Terms of Service & Master Service Agreement (MSA)

1. Scope and Parties

These Terms of Service ("Agreement", "ToS") and Master Service Agreement ("MSA") constitute a legally binding agreement between:

Okustera Cloud
Sovereign Cloud Platform
Governed under European Union law
("Okustera Cloud", "Provider", "we", "us")

and the enterprise, legal entity, organization, or professional developer accessing or utilizing the Okustera Cloud Operating System, Cloud Console, REST APIs, CLI tooling, and hosted infrastructure services ("Customer", "Tenant", "you"). This Agreement applies exclusively to commercial, enterprise (B2B), and institutional relationships.

2. Account Registration & Credential Security

To provision cloud resources, the Customer must maintain an authenticated organizational tenant account:

Accurate Corporate Profile: The Customer warrants that all information provided during tenant registration is truthful, complete, and legally authorized.
Credential Protection: The Customer is solely responsible for maintaining the confidentiality of administrative credentials, API access tokens, SSH private keys, and OpenStack Application Credentials.
Multi-Factor Authentication (MFA): Customers are strongly advised and, for high-privilege roles, mandated to enforce hardware-backed MFA or TOTP across all operator identities.
Notification Obligation: Customer must notify Okustera immediately at [email protected] upon suspecting any compromise of tenant credentials.

3. Acceptable Use Policy (AUP)

The Okustera platform is dedicated strictly to lawful enterprise compute, data management, distributed storage, and AI inference workloads. The following abusive, malicious, or disruptive activities are strictly prohibited:

Unauthorized Cryptographic Mining: Proof-of-work cryptocurrency mining is prohibited across shared or virtualized compute instances without prior written approval.
Network Attacks & Disruptive Workloads: Initiating or participating in Distributed Denial of Service (DDoS) attacks, unauthorized port scanning, vulnerability fuzzing of neighboring tenants or third parties, network spoofing, or packet flooding.
Malware & Command-and-Control: Hosting, distributing, or executing ransomware, botnets, keyloggers, Trojan horses, exploit kits, or command-and-control (C2) infrastructure.
Spam & Unsolicited Communication: Operating open email relays, sending bulk unsolicited marketing emails (spam), or engaging in phishing / social engineering operations.
Illegal & Harmful Content: Storing, transmitting, or generating child sexual abuse material (CSAM), terrorist propaganda, incitement to violence, or unauthorized copyrighted materials.

Immediate Suspension Right: Okustera reserves the right to immediately isolate, throttle, or suspend tenant instances without prior notice if an active security incident poses an immediate threat to platform stability, host hardware, or external networks.

4. Service Level Commitments & Maintenance

Okustera provides enterprise service commitments for production subscription tiers:

Platform Component	Availability Target	Architectural Safeguard
Control Plane APIs (Nova, Keystone, CAPI)	99.95% Monthly Uptime	Triple-redundant control plane nodes with Keepalived virtual VIPs and ProxySQL clustering.
Ceph NVMe Distributed Storage	99.99% Durability	3x synchronous replication across distinct physical failure domains and automatic self-healing.
Clustered Databases (CloudNativePG / Galera)	High Availability	Sub-second Recovery Point Objective (RPO) with automated Raft consensus failover.

Scheduled Maintenance: Routine infrastructure patching and kernel updates are performed with live VM migration wherever possible. In the event of required maintenance impacting customer workloads, Okustera provides a minimum of forty-eight (48) hours advance notice via email and status portal notifications.

5. Pricing, Billing & 0€ Egress Commitment

Cloud infrastructure usage is metered according to the official price catalog published in your tenant dashboard:

Zero Egress Tax Policy: Okustera does not impose punitive bandwidth egress fees. Standard outbound Internet traffic is provided at 0€ / GB within fair usage boundaries corresponding to provisioned compute tier bandwidth capacity.
Payment Terms: Invoices are issued monthly in Euros (€) and are payable within thirty (30) calendar days from invoice date unless alternative contractual terms are agreed in writing.
Taxes: All listed prices are net prices and do not include statutory Value Added Tax (VAT / USt), which is added at the statutory rate where applicable.

