Managed Services Terms

1. About these terms

These Managed Services Terms apply to server management plans (Essential, Advanced, Enterprise and Ultimate) on YallowHost cloud and bare metal servers. They add to our Terms and Conditions, Privacy Policy and Refund Policy. If they conflict with the Terms and Conditions on a management plan, these terms apply. Words such as "we" and "you" mean what they mean in the Terms and Conditions.

2. One plan, one server

A plan covers one server, the one it was bought for. It cannot be moved to another server. Each server can have one plan at a time.

3. What each plan includes

We carry out the work listed for your plan, and only that work:

• Essential: operating system updates; security patching; basic firewall setup (iptables or UFW); standard monitoring of the server's health and key services, with alerts reviewed by our team. You keep root access.
• Advanced: everything in Essential, plus performance tuning of the operating system and its services; automated daily backups (section 8); malware scanning; priority handling of your support tickets by our L2 engineers. You keep root access.
• Enterprise: everything in Advanced, plus 24/7 incident response (section 9); a dedicated account manager, a named member of our team who is your main contact; custom architecture reviews on request; zero credentials (section 6); and the Data Protection Compensation Cover up to $50,000 (section 11).
• Ultimate: everything in Enterprise, plus proactive threat hunting on the server; L3 engineering hours with no hour count, under fair use (section 10); help designing and setting up high-availability (HA) clusters across servers you order from us (each extra server is billed on its own); zero credentials; and the Data Protection Compensation Cover up to $100,000 (section 11).

Work that is not listed, such as developing, installing or fixing your own applications, websites and content, is not part of a plan. We can quote for it separately.

4. Billing and the plan year

Plans are priced per month and billed annually, in advance: twelve times the monthly price. The plan's year starts on the day management begins (section 5), not on the day you pay. Before the year ends we issue a renewal invoice for the next year; nothing is charged until you pay it (Terms and Conditions, Section 6). If the renewal invoice is not paid by its due date, the plan is suspended until it is paid; if it stays unpaid, we end the plan and the server carries on as an empty machine. A plan keeps the price and the features it was ordered with for as long as it renews. Prices are before tax.

5. When management begins

After the plan's first invoice is paid, our team takes the server on: we check the operating system, harden it and switch on the plan's monitoring and backups. On Enterprise and Ultimate we also replace the server's access details and remove your SSH keys. Management begins when this work is finished, and we tell you by e-mail. If we find that we cannot take the server on (for example, it is already compromised or runs software we cannot support), we tell you and refund 100% of the plan's payment.

6. Zero credentials (Enterprise and Ultimate)

While the plan is active, only YallowHost configures, manages and accesses the server. Our team holds the server's access details; you do not receive them. Our authorised staff (administration, quality assurance and security) can see them at all times, and every time they are shown is recorded. Every change to the server is made by our team at your request, through a support ticket. You agree not to try to gain access by other means. The server's IP address stays visible in your account. If the server was ordered with a control panel, you receive a limited login to that panel (a User or Reseller account), and our team keeps its administrator login. When the plan ends, we give you new access details.

7. Root access (Essential and Advanced)

You keep root access. Changes you make can conflict with our work. We may ask you to undo a change, and repairing what your own changes broke is not part of the plan.

8. Backups (Advanced, Enterprise and Ultimate)

We take automated daily backups of the server and keep each one for 7 days, on separate, isolated storage. We may also take any other backup we consider necessary to secure the server's data, at any time. We restore a backup when you ask, or when we need to after an incident. Our backups are a protection for the server, not a replacement for your own copy of data you cannot afford to lose (Terms and Conditions, Section 13).

9. Monitoring and incident response

On every plan our monitoring alerts our team to problems on the server. On Enterprise and Ultimate, 24/7 incident response means an on-call engineer is alerted at any hour and starts work on the incident. We do not promise any response time, resolution time or availability figure, on any plan.

