Last Revised: 2026-08-18 09:37

INFRASTRUCTURE CONSTRAINTS & SECURITY BASELINE

Preamble & Regulatory Framework

This document ("Infrastructure Constraints & Security Baseline" / "DOC-012") defines the mandatory technical specifications, operational limits, resource isolation parameters, four-tier perimeter security architecture (L1–L4), suspension protocols, and the cybersecurity incident response framework pursuant to Directive (EU) 2022/2555 (NIS2) across all services provided by Prootzos Online.

This document constitutes an integral part of the General Terms of Service (DOC-001) and legally binds every Client or User of the infrastructure. Terms utilized herein shall be interpreted strictly in accordance with the Common Definitions Registry (DOC-002).

Article 1: Infrastructure Architecture & Interface Separation

1.1. Infrastructure Stack, Operating System & EU Data Sovereignty

The infrastructure of Prootzos Online operates exclusively on Debian Linux (LTS), utilizing a hybrid web server stack (Apache / Nginx) and relational database management systems (MariaDB, MySQL, PostgreSQL).
EU Hosting & Data Sovereignty: All physical nodes, virtual machines, primary storage volumes, and Disaster Recovery backup repositories are hosted exclusively in certified Data Centers located within the European Economic Area (EEA/Greece/EU), strictly precluding cross-border data transfers to third countries lacking an adequacy decision (Chapter V GDPR).
Prohibition of Third-Party Packages: The installation of ad-hoc or unauthorized external software packages, compiled kernel modules (DKMS), or third-party repositories outside Provider-certified baseline templates is strictly prohibited.

1.2. Virtualization Layer (Proxmox VE) & Non-Refundable Setup Fees

For Managed VPS (Virtual Machines), hypervisor management is executed on the Proxmox VE virtualization platform.
Client management of virtual machines is strictly confined to basic Start, Stop, Reboot, and Usage Stats operations via the integrated module within the Controller.
Exclusion of Hypervisor Access: Direct access to Proxmox Console/VNC, mounting custom ISO images, configuring virtual networks (VLANs/SDN), or altering Software-Defined Storage at the hypervisor level is strictly excluded.
Non-Refundable Setup Fees: Every new provisioning order or re-initialization (re-provisioning) of a Managed VPS or Managed Dedicated Server is subject to a mandatory, non-refundable Setup Fee pursuant to DOC-011, covering engineering resource allocation for initial deployment and security hardening.

1.3. Strict Interface Separation & Data Retention

Client Area (WHMCS): The exclusive portal for commercial account administration, billing, domain management, SSL certificate orders, Support Ticket submission, Knowledgebase access, and Network Status monitoring.
Data Retention Automation: Data retention within the Client Area is governed by automated purging and anonymization schedules for inactive accounts, cancelled orders, and closed tickets (Article 5(1)(e) GDPR), while preserving statutory tax record retention obligations (DOC-005, DOC-011).
No One-Click Restore: The Client Area does not provide automated self-service data restoration (No automated one-click restore).
Hosting Controller («Controller» / ISPConfig): The sole authorized interface for managing technical hosting operations (Websites, FTP/sFTP users, Databases, Mailboxes, DNS zones, and CRON jobs).
Local Snapshots: Local snapshot creation and restoration are executed exclusively via the Controller and consume storage space from the Client’s allocated Storage Quota (DOC-010).

Article 2: Resource Isolation, cgroups & Upgrades

2.1. Kernel-Level cgroups v2 Resource Isolation

To ensure server stability and prevent service degradation caused by neighbouring users (Noisy Neighbor phenomenon), all Shared Hosting environments strictly enforce resource limits via Linux Control Groups (cgroups v2).

Governed Resources: Processor capacity allocation (CPU Shares / Quotas), active physical memory (RAM Allocation / Swap Limits), disk input/output throughput (Disk I/O / IOPS), and maximum concurrent process limits (Nproc limits).
Client Visibility: The Client is granted visibility within the Controller strictly over Storage Quota and Bandwidth/Traffic Quota. CPU, RAM, and IOPS parameters are configured and enforced at the kernel layer.

