officer: none designated (see Bitshard’s privacy policy, section “Data protection officer”).

Annex II — Description of the processing

A. Categories of data subjects

1. Staff and administrators of the Customer (system accounts, holders of SSH keys, administrators of WordPress and other applications, people who log in to the servers).
2. Users and visitors of the Customer’s websites and applications, whose data appears in the logs or, in Managed, in the backed-up databases and files.
3. People who try to access or attack the Customer Servers.
4. Any other person whose data appears in logs, files, databases or process lists (for example, senders and recipients in mail logs).

B. Categories of personal data, by service

1. All services: network identifiers (IP addresses, host names, ports and times of connections); account identifiers (system usernames; usernames and email addresses of administrators of WordPress and other applications; comments of public SSH keys, often in the form user@machine); web and application log data (requested web addresses, including parameters that may contain email addresses or other data; referring pages; browser identifiers; response codes); authentication events (successful and failed logins, source address and username used); mail logs, if present (sender and recipient addresses); process and connection data (command lines with their arguments, remote addresses); names, metadata and fingerprints of files; contents of allowed configuration files.
2. Manual work (Health Check, Emergency Clean-up, work at the Hourly Rate and, in Watch and Managed, the Deep Checks and manual work through the Bitshard Access): in addition, the output of the commands that the AI Model runs on the server during the Diagnosis and the Repair, which may include any data on the server needed to review it or investigate an intrusion (for example, the content of a suspicious file or of a database table modified by the attacker), limited to what is necessary; the Prior Backup (copy of the files and configuration that will be changed and, if a database will be changed, a dump of all the databases of the server); and, only if the Customer orders it, a forensic copy of the server (clause S1.5(d) of the Terms).
3. Managed: in addition, the full content of the daily backups of the server: files, databases and any personal data they contain, including customer records, messages or documents of the Customer’s own users. These data are copied and stored, not read or analysed, except during the monthly restore test or a restore that the Customer requests. The same applies to a Prior Backup that does not fit on the disk of the server and is stored with those backups (clause 7.6(c)(i) of the Terms).

C. Special categories of data

Not intended. They may be present in the backups of Managed and appear incidentally in logs (clause 9). Restrictions: the Customer flags the servers and sources concerned in the Authorization Form; excluded sources are not collected; the AI Model is instructed not to read flagged sources, which reduces but does not exclude that their data reach it (clause 9.2). Masking (clause 11.2) does not detect special categories of data that appear incidentally outside the flagged sources.

D. Nature of the processing

Manual services: preparation and check of the access and access to the server (clause S1.2(b) of the Terms); reading and analysis with the AI Model, checked by a second AI model (Diagnosis); changes of the plan of action accepted by the Customer, run by the AI Model with the process supervised in general by people of Bitshard, without a person approving each command or each change, after a Prior Backup kept on the Customer Server or, in the case of clause 7.6(c)(i) of the Terms, with the Customer’s contracted backups (Repair); preparation of the report; return and deletion; destruction of Bitshard’s copy of the private keys when the report is sent (clause 19.4(c) of the Terms). Watch and Managed: automated collection through the Watcher; transmission to and storage on the Platform; matching of the inventory against vulnerability sources; detection of anomalies by fixed rules; analysis with the AI Investigator; supervision by an operator; execution of Approved Actions; automatic read-only connections through the Bitshard Access, scheduled or triggered by an alert, at any time, for Deep Checks with the AI Model and, in Managed, connections for manual work; checks and port scans from the Internet; backups and restore tests (Managed); preparation and sending of alerts and reports; export and deletion; destruction of Bitshard’s copy of the private keys when the plan ends (clause 19.4(c) of the Terms). In all services, an encrypted copy of the keys may remain for up to 14 days in the internal logs of Bitshard’s database, which delete it automatically.

E. Purposes

To provide the Service ordered: review of the server, clean-up of intrusions, inventory of the software, detection of vulnerabilities, application of updates, monitoring, detection and investigation of security incidents, checks of exposure to the Internet, backups (Managed) and reports to the Customer.

F. Duration and frequency

The term of the Contract and the period of clause 17. Frequency of any transfer to a Customer outside the EEA (clause 12.4): continuous during the Contract (alerts and reports) and one final export at its end.

G. Retention periods within the Service

H. Processing by Sub-processors

See Annex IV: subject matter, nature and duration of each Sub-processor’s processing are those of the function described there, for the term of the Contract.

