ARCKIPEL Cloud Synergistic (ACS) Service Agreement

This Service Agreement ("Agreement") is made between Arckipel OÜ (an Estonian company based in Tallinn, hereafter "Provider" or "Arckipel") and the customer ("Customer") who subscribes to the ARCKIPEL Cloud Synergistic service (hereafter "ACS" or "the Service"). In this fully managed multi-cloud solution, Provider integrates and operates cloud infrastructure on behalf of Customer, using multiple public cloud providers (e.g. Google Cloud, Azure, OVH, etc.) and Provider's own servers. Customer agrees that ACS is a managed service: Provider will create and manage all necessary cloud accounts and resources, and Customer will not have direct administrative access to the underlying infrastructure. Customer entrusts Provider to handle provisioning, monitoring, security patching, backups, scaling, and all day‑to‑day operations. The Service includes (but is not limited to) the following features and modules:

Service Features and Modules

• IsleCompute: Flexible and scalable compute instances tailored to Customer's performance needs, capable of handling a variety of workloads.
• ReefOrchestrator: Kubernetes-based container orchestration for simplified deployment and management of containerized applications, ensuring flexibility and resilience.
• CurrentBalancer: A global load-balancing and traffic distribution system to maximize availability and distribute workload across resources.
• TideScaler: Automatic resource scaling (autoscaling) based on demand, ensuring efficient use of compute and reducing performance bottlenecks.
• LagoonStorage: Secure and durable object storage for files and data (similar to S3/Blob storage), with fast global access.
• CoralBlock: High-performance block storage volumes for compute instances, providing fast I/O for databases and applications.
• AtollBackup: Managed backup and restore service for critical data, with regular snapshots and recovery capabilities.
• HarborDB: Managed relational database service (e.g. MySQL/PostgreSQL) with automated scaling and maintenance.
• DriftDB: Scalable NoSQL (e.g. MongoDB, Cassandra) database service for large-scale or real-time data.
• LighthouseAnalytics: Data warehousing and analytics platform (ETL and OLAP) for processing large datasets and real-time reporting.
• CoveNet: Virtual Private Network (VPN) service for secure connections between on-premises and cloud networks, or between different cloud zones.
• NavigatorDNS: Fast, managed DNS hosting service for domain management with high availability.
• TideShield: Enhanced network security and firewall services (DDoS protection, intrusion filtering) with granular rules.
• WaveMail: Scalable secure email hosting and delivery service with advanced anti-spam/anti-virus filtering.
• ChannelQueue: Message queue/streaming service for reliable communication between distributed applications.
• BeaconNotify: Real-time notification/event service (pub/sub or push notifications) for critical alerts to applications.
• DriftlessFunctions: Serverless functions (event-driven compute) for on-demand execution without managing servers.
• HarborGateway: Secure API gateway for exposing Customer's services with rate limiting and authentication.
• SeabreezeCDN: Global Content Delivery Network to accelerate content and media delivery worldwide.
• OceanMind: Machine Learning platform for training and deploying large-scale AI models.
• TideWatch: Monitoring, logging, and performance management platform with real-time alerts and dashboards.
• CoveDefense: Advanced virtual firewall and network security appliance (formerly "CoveDefense", integrating soon into securis.ai).

These modules together form the ACS offering. Provider may add, remove or upgrade components over time as technology evolves.

Scope: Provider will deliver the chosen ACS modules and underlying infrastructure according to Customer's selected plan and requirements. Provider is responsible for all infrastructure management (servers, networking, storage, etc.) and software maintenance (OS updates, library patches, etc.) needed to operate the Service. Customer is responsible for its own application code, data, and correct configuration of any Customer-managed aspects. Customer's use of ACS is restricted to its internal business purposes and subject to compliance with this Agreement.

Term and Termination

Term

The initial term of this Agreement is twelve (12) months from the Effective Date (the "Initial Term"). After the Initial Term, this Agreement automatically renews for successive one-year periods unless a non-renewal notice is given. To terminate the Agreement after the Initial Term, either party must provide at least sixty (60) days' prior written notice before the desired termination date. Notice is counted from the first day of the calendar month following delivery of the notice. Example: if Customer gives notice on June 5, the first full month after notice is July, so the earliest termination date is September 1 (60 days after July 1). Likewise, if notice is given on July 2, termination would be effective October 1.

