Overslaan naar inhoud

Policies

Acceptable Use PolicyAbuse PolicyCVD PolicySensible use Policy

Through this document CloudInventor B.V. (hereinafter CloudInventor) means to point out the responsibilities accompanying CloudInventor’s services to clients and users of CloudInventor’s services (hereinafter user[s]).

Acceptable Use Policy

VERSION 2026-01-01

last reviewed on 01-10-2026

When provisions of this Acceptable Use Policy are violated, CloudInventor can take measures, as defined in the Abuse Policy, to counter the continuation or repetition of the offence.

Purpose

The objectives of the Acceptable Use Policy include:

  • offering users safe and reliable internet services.
  • contributing to the open nature of the internet and the value of the internet as a platform for freedom of speech.
  • promoting the responsible use of the internet and counteracting practices that negatively affect the value of the internet.
  • protection of the rights, privacy and (internet) security of individuals and organizations.
  • indicating the rights and obligations, in addition to statutory rights and obligations, CloudInventor provides users with.

Rules of Conduct

  • The starting point is that users behave as proper and careful internet users and do not cause any inconvenience to the other users and/or networks on the internet.
  • The user shall follow reasonably formulated instructions from CloudInventor regarding the offered internet services
  • The user shall refrain from transmitting any material through or posting any material, of any form, on the internet, which can be regarded as illegal, unlawful, threatening, discriminatory, libellous, encouraging or triggering conducts that can be considered criminal, which could give civil liability to, or could otherwise result in a conflict with the Dutch law or international laws and regulations.
  • The user will do everything reasonably possible to prevent a computer virus or other malicious program from being posted on or transmitted through the internet or CloudInventor’s infrastructure.
  • The user will do everything reasonably possible to only connect systems with adequate security to the internet.
  • CloudInventor is extremely careful with their users’ confidential information (including passwords) and expect the same degree of care from its users.
  • The users will inform CloudInventor as soon as possible if any confidential data from or provided by CloudInventor has come into the hands of unauthorized parties, or in case of suspicion thereof.
  • The user will inform CloudInventor as soon as possible when unauthorized parties have had access to the services, or in case of suspicion thereof.

Abuse

The user shall refrain from any attempt, in any way whatsoever, to:

  • invade third-party systems or using third-party accounts without authorization.
  • gain access to data not intended for the user.
  • carry out any denial of service attacks.
  • intercept or manipulate third-party network traffic without consent.
  • send spam.
  • manipulate electronic messages (including email headers).

Revision

CloudInventor reserves the right to revise this Acceptable Use Policy unilaterally in accordance with social and technological developments.

Abuse Policy

VERSION 2026-01-01

last reviewed on 01-10-2026

Through this document CloudInventor B.V. (hereinafter CloudInventor) wants to point out the consequences of violating the Acceptable Use Policy (AUP) to clients and users of CloudInventor’s services (hereinafter user[s]). This document also describes how internet users can report a breach of the AUP at CloudInventor.

For reports of AUP violations regarding unlawful and/or illegal content on the internet, CloudInventor uses a separate Notice and Take Down (NTD) procedure, as described below. Below that, the procedure applicable to other types of AUP violations is stipulated.

Notice and Take Down

CloudInventor uses a specific Notice and Take Down (NTD) procedure for reporting violations of the Acceptable Use Policy regarding unlawful and/or illegal content on the internet. This procedure is based on, and thus endorses, the 2008 NTD code of conduct. We distinguish between reports by companies and individuals on the one hand, and actions, interventions and request from/by (government) authorities on the other. We use the NTD procedure described here to handle reports. In case of actions and requests of authorities, we act solely on the basis of a strong, legal underpinning such as a judgment or order. 

Submitting reports

o The detector should first contact the content provider to come to an agreement.

o A report to CloudInventor must contain the following information for it to be taken into consideration:

  • indication that the report concerns an NTD request, detectors contact information
  • description of the failed attempt to come to an agreement with the content provider
  • the data CloudInventor needs to assess the content, including at least the location of the illegal and/or criminal content (URL)
  • a description of why the content is illegal and/or criminal according to the detector
  • an explanation as to why CloudInventor is approached as the most suitable agent to act
  • an explicit indemnity against claims by the content provider as a result of taking measures for dealing with the report
  • the report should be mailed to abuse[at]cloudinventor.eu
  • the detector is responsible for a correct and complete notification

Handling reports

After CloudInventor has received the NTD report, CloudInventor will respond substantively within two working days of the notification and indicate which of the following options applies. CloudInventor may decide to ask a third party to evaluate the content of the report in cases that exposure to the content is suspected to be harmful to CloudInventor or the assessing employee. The personal data of the detector and content provider will not be provided to the third party in these cases. When providing information to the detector and/or content provider, the personal data of the detector or content provider will not be shared without permission. If either CloudInventor or the third party finds that the report is:

  • unmistakably illegal and/or undoubtedly punishable and CloudInventor knows that an investigation is important for the content to be accessible, CloudInventor will not proceed to make the content inaccessible. CloudInventor will inform the detector of this.
  • unmistakably illegal and/or undoubtedly punishable and there is an emergency that warrants no further delay, CloudInventor will immediately proceed to disabling the access to the content when proportionally possible. CloudInventor will inform the content provider and detector of this.