Annex III — Technical and organisational measures

0. Manual services (Health Check and Emergency Clean-up)

1. Access to the Customer Server through two users that the Customer creates by running the installation package that Bitshard sends only by email, with its SHA-256 fingerprint: a read user without administrator rights and a repair user with administrator rights (sudo), whose commands with sudo are recorded on the Customer Server, each with one key of Bitshard accepted only from the IP address of the central server. The keys have no end date; in Watch and Managed they are changed every 6 months and whenever there is a suspicion (clause 6.7(a)(iii) of the Terms); Bitshard destroys its copy of the private keys at the end of each order (clause 19.4(c) of the Terms; point 12); without them, the users that remain on the Customer Server let nobody in. The Diagnosis uses only the read key. The repair key is loaded only for at most 10 minutes to check that the repair user can use sudo, without changing anything, and for a Repair whose plan the Customer has accepted and an operator has confirmed (clause 7.8 of the Terms), for the time of the plan and at most 4 hours each time; its first use is the Prior Backup, and nothing is changed until that backup has been checked. When the access is checked, a command that needs administrator rights is run with the read key and must be refused; the result is recorded. The Customer can revoke the access at any time by running the removal program (uninstall) or by locking the users (clause 6.6 of the Terms).
2. The computers and telephones of the persons who work on the Service (the engineer and the operators): operating system with security support, full-disk encryption and automatic screen lock. Customer Personal Data are not stored on them (point 8); what a Customer sends through WhatsApp or Telegram with data of its server is deleted from the chat within 24 hours.
3. A model of an AI Provider is used only with Bitshard’s account at that AI Provider (clause 11.1(f)); an Own Model runs only on the infrastructure listed in Annex IV. The AI tool runs on the central server, as the Linux user of the Customer, in jobs started by the orchestrator: in the Diagnosis, which no person follows, it uses only the read key, whose user has no administrator rights; in the Repair, with the process supervised in general by people of Bitshard, it runs the commands of the accepted plan without a person approving each command or each change (clause 7.6(b) of the Terms), each command in its own call to sudo. Its instructions treat everything read on the server as data and never as an order; a second AI model checks the report and the plan, and the result of the Repair against the plan.
4. Before any output is given to the AI Model, the masking of clause 11.2 is applied.
5. Bitshard does not ask the AI Model to read the files excluded in section 1.5; the read user cannot read those that only the administrator can read, and the tools try to block those that every user can read and mask the secrets that they recognise; such a file may nevertheless reach the AI Model (clause 6.4 of the Terms). If the work needs one of them, the plan of action says so expressly.
6. Before the first change, a Prior Backup: a copy of the files, configuration and scheduled tasks that the Repair will touch and, if it changes a database, a dump of all the databases of the server (when it is restored, all of them go back to the date of the backup), stored on the disk of the Customer Server in a folder that only its administrator can read; Bitshard keeps no copy. If the disk has no room and the Customer has contracted backups of that server (Managed), the copy is stored, encrypted, with those backups (Contabo GmbH (Germany), in the European Union) and deleted 35 days after the copy in an Emergency Clean-up and 14 days after the copy in other work; otherwise clause 7.6(d) of the Terms applies. Before the backup nothing is changed on the server. A copy on the same disk does not protect against the failure of that disk or against an attacker with administrator access on the server (clause 7.6(c) of the Terms).
7. Every command run on the Customer Server by the AI Model, and its output as the AI tool reports it, are recorded on the central server; every command run with sudo is also recorded on the Customer Server; every change is listed in the report. These records are partial evidence (clause 6.7(d) of the Terms). Recordings follow the periods of Annex II.G and the deletion obligations of clauses 13.2 and 17.
8. Working data, forensic copies ordered by the Customer and the records of each work are stored only on the central server, in the Linux user of the Customer or in folders accessible only to its administrator, and what is kept in its database is also in the nightly copy of that database, on the central server itself (point 12); never on the computers or telephones of the engineer or of the operators, on removable media or in third-party services other than the Sub-processors of Annex IV; they are deleted within the periods of Annex II.G.
9. Communications about the work go by email to the Customer’s contacts; through WhatsApp, Telegram or similar channels only summaries without Customer Personal Data and buttons are sent (clause 22.2 of the Terms); permissions of plans of action are given only on the acceptance page whose link is sent by email to the registered address (clause 7.8 of the Terms; point 13).
10. Continuity: Bitshard has a single engineer. The reading works of the AI Model run on the central server without a person following them; a Repair needs the confirmation of an operator to start (clause 7.8(g) of the Terms) and its process is supervised in general by people of Bitshard (clause 7.6(b) of the Terms); if no operator is available to confirm it, the Repair does not start. After a restart of the central server, no work that needs a key runs until an authorised person unlocks the keys. The Customer keeps full control of the access (point 1).
11. Remote access from outside the EEA (clause 12.2): only by the persons who work for Bitshard on the Service, from computers with the measures of point 2, through encrypted connections. Only the persons that Bitshard authorises enter the central server, each with their own key and through the VPN. The engineer and the operators work through email, the messaging group and the reports, without keeping Customer Personal Data on their computers or telephones (point 8).
12. Central server: at Contabo GmbH, in the European Union (France) (Annex IV); at the date of this DPA there is only one; no service open to the Internet except Bitshard’s VPN; one Linux user per Customer; the private keys of the Customers are kept encrypted until they are destroyed at the end of each order (clause 19.4(c) of the Terms; an encrypted copy may remain for up to 14 days in the internal logs of the database of each central server, which delete it automatically), the read keys are loaded in memory while the access is in use and the repair keys only as stated in point 1; after a restart they stay locked until an authorised person types the master password; every night a copy of its database, without the keys, is made on the central server itself and kept for 14 days; if Bitshard adds a second central server on standby, the database, with the keys encrypted, is replicated to it continuously; the credential of the AI Provider is kept by the orchestrator. A person with the administrator level on the central server can read every key; Bitshard grants that level only to the persons it names. Bitshard holds the accounts of the central server, of the VPN and of the AI Providers. If the central server may be compromised, Bitshard switches it off and asks the Customers to delete its keys, because only they can remove them (protocol P6 of Schedule 3 of the Terms).
13. Acceptance page (clauses 7.8 and 22.3 of the Terms): it runs on a web server of Bitshard in the European Union (France), separate from the central server (Annex IV), and holds no keys of the Customer Servers; each link to a plan is unique, is used up only when the plan is accepted (opening it does not use it up) and expires after 72 hours; each acceptance record contains the exact text shown and its fingerprint (SHA-256), the version of the Terms, the boxes ticked, the server time, the IP address, the browser identification and the email address to which the link was sent, and points to an unchanged copy of each published version of the legal texts; only published versions, without internal notes or pending markers, are registered. The records are kept for the period of Annex II.G and then deleted. The other links of the emails (the buttons of clause 22.3 of the Terms) are computed by the central server with a key that the page does not have, and the page keeps only their fingerprint; opening one does nothing, the action happens when the button of the page is pressed, and the page keeps each press with the IP address and the browser from which it was made (Bitshard’s privacy policy states for how long). The central server collects the presses through an encrypted connection that it opens itself, checks each one with its key and validates its data again. The page also keeps the latest snapshot of “Status of your order” (stages, actions of the plan and number of commands of each category; never the commands, their output, the email addresses or the IP address of the server), which it deletes 30 days after the order is closed. The emails with the links, the buttons and the copies of what was accepted are sent through Zoho Mail from no-reply@bitshard.eu, with info@bitshard.eu as the reply address; no program of Bitshard reads the emails that Bitshard receives.