Termination for Convenience

Either party may terminate this Agreement for convenience (without cause) after the Initial Term by giving at least 60 days' written notice as above. This notice will take effect on the first day of the applicable month following the 60-day period. All fees owed up to the effective termination date remain payable, and no refunds will be given for partial months of service (prepaid fees remain non-refundable except as required by law).

Termination for Cause

Either party may terminate this Agreement immediately upon written notice if the other party materially breaches its obligations and fails to cure such breach within thirty (30) days after receiving written notice of the breach. For example, if Customer fails to pay undisputed fees when due (see Section 3), Provider may give notice and terminate if the amount remains unpaid after the cure period. Similarly, if Customer uses the Service in violation of law or this Agreement, Provider may terminate after 30 days if the violation is not remedied.

Immediate Suspension

Provider reserves the right to suspend or terminate the Service immediately (even without a cure period) if Customer's conduct threatens the security or operation of ACS, or if Customer fails to pay past-due invoices despite notice. Provider may also suspend the Service if Customer's account is in material breach of this Agreement.

Effect of Termination

Upon termination or expiration of this Agreement, Provider will disable Customer's access to ACS. Customer may retrieve or export its data from the Service for a limited time. After expiration/termination, Provider will retain any Customer Data for up to ninety (90) days to allow Customer to extract or transfer it, after which Provider will permanently delete all copies of Customer Data (including backups) from Provider's systems. Provider will confirm in writing when deletion is complete. Customer remains responsible for any fees due through the termination date.

Transition

If Customer requests, Provider will provide reasonable cooperation to transition services or data to a successor provider or to Customer's on‑premises systems. Customer acknowledges that ramp-down of resources and migration of data may require time (hence the 60-day notice), and agrees to work with Provider to ensure an orderly transition.

Fees and Payment

Resource-Based Tiered Pricing

Unlike most public cloud providers that calculate usage costs based on unpredictable metrics such as bandwidth consumption or per-second compute time, ACS follows a predictable, tiered pricing model based on actual resource load requirements.

Compute and Performance: Each application deployed on ACS is assigned to a predefined resource tier (e.g. based on CPU, RAM, and disk I/O thresholds). As long as the application remains within the performance limits of its current tier, the pricing remains fixed — regardless of traffic surges or number of user sessions. This offers a major benefit over traditional metered billing models, providing customers with cost predictability and operational stability.

Autoscaling Between Tiers: ACS monitors system performance and will automatically scale resources up or down when thresholds are crossed. However, tier changes only occur when sustained resource demand requires it, and customers will be notified before any billing tier upgrade is enacted. Likewise, if an application's resource usage drops below its current tier threshold, ACS may adjust the tier downward, reducing costs accordingly.

Storage Allocation: Data storage is also managed on a tiered basis, not strictly by volume but by performance impact. If the volume or structure of stored data begins to degrade service responsiveness, ACS will provision higher-capacity storage backends. This tier transition is not automatic; it is triggered by operational need and will be communicated in advance.

This pricing model ensures that customers are never billed more unless their infrastructure genuinely requires scaling, and provides a much more stable cost forecast compared to conventional usage-based models. Customers can clearly understand which tier they are in at any time, and billing only changes once explicitly confirmed by ACS.

Fees

Customer shall pay the fees for ACS as set forth in the applicable Order Form or pricing agreement. Fees may be monthly, per-use, or as otherwise agreed. Provider may adjust fees for renewal periods with written notice, but will not unilaterally increase prices during the Initial Term except for new services or mandatory cost increases (e.g. taxes or third-party fees). All fees are in Euros (EUR) and do not include any applicable taxes, duties or levies, which are the responsibility of Customer.

Invoicing and Due Date

Provider will invoice Customer monthly in arrears, typically at the beginning of each month for the previous month's usage. Each invoice is due and payable within five (5) days of the invoice date. Payment must be in cleared funds (e.g. bank transfer or approved credit card) to Provider's designated account. If payment is not received by the due date, interest will accrue on overdue amounts at the maximum rate permitted by Estonian law (but no less than 1% per month) until paid in full. Provider may suspend service in whole or part if any undisputed amount is more than 10 days overdue.

Auto-Pay Options

To avoid service interruptions, Customer may set up automated payments (e.g. credit card or SEPA direct debit) with Provider. If an automated payment fails, Provider will notify Customer to arrange immediate payment.

Expense Responsibility

Customer is responsible for its own costs of connecting to the Service (e.g. its own internet access charges or devices). Provider will not pay any of Customer's expenses unless expressly agreed in writing.

