Service Specific Terms

1 What every order must record

Before provisioning, the accepted order must identify the customer and authorised contacts, service type, management level, configuration, location, upstream supplier where relevant, start date, billing interval, commitment, renewal and notice periods, price and taxes, support hours and included work. It must identify bandwidth and usage limits, backup and retention choices, any SLA, exit arrangements and service-specific restrictions. A change requires an authorised written variation.

Availability targets, hardware-replacement targets, response times, service credits, recovery point objectives and recovery time objectives apply only if expressly agreed. Marketing references to monitoring, resilience or dedicated infrastructure do not create a percentage uptime guarantee or zero-data-loss warranty. An agreed SLA must define measurement points, exclusions, maintenance, the claim process and credits, without excluding mandatory remedies.

2 Self managed bare metal cloud servers

A bare metal server is a dedicated physical server allocated for the customer's use; it is not a promise that every network, storage or data-centre component is dedicated. The customer receives the administrative access identified in the order. Hardware remains the property of ITSA or its supplier unless sold under a separate agreement. A specified hosting region is a location commitment only to the extent written into the order.

ITSA's base responsibility is to arrange the ordered hardware, data-centre facilities and network allocation, provision the agreed access and coordinate physical hardware faults with the facility operator. Physical facilities and replacement work may be delivered by an upstream provider. ITSA must identify that dependency and any contractual restrictions affecting the customer. Physical security of a facility does not secure the customer's operating system or applications.

The customer must install, configure, license, patch, harden and monitor its operating system, hypervisor, containers, applications and databases; manage users, root and administrator accounts, firewall rules, certificates, encryption and keys; and protect all data and credentials. The customer must maintain supported software, incident response capability, independent backups and tested recovery. Default images and optional control panels do not include continuing administration.

ITSA does not routinely log in to or monitor the guest operating system, inspect files, patch software, restore data or investigate application faults under the base service. Any authorised remote-hands or administration task must state scope, access, price and responsibility. Emergency isolation to protect infrastructure is permitted under the Trust and Safety Policy, with notice where practicable. Such isolation does not transfer ongoing administration to ITSA.

Before production use, the customer must verify hardware resources, access, storage layout, network rules and successful external backups. The customer must replace initial credentials, restrict management ports, use multifactor authentication where available and keep an external recovery contact. The customer bears the operational risk of unsupported configurations it chooses, but ITSA remains responsible for its own agreed duties and wrongful acts.

3 Bare metal faults rebuilds and data loss

Report suspected hardware faults to [email protected] with the server reference, symptoms and relevant diagnostic information. ITSA may request non-sensitive diagnostics and a safe access window. Replacement time depends on the accepted SLA, hardware availability and facility access; no universal replacement time is promised. ITSA will coordinate a reasonable response and communicate material updates.

Replacing disks, changing storage controllers, booting rescue systems, repartitioning, reimaging and releasing a server can destroy data. ITSA must obtain authorised confirmation before a destructive operation unless immediate action is lawfully necessary to contain serious harm. Customers must verify recoverable backups and preserve keys before authorising it. RAID, disk mirroring, snapshots and spare disks are not independent backups. ITSA is responsible for damage caused by carrying out an operation outside the authority granted, subject to the governing terms and law.

Failed or retired media must be handled under the facility's documented sanitisation or destruction process. Dedicated destruction, retention of failed media or a destruction certificate must be ordered separately if required. Do not assume supplier standard erasure meets a regulated workload's requirements. On release, the customer must remove credentials, export data and request any agreed sanitisation evidence before the server is reassigned.

4 Networks traffic and permitted workloads

The order controls included traffic, port speed, IP addresses, storage and other limits. Port speed is a maximum interface capability, not guaranteed internet throughput. Additional IP allocations may require technical justification. IP addresses and reverse-DNS allocations are assigned for the service term and are not sold to the customer. Transfers, changes and overage rates must be disclosed before chargeable use where practicable.

Do not spoof addresses, operate open mail relays or resolvers, send unsolicited bulk messages, attack other systems or run unauthorised scanners. Mail delivery depends on reputation, recipient policies and upstream port restrictions; a server order does not guarantee bulk-mail capability. High-risk stress tests, cryptocurrency mining, public proxies, reselling and unusually intensive workloads require prior written approval where they may affect supplier rules or network safety. The applicable restriction must be disclosed for the selected platform rather than assumed for every customer.

DDoS protection applies only where included and within its stated limits. ITSA may filter or temporarily null-route traffic to contain an attack or protect shared systems, using the least disruptive reasonably available option. Lawful customers must cooperate with remediation. Unused capacity does not entitle a customer to bypass usage limits or resell another supplier's products without permission.

5 Managed virtual servers and cloud platforms

Virtual CPU, memory, storage, tenancy model, management tasks and support scope must be stated in the order. Virtual resources may share underlying hardware. Managed work can include selected operating-system updates, monitoring, hardening or backup administration only as specified. Application development, application-level support, database tuning and emergency recovery are separate unless expressly included.

Public-cloud accounts may incur consumption charges for compute, storage, egress, snapshots, licences and resources left running. Budgets and alerts are controls, not guaranteed spending caps. The customer must approve billing ownership, limits, administrator roles and responsibility for deleting unused resources. ITSA must not make unapproved material changes or purchases on the customer's account.