  • unmistakably illegal and/or undoubtedly punishable, CloudInventor will inform the content provider about the report and request to have the content made inaccessible within two working days. CloudInventor will inform the detector of this. If the content provider:

    • has made the content inaccessible within two working days, CloudInventor will inform the detector of this.
    • has not made the content inaccessible within two working days and informs CloudInventor of an investigation requiring the content to remain accessible, CloudInventor will not proceed to make the content inaccessible. CloudInventor will inform the detector of this.
    • has not made the content inaccessible within two working days, CloudInventor will do that when proportionally possible. CloudInventor will inform the content provider and detector of this.
  • not unmistakably illegal and/or undoubtedly punishable, CloudInventor will inform the content provider of the report. CloudInventor will inform the detector of this.

Other Abuse

Violations of the AUP other than unlawful and/or illegal content on the internet is subject to the following procedure.

Abuse with complaint

Submitting abuse complaints

A complaint is expected to contain the following information to be taken into consideration by CloudInventor:

•    an indication that the report is an abuse complaint

•    the contact information of the detector

•    a description of the abuse

•    the data CloudInventor requires to confirm the abuse, such as IP addresses, logs, etcetera

The abuse complaint should me emailed to abuse[at]cloudinventor.eu

Handling complaints

After CloudInventor has received the abuse complaint, CloudInventor will respond substantively within two working days. CloudInventor gives as much cooperation as possible from the complaining party to be able to investigate the complaint as best as possible. No confidential information will be provided. If a complaint proves to be justified, CloudInventor may decide to suspend a service to the causing party, until consultations between the affected user and a CloudInventor employee have been concluded. In case this consultation does not result in a satisfactory solution for CloudInventor, CloudInventor may decide to discontinue the service to the user and terminate the contract with immediate effect. 

Abuse without complaint

When CloudInventor registers conducts in conflict with the AUP, CloudInventor may decide to suspend a service to the causing party, until consultations between the affected user and a CloudInventor employee have been concluded. In case this consultation does not result in a satisfactory solution for CloudInventor, CloudInventor may decide to discontinue the service to the user and terminate the contract with immediate effect. 

Revision

CloudInventor reserves the right to revise this Abuse Policy unilaterally in accordance with social and technological developments.

CVD Policy

VERSION 2026-01-01

last reviewed on 01-10-2026

The purpose of this Coordinated Vulnerability Disclosure policy (CVD) is to contribute to the security of our ICT systems and those of others by sharing knowledge about vulnerabilities. We will share the knowledge with one or more potentially vulnerable organisations in order to arrive at a joint solution for the vulnerability found in cooperation with the reporter. In order to limit or prevent damage as much as possible, it is important that the organizations affected have sufficient time to resolve vulnerabilities have sufficient time to resolve vulnerabilities or protect systems. Our starting point is the disclosure of knowledge about the vulnerabilities after they have been resolved.

For which vulnerabilities can you file a CVD report?

You can report vulnerabilities to us that pose a risk to the security of a system. Examples are vulnerabilities that make it possible to bypass a login form or gain unintended access to a database or storage with personal data.

Not every anomaly in a system is a vulnerability. In general, the following anomalies do not lead to an unsafe situation. We therefore kindly request that you do not submit a CVD report to us for the anomalies listed below:

  • An anomaly that has no impact on the availability, integrity or confidentiality of information.
  • The availability of WordPress xmlrpc.php and alike functionality when its misuse is limited to a so-called ping-back denial-of-service.
  • The possibility of cross-site scripting on a static website or on a website on which no sensitive (user) information is processed.
  • The availability of version information via, for instance, an info.php file. A possible exception to this is when the version information shows that the system uses software with known vulnerabilities.
  • The absence of HTTP security headers as used by, for example, Cross-Origin Resource Sharing (CORS), unless this absence demonstrably leads to a security problem.

If you are unsure whether the anomaly you have found falls under one of the above exceptions, you can of course simply report it to us. We will then determine whether it is a vulnerability and take the appropriate follow-up actions.

How do you file a CVD report with us?