Taxes

All amounts payable under this Agreement are exclusive of taxes. Customer shall pay all taxes (other than taxes on Provider's net income) arising from this Agreement (including VAT, sales tax, etc.), unless Customer provides valid exemption documentation. If Provider is required to withhold or pay any taxes on Customer's behalf, Customer shall reimburse Provider for such amounts.

Service Level and Maintenance

Availability Guarantee

Provider will use commercially reasonable efforts to make ACS available 99.5% of each calendar month, excluding scheduled maintenance and factors beyond Provider's control. Uptime is measured by subtracting any downtime minutes from total monthly minutes, divided by total minutes. If the monthly availability percentage falls below 99.5%, Customer may submit a claim for a service credit (for example, a percentage refund on that month's fees) in accordance with Provider's SLA policy. (As a reference, other cloud providers often grant tiered credits: e.g. 5–10% credit if availability is between 95–99.5%.) This uptime commitment applies to the Service infrastructure; it does not cover Customer's own applications or Internet connectivity.

Downtime Exclusions

"Downtime" does not include periods when the Service is unavailable due to any of the following: (i) scheduled maintenance or upgrades (see below), (ii) Customer's own actions or any content transmitted by Customer's systems, (iii) force majeure events (unforeseeable disasters or events beyond Provider's control), or (iv) failures of third-party components outside Provider's direct control (for example, a public cloud provider's outage, underlying internet network failures, DNS issues, etc.). These exclusions mean that transient issues caused by factors outside Provider's reasonable control are not counted against the uptime guarantee.

Scheduled Maintenance

Provider will occasionally perform scheduled maintenance to upgrade or patch the infrastructure. Planned maintenance windows will be announced to Customer in advance (typically at least 48 hours' prior notice). Provider will endeavor to schedule maintenance during off-peak hours and minimize disruption. Customer acknowledges that such planned downtime does not count as "Downtime" under the SLA, provided normal operations resume promptly after the maintenance is completed.

Remedies

To claim a service credit, Customer must submit a written request within 30 days of the incident, detailing the dates and impact of the downtime. Provider will verify availability using its monitoring logs. Any approved service credit will be applied to Customer's next invoice. Service credits are the sole and exclusive remedy for unavailability of ACS.

Performance Monitoring

Provider will monitor core infrastructure metrics (CPU, memory, disk I/O, network traffic) and alert on capacity issues. If metrics indicate that Customer's workload regularly exceeds the allotted resources (for example, disk I/O saturation or sustained high CPU), Provider will inform Customer and recommend upgrading to a higher service tier. Provider may also increase resources temporarily to mitigate urgent performance issues, with Customer's consent, to ensure the Service remains operational.

Customer Responsibilities and Use Restrictions

Use of Service

Customer shall use ACS only for lawful purposes and in compliance with this Agreement. Customer must not use the Service to violate any law, regulation, or the rights of others. Prohibited uses include (without limitation): hosting illicit content (such as illegal pornography, pirated software, or copyrighted material without authorization), engaging in fraud or unauthorized access attempts, distributing malware or viruses, conducting denial-of-service attacks, or any activities that harm or disrupt networks or services. For example, Customer may not use ACS to engage in activities like hacking other systems, sending unsolicited mass email (spam), or storing illegal content. Provider reserves the right to suspend or terminate the Service immediately if Customer uses ACS for any unlawful or abusive purpose.

Account Security

Customer is responsible for all actions taken through its ACS accounts. Customer must safeguard all usernames, passwords, API keys and authentication credentials. Customer and its authorized users must protect the confidentiality of their login information. If Customer suspects any breach of account security or unauthorized access, Customer shall notify Provider immediately. Customer will be liable for any losses or liabilities arising from use of the Service by anyone to whom Customer has granted access (whether authorized or not).

Resource Management

Customer may not attempt to access or modify the underlying cloud provider consoles, servers, or network devices directly. All changes to infrastructure (scaling, provisioning, configuration) must be made through Provider. Customer shall not reverse-engineer, decompile, or otherwise attempt to discover any Provider proprietary software or algorithms. Customer also agrees not to upload or use on the Service any software that contains malicious code, backdoors, or code designed to exploit vulnerabilities (such as viruses, worms, trojans, or crypto-miners).