2.2. Throttling & Burst Management Policy

Processes exceeding standard safety thresholds for a continuous duration exceeding ninety (90) seconds (Sustained Burst) are automatically downgraded in process scheduling and I/O priority (nice / ionice).
If severe memory exhaustion persists that jeopardizes node stability, responsible processes are terminated automatically by the operating system’s Out-Of-Memory Killer (OOM Killer).

2.3. Quota Exhaustion & Prorated Billing Upgrades

Storage Quota (100%): Triggers an automated lock preventing file writes, database inserts, and rejects incoming emails (Mailbox Full bounce).
Traffic Quota (100%): Triggers an automated temporary suspension of web traffic (HTTP 509 Bandwidth Limit Exceeded response) until the start of the next billing cycle or package upgrade.
Prorated Billing Upgrade Clause: Upgrading to a larger hosting plan via the Client Area is provisioned immediately upon settlement of the prorated difference for the remainder of the current billing cycle. Subsequent downgrades take effect in the next billing cycle without cash refunds, pursuant to DOC-011.

Article 3: Web Server Management & vHost Options Tab Policy

+-----------------------------------------------------------------------------------+
|                        vHOST MANAGEMENT & RESPONSIBILITY MATRIX                   |
+--------------------------+-------------------+------------------------------------+
| Service Tier             | "Options" Tab     | Directives & Recovery Resourcing   |
+--------------------------+-------------------+------------------------------------+
| Shared Hosting           | LOCKED            | Provider (Predefined Template)     |
| Managed VPS (VM)         | ACTIVE            | Client (Directives) / Pro Service  |
| Managed Dedicated Server | ACTIVE            | Client (Directives) / Pro Service  |
+--------------------------+-------------------+------------------------------------+

3.1. Shared Hosting Environment

In Shared Hosting environments, all virtual host (vHost) configurations for Apache, Nginx, and PHP are strictly standardized and secured.

The configuration tab (vHost Options Tab) within the Controller is fully disabled and locked.
Manual insertion of custom directives, module overrides, or global header manipulations by the Client is prohibited.

3.2. Managed VPS & Managed Dedicated Servers

On Managed VPS and Managed Dedicated Server tiers, the vHost Options tab remains active within the Controller, permitting the injection of custom directives:

Custom Apache Directives (e.g., Module Rules, Custom Headers).
Custom Nginx Directives (e.g., Location Blocks, Microcaching Rules, Custom Proxy Pass).
Custom PHP Directives (per-vHost php.ini customization).

3.3. Liability Allocation & Billable Crash Recovery

Client Sole Responsibility: The Client bears sole technical and legal responsibility for the syntax, validity, and operational impact of any directives entered into the Options tab.
SLA Exclusion: In the event that erroneous syntax causes failure to restart, reload errors, or a complete daemon crash (Apache/Nginx), such incident shall not constitute an infrastructure failure and is expressly excluded from SLA uptime calculations (DOC-004).
Billable Professional Service: Investigating, debugging, purging invalid directives, and restoring the web daemon to operational status is performed exclusively as a Billable Professional Service (DOC-009), subject to a minimum charge of one (1) engineering hour pursuant to DOC-011.

Article 4: Access Control, Authentication & Privileges

4.1. File System Access (FTP / SSH / sFTP)

Chrooted FTP: Provided strictly chrooted within the specific website root path (/var/www/clients/clientX/webY).
Jailed SSH / sFTP: Where SSH or sFTP shell access is provisioned, it operates strictly within an isolated Jailed Shell environment.
Prohibition of Root Shell: Under no circumstances is administrative superuser access (Full Root Shell / sudo privilege) granted, including on Managed Dedicated Servers.
Prohibition of Root Cron Jobs: All scheduled tasks run strictly under unprivileged isolated web user permissions (web_jail) via the Controller.

4.2. Database Privileges

Database users are provisioned exclusively through the Controller with standard schema and data manipulation privileges (DML/DDL).
Administrative superuser grants (SUPER, GRANT OPTION, PROCESS, SHUTDOWN, or RELOAD) are strictly prohibited.
Remote Database Access: Direct exposure of database ports to the public Internet without encrypted tunneling (SSL/TLS or SSH Tunnel) is strictly prohibited.