1. Access to the Customer Servers (Watch and Managed)

1. The Watcher opens an outgoing encrypted connection (TLS) to the Platform and needs no open port; the Bitshard Access is described in point 8.
2. The Watcher only runs functions from a fixed list; it does not accept free-form commands.
3. Read-only commands run with the read user of the Bitshard Access, without administrator rights.
4. Every action that changes something runs only through the repair key, loaded on the central server for that action after the Customer’s permission of its plan or its pre-authorisation (clauses 7.4 and 7.8 of the Terms) and the confirmation of an operator; the Watcher does not run changes.
5. The Watcher’s functions never read these paths: /etc/shadow, /etc/gshadow, private SSH keys (/etc/ssh/ssh_host_*_key, ~/.ssh/id_*), private TLS keys (/etc/ssl/private/, /etc/letsencrypt/live/*/privkey.pem, /etc/letsencrypt/archive/), .env files, wp-config.php, .my.cnf, .pgpass, .netrc, .git-credentials, cloud-provider credential files (~/.aws/credentials and equivalents).
6. Known secret values in command lines and logs are hidden before storage on the Platform, and the masking of clause 11.2 is applied before data are given to the AI Model.
7. The remote-command and active-response functions of Wazuh are disabled.
8. Bitshard Access (clause 6.7 of the Terms): as in point 1 of section 0; the keys are those of point 12 of section 0. The Customer can see and remove them at any time.
9. Every session is recorded on the central server (date, time, server, key used, commands and their output) and listed in the monthly report; recordings follow Annex II.G.
10. Removal: Bitshard’s copy of the private keys of the server is destroyed when the plan ends (clause 19.4(c) of the Terms; section 0, point 12); the Customer removes the users and their keys with the removal program (uninstall).