6 Managed website hosting

The selected package controls website count, storage, updates, security work and support. Current package recovery frequencies are: Web Start, one managed restore point quarterly; Business Cloud, monthly; Professional Cloud, twice per month; Managed Pro, daily backups plus an off-site copy. These frequencies are not a promise to retain every historical restore point. The order must specify retention, covered files and databases, exclusions, restore charges and recovery objectives. A different agreed schedule controls an existing customer service.

Business email is supplied separately unless included in writing. Customers must keep lawful content, licensed themes and extensions and supported applications. ITSA may require removal of vulnerable components or excessive resource use after explaining the issue. An SSL certificate protects a connection within its scope; it does not certify the business, prevent every attack or guarantee search ranking. Website migrations require an agreed cutover, DNS plan, verification and rollback responsibility.

7 Backup recovery and continuity

The backup order must identify protected systems and datasets, credentials, encryption and key custody, backup frequency, location, immutability if included, retention and deletion, exclusions, capacity and failure-alert responsibility. It must state who reviews successful jobs and who performs restore tests. A completed job does not prove application consistency or recovery until tested appropriately.

Customers must identify critical workloads, notify ITSA of material changes and cooperate with recovery tests. ITSA must investigate failed jobs within the agreed support scope and must not represent an unverified copy as recoverable. A restore may overwrite newer data and requires authorised approval. Backup and disaster recovery are distinct services; a backup purchase alone does not include a warm standby environment, guaranteed failover or a specific recovery time.

8 Domains DNS certificates and edge services

Domain registrations and renewals are governed by the Domain Registration Agreement. Domain ownership, DNS hosting, website hosting, email and certificates are separate services unless bundled expressly. A DNS change may affect all dependent services and requires an authorised instruction and a rollback plan proportionate to its risk.

Caching, DNS, filtering and secure-access products may be delivered by upstream platforms under their disclosed terms. Cached material can remain temporarily after an origin change. Customers must configure cache exclusions for private content and review access rules. ITSA must disclose material supplier restrictions before the customer commits; a generic reference to suppliers is not sufficient to impose an undisclosed product contract.

9 Microsoft 365 software and subscriptions

The order must identify publisher, plan, tenant, user count, licence period, billing frequency, renewal and cancellation window and what administration or migration is included. Paying monthly does not make an annual commitment cancellable monthly. The customer must accept applicable publisher terms through a valid process and ensure users meet licensing conditions. ITSA must give the customer access to applicable terms before activation.

Customers retain ownership and control of their tenant and business data. Delegated administration must be limited to agreed roles and purpose, recorded and withdrawn when no longer needed. Licensing does not by itself include backup, archiving, retention configuration, endpoint support or migration. Deleting a user, cancelling a licence or terminating a subscription may start the publisher's deletion process; agree exports and retention before authorising those actions.

10 Cybersecurity assessment and response

Testing requires written authorisation identifying systems, owners, scope, methods, time windows, source addresses, exclusions and emergency contacts. The customer must obtain permission from every affected third party. A vulnerability assessment does not authorise exploitation, persistence, destructive testing or social engineering unless those activities are expressly approved. ITSA may stop work if authority or safety is uncertain.

For monitoring or managed detection, define log sources, data access, coverage hours, alert priorities, escalation contacts and who may isolate devices or disable accounts. Automation must operate within approved response playbooks and reversible limits. No product or service guarantees detection of every threat. Incident response is an agreed professional service; forensic admissibility, law-enforcement liaison and specialist recovery must be identified separately if required.

11 Managed support projects and websites

Support scope must state covered users, devices, sites and systems, response coverage, included time and excluded work. Requests by an authorised contact may be chargeable at agreed rates. ITSA must document material changes and preserve a reasonable route to rollback. Customer delays or unsupported systems may affect delivery but do not excuse negligent work.

For web design and development, agree deliverables, revision rounds, content ownership, third-party licences, acceptance tests, source-file rights, maintenance and accessibility requirements. The customer must approve supplied content and lawful collection through forms. Production deployment requires authorised acceptance and suitable backups. A design project does not include perpetual hosting, security maintenance or future platform updates unless the order says so.

12 Hardware installations and physical systems

Hardware, structured cabling, Wi-Fi, CCTV, access control, biometrics, alarms and smart-system installations require agreed specifications, site permissions and safe working conditions. Electrical, working-at-height and other specialist tasks must be performed by competent authorised persons. ITSA may stop unsafe work under its SHEQ Policy. The customer must disclose hazards and obtain landlord or site-owner approvals.

The customer must determine the lawful purpose and retention for recordings and biometric data, provide notices and restrict access. ITSA must configure agreed controls and avoid retaining unnecessary copies. Surveillance is not an assurance against crime or loss. Acceptance, training, handover records, workmanship warranty and maintenance responsibilities must be documented.

13 Service exit and upstream dependencies

Before activation, record export formats, migration responsibilities, domain and tenant ownership, credential handover, deletion timetable and any supplier limitation on post-termination access. ITSA must provide reasonable cooperation on agreed charges and must not claim ownership of customer domains or tenants as a substitute for collecting an unrelated debt. Preserve records legally required and erase other customer data under the agreed schedule, including backup expiry.

For bare metal, obtain the customer's release approval before supplier cancellation, because reallocation may erase all disks immediately. The thirty-day retrieval provision in the main terms applies unless a different documented supplier limit was expressly accepted before provisioning. Do not rely on post-cancellation recovery. Questions about scope or support may be sent to [email protected] for infrastructure or [email protected] for general services.