Article 5: Email Services & Rspamd Spam Filtering

5.1. Rspamd Spam Filtering Policies

Email security is managed via the Rspamd filtering engine.
The Client may select predefined filtering sensitivity levels (Spam Policies) per domain or mailbox exclusively via the Controller graphical user interface.
Prohibition of Custom Rules: Manual creation of custom regex or LUA filtering rules by the Client is unsupported and prohibited.

5.2. Authentication Protocols (DKIM, DMARC, SPF, Greylisting)

DKIM: Key generation and selector management are handled exclusively within the dedicated section of the Controller.
DMARC & SPF: Standard DNS records are supported. Advanced strict enforcement tuning (DMARC p=reject alignment) is provided as a Professional Service (DOC-009).
Greylisting: Implemented server-wide and configurable per domain/user via the Controller.

5.3. Bulk Mail Prohibition & Daemon Rate Limiting

Using Prootzos Online mail infrastructure for outbound bulk messaging (Mass Mailings), newsletters, cold outreach, or unsolicited campaigns is strictly prohibited.
Daemon Rate Limiting: Strict hourly sending limits are enforced at the Postfix daemon and Rspamd policy levels per mailbox and domain to prevent mail queue exhaustion and IP pool blacklisting. Breaches trigger immediate service suspension pursuant to DOC-003 (AUP).

Article 6: SSL/TLS Certificates & DNS Management

6.1. Automated Let's Encrypt SSL & ACME Rate Limits

The Controller provides automated issuance and renewal of Let's Encrypt SSL certificates via the ACME protocol (HTTP-01 Validation).
DNS & CAA Prerequisites: Successful issuance requires that domain DNS records (A/AAAA) point accurately to the Prootzos Online server IP, that no restrictive DNS CAA records block Let's Encrypt, and that access to /.well-known/acme-challenge/ is uninhibited.
ACME Cooldown Disclaimer: Repeated validation failures resulting from incorrect external DNS settings that trigger an ACME rate limit (block) by Let's Encrypt do not constitute a Provider infrastructure fault and require waiting for the mandatory cooldown window to expire.

6.2. Commercial SSL Certificates

Prootzos Online Commercial SSL: Certificates purchased via the Client Area are installed by the Client with free validation and file issuance assistance. Application-level rewriting or custom .htaccess tuning remains the Client's responsibility or is billed as a Professional Service (DOC-009).
Third-Party SSL: Certificates procured from external authorities must be installed by the Client. Installation assistance by the Provider is billable under DOC-009.

6.3. DNS Service Constraints

Free DNS Eligibility Scope: Complimentary DNS zone management is provided exclusively for domain names actively registered with Prootzos Online or linked to an active hosting plan.
Transferring a domain away or terminating the hosting plan automatically terminates complimentary DNS hosting.
DNSSEC: DNSSEC is not provided as a standard/automated feature. Implementation of advanced DNSSEC architectures is available exclusively via DOC-009.

Article 7: Multi-Tier Perimeter Security (L1–L4) & Suspension Framework

7.1. Four-Tier Defense Architecture

 [PUBLIC INTERNET TRAFFIC]
            │
            ▼
 ┌─────────────────────────────────────────────────────────┐
 │ TIER 1 (L1): Datacenter Edge DDoS Mitigation & Scrub    │
 └────────────────────────┬────────────────────────────────┘
                          │
                          ▼
 ┌─────────────────────────────────────────────────────────┐
 │ TIER 2 (L2): Proxmox VE Hypervisor Hardware Firewall    │
 └────────────────────────┬────────────────────────────────┘
                          │
                          ▼
 ┌─────────────────────────────────────────────────────────┐
 │ TIER 3 (L3): Fail2ban Dynamic IPS / Host Intrusion      │
 └────────────────────────┬────────────────────────────────┘
                          │
                          ▼
 ┌─────────────────────────────────────────────────────────┐
 │ TIER 4 (L4): Uncomplicated Firewall (ufw) Host Rules    │
 └────────────────────────┬────────────────────────────────┘
                          │
                          ▼
 [SECURE INTERNAL INFRASTRUCTURE / ISOLATED SERVICES]

Tier 1 (L1 - Datacenter Edge): Upstream edge protection for volumetric DDoS mitigation and traffic scrubbing.
Tier 2 (L2 - Hypervisor Firewall): Stateful filtering at the Proxmox VE hypervisor layer governing virtual bridge traffic.
Tier 3 (L3 - Dynamic Host Defense): fail2ban automated dynamic IP blocking analyzing logs in real time against brute-force attacks across SSH, FTP, Mail, and Web auth endpoints.
Tier 4 (L4 - Local Host Firewall): Host-level firewall (ufw / nftables) on each node with an absolute Default Deny policy.