2. AI Investigator

1. In the automatic reading sessions of clause 6.7(b) of the Terms it uses only the read key.
2. Each investigation only has access to the servers of one customer.
3. Every tool call and every response of the model is logged.
4. It can only propose actions from the Action Catalogue; each one runs only after the Customer’s permission of its plan or its pre-authorisation and the confirmation of an operator (clauses 7.4 and 7.8 of the Terms).
5. It uses the AI Providers with Bitshard’s account, configured so that customer content is not used for training (clause 11.1(d)), or an Own Model; the credential of the AI Provider is kept on the central server, never in code repositories.
6. It is instructed not to read data from sources flagged under clause 9.2, which reduces but does not exclude that such data reach it (clause 9.2).

3. Platform

1. Dedicated machines that host no websites, located in a data centre in the European Union (clause 12.2).
2. Administrative access only through a VPN.
3. Encryption in transit (TLS) for all connections between the Watcher, the Platform, the engineer and the Sub-processors.
4. Backup of the database as on the central server (section 0, point 12): a copy every night on the server itself, kept for 14 days.
5. The Platform is updated with the same procedure as the Customer Servers.
6. Administrative access to the Platform is logged; those logs are kept for 12 months.
7. The data of each customer is separated logically, by customer identifier.
8. External port scans are made only from the IP addresses stated in the Authorization Form and only against the targets listed in it.

4. Organisation

1. Every person with access to Customer Personal Data is bound in writing, before having access, to confidentiality and to act only on Bitshard’s instructions (by an employment contract, by membership of the management board or by a specific written commitment).
2. Customer Personal Data is not sent through WhatsApp, Telegram or other chat applications, nor stored in project-management tools; through those channels only summaries without Customer Personal Data are sent; Customer Personal Data is sent by email only in the alerts and reports addressed to the Customer.
3. Written procedure for handling security incidents and notifying breaches (clause 15), applicable also outside Business Hours.
4. Review of these measures at least every 12 months and after any significant incident.
5. Requests from public authorities of countries outside the EEA: Bitshard discloses Customer Personal Data to such an authority only where an international agreement or the law of the European Union or of a Member State requires it (Article 48 GDPR). If a law binding on Bitshard or on a person who works for it compels a disclosure that Article 48 GDPR does not allow, Bitshard contests the request by the reasonable means available, discloses only the minimum if it cannot avoid it, informs the Customer unless the law prohibits it, asks the authority to address the Customer and records the request and the answer (protocol P7 of Schedule 3 of the Terms). A person who works for Bitshard from outside the EEA may be subject to the laws of the country from which they work; Bitshard reduces the data available there (section 0, point 8) and assesses that risk (point 6).
6. Bitshard keeps an internal written assessment of the risks of the law of each country from which its staff access Customer Personal Data (in particular, access by public authorities), and reviews it when that country changes. The assessment is not published; the Customer can ask for a summary under clause 16.1.
7. Logs that Bitshard keeps for its own security purposes are kept separate from the content of the Customer Servers, are limited to what that purpose needs and do not include, by default, the full output of commands; no immutable storage is configured that would prevent Bitshard from meeting its deletion obligations.
8. Changes need the Customer’s permission of the plan of action on the acceptance page (section 0, point 13) and the confirmation of an operator (clause 7.8 of the Terms). When a person stops working on the Service, their users of the VPN and of the central server, their credentials of the AI Providers and their access to the messaging group are revoked on the same day, the passwords that protect the keys are changed, and the return or deletion of the data that they hold is confirmed in writing (protocol P8).

5. Minimisation, retention, portability and deletion

1. Only the log sources listed in the Authorization Form are collected; the Customer can exclude sources.
2. Retention periods of Annex II.G.
3. Export in JSON or CSV and reports in PDF (clause 19.4 of the Terms).
4. Deletion procedure with written confirmation on request (clause 17).

6. Assistance to the Customer

1. Search, export, correction and deletion by identifier (clause 13.2).
2. Information for breach notifications (clause 15) and for impact assessments (clause 14).

Annex IV — Sub-processors

This list is also published on Bitshard’s website at https://www.bitshard.eu/legal.html#subprocessors (clause 10.1). The AI Providers are interchangeable: Bitshard uses any of them, or an Own Model, as it chooses (clause 11.1).