6. Formalized Shared Responsibility Model

In cloud environments, security, compliance, and disaster recovery are a shared endeavor between the infrastructure provider and the tenant. This section formalizes the binding legal and operational boundaries:

Domain	Okustera Responsibility (Provider)	Tenant Responsibility (Customer)
Physical & Facilities	Datacenter perimeter, biometric access, N+1 HVAC cooling, redundant dual grid power, physical hardware lifecycle.	None (Managed by Okustera)
Hypervisor & Host Kernel	KVM hypervisor hardening, host OS security updates, CPU microcode patches, physical memory scrubbers.	Guest OS kernel configuration, SSH keys, tenant software package updates.
Network Perimeter & VPC	Physical switch fabrics, anti-DDoS transit scrubbing, OVN Geneve encapsulation, core router uptime.	Security group rules, internal subnet topology, egress NAT firewalls, API access tokens.
Storage & Databases	Ceph NVMe storage pool durability, 3x block replication, underlying disk failure replacement.	Database schema design, database user permissions, off-site backup schedules, application queries.
Identity & Encryption Keys	Keystone IAM service availability, Barbican KMS service uptime, hardware token verification.	User role assignments, MFA enforcement, Customer-Managed Key (CMK) lifecycle and key rotation.
Workload Data & Compliance	Platform GDPR processor compliance (Art. 28), in-country EU data residency guarantees.	Lawfulness of data processing, content compliance, tenant-side encryption, application security.

Liability Demarcation: The Customer acknowledges and agrees that Okustera bears no liability for data loss, data breaches, or security incidents arising from Customer-managed responsibilities, including compromised tenant API keys, misconfigured security groups, unpatched guest operating systems, or failure to retain independent backups.

7. Data Ownership & Data Processing Agreement (DPA)

Customer Data Ownership: As between Customer and Okustera, Customer exclusively owns all rights, title, and interest in and to all data, files, software, and databases uploaded or processed within Customer tenant instances ("Customer Data"). Okustera claims zero intellectual property rights over Customer Data.

Data Processing Agreement: Where Customer Data includes personal data under the EU GDPR, the processing of such data is governed by the Okustera Data Processing Agreement (DPA) pursuant to Art. 28 GDPR, which is hereby incorporated by reference into this Agreement.

8. Warranty & Limitation of Liability

Okustera's liability shall be governed exclusively by the following provisions in accordance with German statutory law (§§ 305 ff. BGB):

Unlimited Liability: Okustera is liable without limitation in cases of intentional misconduct (Vorsatz), gross negligence (grobe Fahrlässigkeit), culpable injury to life, limb, or health, or under mandatory provisions of the German Product Liability Act (Produkthaftungsgesetz).

Slight Negligence (Essential Duties): In cases of slight negligence (einfache Fahrlässigkeit), Okustera shall only be liable for the breach of essential contractual duties (Kardinalpflichten)—duties whose fulfillment is essential to the proper performance of the contract and on whose compliance the Customer regularly relies. In such cases, liability is strictly limited to typically foreseeable damages.

Liability Cap: To the extent legally permissible, Okustera's aggregate financial liability for slight negligence under this Agreement shall not exceed the total amount of fees paid by Customer to Okustera in the twelve (12) months immediately preceding the event giving rise to liability.

Alpha / Beta & Free Tiers: Any preview, evaluation, sandbox, or developer tier services provided free of charge are provided strictly "AS IS" and without warranty, except in cases of fraudulent concealment of defects.

9. Term, Suspension & Termination

Ordinary Termination: Unless agreed otherwise in an enterprise order form, pay-as-you-go subscriptions may be terminated by either party at any time at the end of the current billing cycle.

Termination for Cause: Either party may terminate this Agreement immediately for cause (aus wichtigem Grund), specifically upon severe or repeated breach of the Acceptable Use Policy or persistent payment default.

Post-Termination Data Retrieval: Following termination, Customer will have a grace period of thirty (30) calendar days to export all virtual disks, S3 objects, and database dumps, after which Okustera securely deletes all tenant storage volumes pursuant to NIST SP 800-88 standards.

10. Governing Law, Place of Jurisdiction & Severability

Governing Law: This Agreement and all disputes arising out of or in connection with it shall be governed exclusively by the laws of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG).

Place of Jurisdiction: To the extent permitted by law (in particular where Customer is a merchant / Kaufmann), the exclusive place of jurisdiction for all disputes arising under or in connection with this Agreement shall be Berlin, Germany.

Severability: Should any provision of this Agreement be or become invalid or unenforceable, the validity of the remaining provisions shall not be affected. The invalid provision shall be replaced by a valid provision that most closely reflects the commercial intent of the parties.