7.2. Suspension Mechanisms & Immediate Abuse Quarantine Protocol

+-----------------------------------------------------------------------------------+
|                        SUSPENSION & QUARANTINE MECHANISMS                         |
+----------------------+---------------------------+--------------------------------+
| Mechanism Type       | Enforcement Layer         | Trigger & Governance           |
+----------------------+---------------------------+--------------------------------+
| Billing Suspension   | Client Area (WHMCS)       | Overdue invoices (DOC-011)     |
| Abuse Quarantine     | Infrastructure / Host FW  | Active security threat / Abuse |
+----------------------+---------------------------+--------------------------------+

7.2.1. Commercial Suspension (Billing Suspension)

Executed automatically via the Client Area (WHMCS) upon reaching invoice overdue thresholds, temporarily disabling UI access and web/mail routing pursuant to DOC-011.

7.2.2. Technical Quarantine (Abuse Quarantine Protocol)

Enacted immediately and asynchronously at the Infrastructure / Controller / Firewall (L1–L4) levels, without prior notice, regardless of account commercial standing, in cases of:

Outbound Abuse: DoS/DDoS participation, port scanning, or outbound exploit attacks.
Outbound Spam: High-volume spamming or triggers resulting in RBL blacklisting.
Malicious Content: Phishing pages, command-and-control (C2) nodes, or malware distribution.
Crypto Mining: Unauthorized mining scripts or binary execution.
Security Breaches: Attempts to bypass L1–L4 firewalls or execute privilege escalation.

7.2.3. Neutral Suspension Notice & Liability Waiver

Data Protection (Neutral Notice): Public suspension notifications are strictly restricted to neutral technical responses (e.g., HTTP 403/503 Forbidden or generic landing pages), without displaying personal, commercial, or abuse details.
Limitation of Liability: The Provider shall bear no civil or criminal liability for any direct, indirect, incidental, or consequential damages (including loss of business, revenue, or data) incurred by the Client or third parties arising from the good-faith enforcement of the Immediate Abuse Quarantine Protocol.

Article 8: Incident Response & NIS2 Directive Compliance

8.1. Scope & Monitoring Architecture

Prootzos Online enforces technical and organizational cybersecurity risk management measures compliant with Directive (EU) 2022/2555 (NIS2), backed by continuous SIEM and monitoring systems (Monit / Graylog).

8.2. Incident Notification Timelines & GDPR Segregation

[T0: Incident Detection]
       │
       ▼ (Within 24 Hours)
 ┌────────────────────────────────────────────────────────────────────────┐
 │ EARLY WARNING:                                                         │
 │ Notification to CSIRT/EETT and affected B2B Clients.                   │
 └────────────────────────────────┬───────────────────────────────────────┘
                                  │
                                  ▼ (Within 72 Hours)
 ┌────────────────────────────────────────────────────────────────────────┐
 │ INCIDENT NOTIFICATION:                                                 │
 │ Initial severity assessment, impact evaluation, mitigation measures.   │
 └────────────────────────────────┬───────────────────────────────────────┘
                                  │
                                  ▼ (Within 1 Month)
 ┌────────────────────────────────────────────────────────────────────────┐
 │ FINAL COMPREHENSIVE REPORT:                                            │
 │ Root Cause Analysis (RCA), technical impact, definitive hardening.    │
 └────────────────────────────────────────────────────────────────────────┘

T0 — Detection: Timestamp of confirmed incident identification.
T0 + 24 Hours (Early Warning): Submission of an early warning to CSIRT/EETT and affected Clients indicating unlawful intent or cross-border impact.
T0 + 72 Hours (Incident Notification): Update providing severity evaluation, Indicators of Compromise (IoCs), and initial mitigation status.
T0 + 1 Month (Final Report): Detailed Final Report containing comprehensive Root Cause Analysis (RCA), definitive impact metrics, and implemented remediation.
Segregation from GDPR Breach Notification: This timeline governs network cybersecurity incidents (NIS2). If an incident involves a personal data breach, GDPR notification procedures under DOC-005 and DOC-007 apply concurrently (notifying the DPA within 72 hours under GDPR Articles 33 & 34).