10. Fair use (Ultimate)

"Unlimited L3 engineering hours" means our senior engineers work on your managed server without counting hours. It covers the server, its operating system and the services we manage on it. It does not cover building, rewriting or maintaining your applications, and it does not mean several engineers at once. If use goes far beyond what is reasonable for one server, we will talk to you first and may decline or quote the extra work.

11. Data Protection Compensation Cover (Enterprise and Ultimate)

11.1 What it is. If data on a covered server is lost through a qualifying incident and cannot be restored from our backups, we pay you the documented cost of recovering it, up to $50,000 (Enterprise) or $100,000 (Ultimate) per customer per incident. The cover is a commitment by YallowHost alone, paid from its own funds. No third party is involved, and it gives no rights to anyone other than you.

11.2 Trusted entities. YallowHost and the software vendors YallowHost has approved in writing for that server ("approved vendors") are the only entities trusted to configure the server or to put software on it. "Approved software" means the operating system and the software YallowHost installs and manages on the server under the plan, and software, scripts and projects programmed, audited and deployed on the server by an approved vendor. Everything else is "third-party software".

11.3 Qualifying incident. A loss of data caused at infrastructure or operating-system level: a failure of the hardware, network or storage we provide for the server, or of the work we do on the server under the plan (such as updates, patching, configuration or backups).

11.4 Conditions. All of these must be true:

• (a) the server has had an active Enterprise or Ultimate plan for at least 90 days in a row when the incident happens;
• (b) for that whole time, the server was configured, managed and accessed only by YallowHost, and every change you wanted was made by our team through a support ticket;
• (c) the server runs only approved software;
• (d) your account has no unpaid invoices when the incident happens;
• (e) you open a claim by support ticket within 72 hours of the incident being discovered, by you or by us; and
• (f) you give us the information we reasonably ask for to assess the claim.

11.5 The cover is void for a server, immediately and for any incident that follows, if you or anyone acting for you uploads your own code to it, has third-party software installed or run on it, installs a vulnerable script, or attempts any unauthorised injection, modification or access. It stays void until we have reviewed the server and confirmed in writing that it runs only approved software again; the 90 days then start again.

11.6 Not covered. Losses caused by: client-side actions (anything done by you, your users or anyone you gave access to, including through your applications or websites); third-party software; work carried out as you asked; your breach of our Terms and Conditions or the law; data held outside the covered server; and lost profits, revenue, business or other indirect losses.

11.7 What we pay. The documented cost to you of recovering the lost data, up to the plan's limit. All losses from the same cause count as one incident, and the limit applies per customer across all their servers. We assess each claim within 30 days of receiving the information we asked for, and pay an approved claim within 30 days of approval, to the payment method or bank account you name.

11.8 Refused claims and fraud. We refuse at once any claim where a breach or loss was caused by client-side actions or third-party software. A claim based on false or misleading information, or on a loss caused on purpose, is fraud: we refuse it, may end the plan without refund, and reserve the right to take legal action.

11.9 Liability. Paying a claim does not extend our liability in any other way (Terms and Conditions, Section 16).

12. Changing plans

You can change plan only when the plan renews: tell us by support ticket before the renewal invoice is issued. Moving from Enterprise or Ultimate to Essential or Advanced gives you new access details when the new year starts.

13. Cancelling and ending

You can ask to cancel a plan at any time, and it then runs to the end of the year you paid for. A plan ends with its server: if the server is cancelled, terminated or not renewed, the plan ends at the same time. Refunds follow our Refund Policy: within 15 days of the plan's first payment you can ask for a refund of that payment; after that, the unused part of the year is not refunded or credited.

14. Suspension

If the server or your account is suspended (for example for unpaid invoices or a breach of our Terms and Conditions), work under the plan stops until the suspension ends. Suspension does not extend the plan year.

15. Changes to these terms

We may update these terms. A plan you have already bought keeps the features listed when you ordered it until its year ends; the current terms apply from the next renewal.