Shared Responsibility and Security

What Hostna secures, what you secure, and why nothing on this platform is sold as a security guarantee.

Hosting is a divided responsibility. This page draws the line, so that it is drawn before an incident rather than argued about after one.

What Hostna does not sell

Hostna sells infrastructure: capacity, network, storage, a control panel and, on managed plans, the platform underneath your application. Hostna does not sell security.

We do not sell, and do not charge for, protection of your website against attack, monitoring of your website for compromise, malware removal, incident response, forensic investigation, or a guarantee that your data cannot be lost, stolen or encrypted. No part of any plan price is a fee for any of those things. If you need them, buy them from a security provider.

Where a plan lists a security-adjacent feature — a firewall in front of the platform, TLS certificates, isolated accounts, spam filtering — that feature is a property of our infrastructure, not a service level for your application, and not a promise about any outcome.

Where the line falls

Physical data centre: Ours. Access control, power, cooling and physical security of the facility.
Network to the platform: Ours. Routing, edge filtering, and mitigation of volumetric attacks against the platform as a whole.
Hypervisor and host operating system: Ours. Patching and isolation of the virtualisation layer and of the shared hosting host.
Managed platform components: Ours on shared, WordPress and email plans: the web server, the PHP runtime, the database server, the mail server, and their updates.
Guest operating system on a VPS, VDS or dedicated server: Yours. Patching, hardening, firewalling, SSH configuration and user management are yours from the moment the machine is handed over, unless you bought a managed add-on that says otherwise in writing.
Your application: Yours. CMS, themes, plugins, dependencies, custom code, configuration, file permissions and their updates.
Your content and databases: Yours. What is in them, whether it is lawful, and whether it is backed up.
Your credentials: Yours. Passwords, SSH keys, API tokens, two-factor enrolment, and who in your organisation still has access.
Your visitors' personal data: Yours as controller. We process it on your instructions as processor under the Data Processing Agreement.
Backups of your data: Yours. See below.

What you must not keep here without your own safeguards

Some data carries a risk that a hosting plan cannot carry for you. Putting it here anyway does not move that risk onto us — it concentrates it on the one party who decided to collect it.

Cardholder data: The card number, expiry date, security code or magnetic-stripe data. Not on shared, WordPress or email plans at all. On a server plan only where you operate the machine in accordance with PCI DSS and can show it. For almost everybody the right answer is a payment service provider, so card data never reaches your systems in the first place — that is what we do ourselves.
Special categories, and criminal-conviction data: Health, biometric or genetic data, data revealing racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, sex life or sexual orientation (Art. 9 GDPR), and data on criminal convictions and offences (Art. 10 GDPR). Only where you have done your own risk assessment, encrypt the data at rest under keys we do not hold, and have concluded the Data Processing Agreement.
Credentials and key material: Password databases, API secrets, private keys and copies of identity documents: encrypted at rest, never in a directory the web server can serve, never in a repository you also publish.
Personal data about people who are not your customers: A scraped dataset, a purchased list, a leaked dump. That is separately a breach of the Acceptable Use Policy and is not made lawful by hosting it here.

This is the practical answer to the worst case people imagine. A compromise that exposes a million card records is only possible where a million card records were stored somewhere they should never have been. Where data was kept contrary to this section, § 254 BGB applies to any claim brought against us over it, and the data protection consequences fall where the decision was made — on you, as controller.

Backups

Keep a current, tested copy of your data somewhere that is not Hostna. This is the single measure that turns almost every worst case into an inconvenience.

Where a plan includes an automated backup, treat it as a convenience with a stated schedule and retention window, not as an insurance policy. It lives on the same platform. A failure that takes out the platform can take it with it, and a snapshot of an already-encrypted or already-defaced site restores an already-encrypted or already-defaced site.

We do not warrant that a backup exists, is complete, is current, or can be restored, and there is no compensation where a restore is not possible.

If your site is compromised

Change every credential: hosting, control panel, database, application administrators, SSH keys, API tokens.
Take the site offline or into maintenance mode so it stops serving whatever was planted.
Restore from a backup you know predates the compromise — not the most recent one.
Patch what was exploited before putting it back online, or the same thing happens again within days.
Tell us if our infrastructure is involved, or if a third party is being harmed from your service, so we can contain it.

We will help with what is on our side of the line: confirming platform status, providing the access logs we hold, and isolating the service so the harm stops. We will not clean your application, and where a compromised service is actively attacking or defrauding third parties we will suspend it rather than leave it running while it is cleaned.

A compromise on your side of the line does not create a claim against Hostna. Liability is limited as described in section 11 of the Terms of Service, and where a claim concerns lost data it is limited to the cost of restoring it from a backup you maintained properly.

If Hostna itself is compromised

It has not happened. We do not tell you that it cannot.

What we maintain, and what our conduct is measured against: patching of the hypervisor, the host and the platform components on a defined schedule; isolation between accounts; individual staff accounts with two-factor authentication and least-privilege access; encrypted transport; logging with a retention period; separated backups of platform configuration; and the technical and organisational measures set out in section 6 of the Data Processing Agreement.

If our platform is breached and your data is affected, you hear it from us without undue delay — what we know, what we are doing, what we cannot yet say, and what you should do — together with what you need for Art. 33 and 34 GDPR. That happens as a matter of course, before anybody has decided whose fault anything was.

What follows then is section 11 of the Terms of Service, and it turns on fault. German law makes liability depend on a breach of duty: where the measures above were in place and were followed, there is no breach and no claim, and § 280 (1) BGB and Art. 82 (3) GDPR are where that is decided. Where a court finds otherwise, section 11 governs what is owed.

We do not ask you to agree that we would owe nothing whatever happened. A clause saying that would be void under § 309 no. 7 BGB — and because German law does not trim an excessive clause back to what is allowed, a clause like that would take the rest of the liability section down with it. What is written here is what can actually be relied on.

None of this changes who the controller is. The personal data your website holds about your visitors is yours: yours to have decided to collect, yours to have decided where to keep, and yours to answer for to your supervisory authority. We answer for our side of the line, on the terms above.

Reporting a vulnerability in Hostna itself

If you find a vulnerability in our own systems — the storefront, the Client Area, the control panel, the provisioning chain — report it to abuse@hostna.com with enough detail to reproduce it. Do not test against other customers, do not access data that is not yours, and do not run destructive or denial-of-service tests. A report made in good faith and within those limits will not be met with a complaint from us.