Article 9: Cookie Governance & Google Tag Manager

9.1. GDPR & ePrivacy Compliance

All Prootzos Online websites and digital properties comply fully with GDPR (EU 2016/679) and the ePrivacy Directive (2002/58/EC as amended).

9.2. Google Consent Mode v2 & Prior Consent (Opt-in)

Google Tag Manager (GTM) deployment operates strictly under Google Consent Mode v2.
Prior Consent (Opt-in): No non-essential cookies, tracking scripts, or analytics tags fire prior to the explicit, affirmative consent of the user via the Consent Management Platform (CMP).
No Pre-Ticked Boxes & Right to Withdraw: The CMP operates strictly without pre-ticked checkboxes. Users maintain the absolute right to modify or revoke consent at any time via the persistent cookie settings module on the website (DOC-006).

Article 10: Scope Creep Protection & Professional Services

The following items are expressly defined as EXCLUDED from Core Managed Services and are provided solely as Billable Professional Services (DOC-009):

vHost Options Crash Recovery: Rectifying web server failures resulting from invalid Apache/Nginx/PHP directives entered by the Client (Minimum 1 hour billable charge).
Advanced DNS Engineering: DNSSEC configuration, Failover DNS profiles, GeoDNS, and Anycast routing.
High Availability & Clustering: Designing and deploying HA clusters, load balancers, and database replication.
Performance Tuning: Advanced tuning of MariaDB/PostgreSQL, OPcache, Nginx FastCGI microcaching, and Redis/Memcached integration.
Malware Remediation: Inspecting, cleaning, and hardening compromised client applications and databases.
Website Migration Policy:

Complimentary Onboarding Courtesy: Migration of up to three (3) websites (total volume up to 5 GB), valid exclusively within the first thirty (30) days of a new subscription, provided strictly on an "as-is" basis excluding custom code/plugin debugging.
Billable Migrations: Migrations exceeding 3 sites or 5 GB, subsequent migration requests, or full-server migrations (from ISPConfig 2/3, Plesk, cPanel, etc.) are billable Professional Services.

Email Deliverability Consulting: Blacklist remediation due to client sending practices, strict DMARC/BIMI record alignment, and RBL delisting coordination.

Article 11: Cross-References & Document Hierarchy

This document ("DOC-012") operates supplementarily and is subordinate to the overall regulatory hierarchy of Prootzos Online:

DOC-001: General Terms of Service (Master Terms)
DOC-002: Common Definitions Registry (SSOT)
DOC-003: Acceptable Use Policy (AUP)
DOC-004: Support Policy & Service Level Agreement (SLA)
DOC-005: Privacy Policy
DOC-006: Cookie Policy & Tracking Technologies
DOC-007: Data Processing Agreement (DPA)
DOC-008: Domain Registration Policy
DOC-009: Professional & Custom Services Agreement
DOC-010: Backup, Retention & Disaster Recovery Policy
DOC-011: Billing, Cancellation & Credit Policy

Article 12: Final Provisions & Enforceability

12.1. Supremacy of the Greek Master Version

This document is executed in the Greek language, which represents the sole primary, official, and legally binding version (Master Version). This English translation is provided as an accurate reflection for operational convenience. In the event of any interpretive discrepancies, the Greek text shall prevail unconditionally.

12.2. Modification Procedures

Major Changes (vX.0): Material technical or operational modifications shall be notified thirty (30) days in advance via email or announcement in the Client Area.
Minor / Patch Changes (v1.X): Routine technical adjustments, security baseline updates, or clarifications take effect immediately upon publication.

12.3. Governing Law & Dispute Resolution

This framework is governed exclusively by Greek Law and European Union Law (GDPR, NIS2, ePrivacy). Any dispute arising out of or in connection with this document shall be subject to the exclusive jurisdiction of the competent Courts of Pyrgos, Ilia, Greece.