Own Model: an Own Model is run by Bitshard itself and is not a Sub-processor; the provider of the infrastructure on which it runs is, and is listed in this Annex before the first use (clause 10.2). If the Own Model runs on the machines of the Platform, the provider of the Platform, once listed in this Annex, covers it, and its function includes running the Own Model.

Not Sub-processors: (a) Stripe, which processes the billing data of the Customer’s organisation as Bitshard’s processor (and as controller for its own purposes); those data are not Customer Personal Data; (b) the Customer’s own hosting provider, which is the Customer’s processor (rollback snapshots remain in the Customer’s account); (c) the public vulnerability sources (OSV, the CISA KEV list, EPSS, endoflife.date and the WordPress vulnerability databases), which only receive names and versions of software, not personal data. (d) Telegram Messenger Inc. and WhatsApp (in the European Economic Area, WhatsApp Ireland Limited), through which Bitshard sends to its operators and to the Customer’s contacts only summaries without Customer Personal Data (clause 22.2 of the Terms); they process the data of those people as controllers under their own terms, as Bitshard’s privacy policy explains; (e) the VPN of the central server, which Bitshard runs itself, without a third-party service.

Optional recipient, only if the Customer chooses it in the Authorization Form: CrowdSec SAS (France), which receives the IP addresses that attack the Customer Servers, the detection scenario and the time, in order to build shared blocklists. Off by default and only for Watch and Managed. Before these plans become available, this Annex will state whether CrowdSec acts as processor or as controller of those data.

Annex V — International transfers

No other transfer outside the EEA takes place with the standard configuration of the Service. Remote access by the persons who work for Bitshard from outside the EEA is not a transfer (clause 12.2).

Server Watch Price List

Version 2026-10-25-v10.5, published on 25 October 2026. Prices in euros, for businesses and professionals only, taxes not included, and charged in euros to every customer. Our website may also show an approximate equivalent in US dollars, for reference only; it is not a price. If the payment page offers you another currency, Stripe has converted the amount at its own rate, with a conversion fee of 2% to 4% that you pay; you can choose there to pay in euros, without that fee (Terms, clause 10.1). VAT: not charged to business customers established outside Estonia (reverse charge in the EU with a valid VAT number; outside the scope of EU VAT for customers outside the EU); Estonian VAT at the rate in force (24% in 2026) for customers established in Estonia. Seller: Bitshard OÜ, registry code 17275103, Kotkapoja tn 2a-10, 10615 Tallinn, Estonia, VAT EE102906167. The Terms of Service define each product and what it includes.

Available now

Before you buy a Health Check or an Emergency Clean-up: (1) Server Watch is an AI-driven service: an AI model reads your server and, in the repair phase, carries out the changes of a plan of action that you accept, always after a backup of what it is going to touch; the process is supervised in general by people of Bitshard, but no person approves each command or each change. As controller of the data on your servers (or as the processor authorised by your own clients), you instruct us to use the AI models and AI providers listed in our Data Processing Agreement, which we choose and may change, with their known conditions; providers may keep data for their own purposes and as controllers for the periods set in their own terms (Provider Terms, linked in Annex IV of the Data Processing Agreement), which you accept, a disclosure that you authorise; and you are responsible for those data (Terms, clause 7.1). (2) Once the work has started (the first recorded diagnostic action on your server), the price is due also if you cancel; we deduct what we save, and what we earn or could reasonably have earned from other work, by not finishing it; if you do not give us working read and administrator access within 15 Business Days of the email in which we send you the instructions and the installation package, the Contract ends and the price is not refunded; your rights if we fail to perform are not affected (Terms, clauses 11.2, 11.3 and 11.6). (3) If something is deleted or damaged by mistake, including by an error of the AI model, the first remedy is that we restore it from the backup that we take before making changes, which covers what the repair is going to touch, not other data, and is kept on the disk of your server (so it is lost if that disk fails or an attacker changes it) or, if it does not fit there and you have backups of that server contracted with us, with those backups; beyond that, our liability is limited to the price of the service, except in the cases of clause 17.1 of the Terms (for example, gross negligence), and if your disk has no room for that backup and you have no contracted backups, you make your own backup or accept the risk in writing before the repair starts (Terms, clauses 7.6(c) and (d) and 17).

Coming later (waiting list, cannot be ordered yet)

Discount codes, when we give them, reduce these prices on the payment page. Each code states its products, its expiry date, its number of uses and, for monthly plans, for how many months the discount lasts; each code can be used the number of times it states and, unless it says otherwise, once per customer (using it more often lets us charge the difference or refuse the order); codes cannot be combined or exchanged for money; and any refund or other amount calculated from the price is calculated on what you actually paid (Terms, clause 10.8).