Send an e-mail to abuse[at]CloudInventor.eu with the title CVD report. In your report, describe as clearly as possible how the vulnerability can be reproduced, used or abused; this contributes to a rapid solution. Also, the IP address or the URL of the affected system and a description of the vulnerability is sufficient, but for more complex vulnerabilities more information may be required. We will contact you about this. Please use a valid e-mail address or telephone number so that we can contact you in case of questions. Communication via e-mail is preferred.

Make sure that:

  • Report it as soon as possible after discovering the vulnerability.
  • Do not share the information about the security problem with others until you hear from us whether it has been resolved.
  • You use the knowledge of the security problem responsibly, for example, by not taking any action that goes beyond what is necessary to prove the security problem.

What should you not do?

Always avoid the following actions:

  • Placing malware.
  • Copying, changing or deleting data in a system.
  • Making changes to the system.
  • Repeatedly accessing the system or sharing access with others.
  • Using brute force to gain access to a system.
  • Using denial-of-service or social engineering.

Handling reports

After CloudInventor has received the CVD report, CloudInventor will respond substantively within two working days of the notification.

The fundamentals of our CVD policy

If you make the report according to the procedure, we have no reason to attach legal consequences for your report. We will treat your report as confidential and will not share personal data with third parties without your permission, unless required to do so by law or court order. Only with your permission will we mention your name as the discoverer of the reported vulnerability. We will send you a confirmation of receipt within one working day. We will respond to your report within three working days with an assessment of the report. We will keep you informed of the progress in resolving the issue. CloudInventor aims to solve your reported security problem in a system within 60 days at the latest. After solving the problem, we will decide if and how it will be published. CloudInventor may offer a reward to thank you for your help, depending on the seriousness of the security problem and the quality of the report, this reward can vary from a T-shirt to gift vouchers. It must be a serious security problem, as yet unknown to CloudInventor.

Revision

CloudInventor reserves the right to revise this CVD Policy unilaterally in accordance with social and technological developments.

Sensible use Policy

VERSION 2026-01-01

last reviewed on 01-10-2026

Our Sensible Use Policy sets out what specific products are designed for. ‘Sensible’, refers to the wisest use of the service. This lets you determine whether additional measures need to be taken to secure your data so that you can meet GDPR guidelines.

When reading this policy it is important to understand that it refers to the systems we manage. Settings and configurations that you may change yourself are not covered by this policy.

The following applies to all services:

  • The CloudInventor policies used to manage these services can be found here: https://www.cloudinventor.eu/policies
  • Equipment is in Security Class 2 data centres;
  • Data is stored in the Netherlands or Germany

Explanation of the items:

  • Purpose: Here is a description of what we consider the product suitable for;
  • Types of personal data: The types of personal data the security is designed for;
  • Security: The way data can be secured. This does not mean that it is also secured in this way by default;
  • Updates: The way updates are performed;
  • Migration: In what format is it stored, what are the tools to migrate;
  • Note: An explanation.


SaaS: Overs8

Purpose: 

Overs8 SaaS solution offers different functionalities each with a different pupose

Overs8 Sales Director

Purpose: 

Keeping track and sefaguarding subscriptions and prices

Types of personal data:

All types of data, other than sensitive personal data .

Security:

  • Each instance runs on its own virtual environment;
  • Connections between client and Overs8 Sales Director are secured by SSL;
  • 2FO can be enabled (setting);
  • Logging of activities (create, modify, delete) is enabled;
  • Brute force security is enabled;
  • Password policy (minimum number of characters, prohibited generic passwords, required upper and lower case letters, required digits, required special characters) is enforced;
  • Data is backed up daily with retention of 7 days;

Updates:

Updating of the OS, services and software is performed at leas once a month or ASAP in case of critical vurnabilities.

Migration:

Data can be exported by us in the used database format (MySQL) or CSV. Since the software supplies the structure, we are not able to deliver structured data in an export.


SaaS: Nextcloud

Purpose: 

Storing and using files for daily use. 

Synchronising this data with devices.

Types of personal data:

With client-side encryption: All types of data. 
Without client-side encryption: All types of data, other than sensitive personal data .

Security:

  • Each instance runs on its own virtual environment;
  • Connections between client and Nextcloud are secured by SSL;
  • Data can be stored in encrypted form (setting);
  • 2FO can be enabled (setting);
  • Version management is on by default (setting). Default settings of Nextcloud are used;
  • Recycle bin is on by default (setting). Default recycle bin of Nextcloud are used;
  • Logging of activities (create, modify, delete) (setting);
  • Brute force security can be switched on by the customer;
  • User-defined password policy (minimum number of characters, prohibited generic passwords, required upper and lower case letters, required digits, required special characters);
  • List of devices with access to files;
  • Data is backed up daily with retention of 7 days;
  • Files that are synchronised to a device must be secured on/by the device.

Updates:

Updating of the OS, services and software is performed at leas once a month or ASAP in case of critical vurnabilities.

Migration:

Files can be copied via drag and drop, webDAV and synctool. For other data to be usable, you need an Nextcloud instance. This software is publicly available and can run on Debian and alike.


SaaS: Kerio Connect

Purpose: 

Saving and synchronising email, calendars, contacts, tasks and notes for daily use.

Synchronising this data with devices.

Types of personal data:

Name and contact data, IP addresses and other personally identifiable information other than legal documents and personal data .

Security:

  • Connections between the client and the service can be secured by forcing the use of SSL (setting);
  • Passwords can be saved in heavily secured SHA format (setting).
  • Recycle bin is on by default. Retention can be set per domain and per user.
  • Automatic clearing of items older than a configurable number of days for the following folders: recycling bin, spam/junk, sent items;
  • Automatic clearing of all items older than a configurable number of days, with the exception of contacts and notes;
  • Logging of all activities (creating, modifying, move, deleting, receiving and sending) (setting);
  • Log retention (setting);
  • Brute force security;
  • Enforcable password policy (minimum 8 characters, minimum 3 types of characters such as lowercase, uppercase, numbers, special characters, and may not contain any parts of the account information);
  • List of devices that have access to the data;
  • Extensive filtering possible;
  • Data is backed up daily with a 7-day retention;
  • Files that are synchronised to a device must be secured on/by the device.

Updates:

Updating of the OS, services and software is performed at leas once a month or ASAP in case of critical vurnabilities.

Migration:

Mail can be migrated via IMAP and EAS. Calendars via calDAV and EAS, addressbooks via carDAV en EAS, Notes and taks via EAS. To use the full functionality like this service supplies, than you need a server with Kerio Connect. This can run on Debian and alike.


Shared web/application hosting

Purpose: 

Hosting content.

Types of personal data:

Name and contact data, IP addresses and other personally identifiable information other than legal documents and personal data.

Security:

  • Every customer has their own vhost;
  • Processes in that vhost are executed on behalf of the customer’s user;
  • Connections between the client and the service can be secured by forcing the use of SSL (can be requested);
  • Connections from the client for FTP data are secured by SFTP;
  • Connections between client and phpMyadmin are secured by SSL;
  • Data is backed up once (Purpose: disaster recovery);

Updates:

Updating of the OS, services and software is performed at leas once a month or ASAP in case of critical vurnabilities.

Migration:

Files can be copied via SFTP. The database can be exported via phpMyAdmin or dumped via the supplies shell access. 

Note:

The above relates to the hosting platform itself. In your website you determine which data can actually be stored. It is also up to you to make sure that your website is fully up to date.


VPS

Purpose: 

To have virtual hardware (CPU, memory, storage) available

Types of personal data:

All types of data

Security:

  • The separation of virtual hardware is controlled by the hypervisor (hardware emulator);
  • Data is backed up daily with a 7-day retention or optional 6 months;

Updates:

Updating of the OS, services and software is performed manually in accordance with the fixed maintenance schedule.

Migration:

If we supply a VPS, you will be the one placing content on it. We do not control how you do that and what protocosl you use. Therefore we can’t know how the data IN the VPS can be migrated. We can however supply you with an image suited for Proxmox or a raw image.

Note:

The above relates to the platform on which the VPS is running. You determine which operating system, functionalities and security are applied to the VPS.


Private Cloud/Private Cluster

Purpose: 

To have a hypervisor and storage available;

Types of personal data:

All types of data

Security:

  • The separation of virtual hardware is controlled by the hypervisor (hardware emulator);
  • Connections between client and administration console are forced to be secured by SSL;

Updates:

Updating of the OS, services and software is performed at leas once a month or ASAP in case of critical vurnabilities.

Migration:

If you run this service on hardware owned by you, you can pickup the entire cluster with all the data and functionality. If you use this service as an IaaS, we can supply you with raw disk images suitable for Proxmox that can be converted to other hypervisors.

Note:

The above relates to the platform on which the hypervisor is running. You determine which operating system, functionalities and security is running on that hypervisor.


Proxmox Backup Server

Purpose:

Creating backups to a Proxmox Backup Server cloud

Types of personal data:

All types of data.

Security:

  • Proxmox VE encrypts data with EAS 256 before sending it to our service.
  • Connections between client and FilesOnline.eu are secured by SSL;
  • 2FO can be enabled (setting);
  • Retention can be enabled and is customisable;
  • Data is stored in Europe.

Migration:

Since backups are encrypted on the source, we can’t read the content of these backups. Therefore we can only supply the datastore. If you want to use the functionality, you need a Proxmox Backup Server. That can be a VPS of Physical server with that software. This software is publicly available and can run on Debian and alike. 

Updates:

Updating of the OS, services and software is performed at leas once a month or ASAP in case of critical vurnabilities.