Compliance with Laws

Customer is responsible for compliance with all laws and regulations related to its use of ACS, including data protection laws (e.g. GDPR), export control, and industry-specific regulations. Customer is solely responsible for any liabilities resulting from its content or activities on the Service.

Data Protection and Backups

Customer should ensure that critical data is backed up appropriately, although Provider offers the AtollBackup service. Customer shall clearly identify any content that requires special handling. Customer agrees that Provider has no liability for loss of Customer Data if Customer has not followed recommended backup practices or fails to recover data during the retention period.

Provider Obligations and Security

General Performance

Provider shall perform the Service in a professional manner consistent with industry standards for cloud providers. Provider will maintain the underlying infrastructure (servers, network, storage) in secure, environmentally controlled data centers and will apply regular software updates, security patches, and hardware maintenance. Provider will monitor system health and respond to incidents or alerts to restore service.

Security Measures

Provider will implement reasonable technical and organizational security measures to protect the Service and Customer Data. This includes (but is not limited to) firewalls, network segmentation, malware scanning on Provider's side, and DDoS mitigation measures. Provider will apply patches to the operating system and hypervisors in a timely manner. Basic anti-virus/anti-malware tools and intrusion detection may be used on managed systems.

Security Disclaimer

Notwithstanding the above, Provider does not and cannot guarantee that ACS is free from all security threats. As stated in industry-standard terms, Provider does not warrant that the Service will be free from intrusion, attack, viruses, or other security incidents. Customer acknowledges that sophisticated or targeted cyberattacks (such as zero-day exploits, state-sponsored hacking, or advanced persistent threats) may breach even well-defended systems. Provider disclaims any liability for any breach or loss resulting from such attacks. However, Provider will take commercially reasonable steps to detect and respond to security incidents. For incidents beyond the scope of the included service (e.g. a determined targeted intrusion), Provider may offer incident response or mitigation services at additional cost.

Third-Party Providers

ACS relies on services from third-party cloud providers (e.g. Google, Microsoft, etc.). Provider will manage these relationships and may switch underlying providers or resources if it deems it necessary for reliability. Provider is not responsible or liable for outages, quality of service, or data loss caused by any third-party provider beyond Provider's control. If a third-party provider experiences downtime, Provider will endeavor to implement a workaround (such as failing over to another region or provider) when feasible. However, Provider cannot guarantee continuous switching between providers without some impact, and Customer accepts that such events may cause temporary disruption.

Service Changes

Provider reserves the right to modify, improve or discontinue parts of the Service (such as updating product names or underlying technologies) provided that any material changes (those that significantly affect functionality or pricing) are communicated to Customer in advance. Provider will not remove features that have been contracted without offering reasonable alternatives or transition time.

Data Retention and Privacy

Data Ownership

Customer retains sole ownership of all data and content uploaded to ACS. Provider acquires no rights to Customer Data except the limited license to process and store it as necessary to provide the Service.

Data Processing

Provider may process Customer Data and Usage Data (logs, metrics) to maintain, improve, and operate the Service. Provider will handle Customer's personal data (if any) in compliance with applicable data protection laws (including GDPR). Provider will not use Customer Data for marketing or other purposes outside the Service.

Data Retention

As noted in Section 2, upon termination Provider will retain Customer Data for up to 90 days, then delete it. Customer should export or back up any data within this period. For active subscribers, Provider will retain data according to the subscribed storage plan; if Customer increases or decreases storage usage, billing will adjust accordingly.

Privacy

Provider agrees not to access, use, or disclose Customer Data except as needed to provide or improve the Service, or as required by law. Provider employees and contractors with access to Customer Data are under confidentiality obligations. Any use of data for anonymized analytics or system improvement will be aggregated and not identify Customer.

Confidentiality

Each party (the "Recipient") may receive or have access to Confidential Information of the other party (the "Discloser"). "Confidential Information" means all non-public information disclosed by Discloser that is either marked confidential or should reasonably be understood as confidential. Confidential Information includes this Agreement's terms, pricing, and business information, as well as Customer Data and Provider's proprietary technology.

Obligations

The Recipient shall not use the Discloser's Confidential Information for any purpose other than performing its obligations under this Agreement. The Recipient shall not disclose Confidential Information to any third party except to its own employees or contractors who need to know and who are bound by confidentiality obligations. The Recipient shall protect Confidential Information with at least the same degree of care as it uses to protect its own similar confidential information (but no less than reasonable care).

Exceptions

Information does not count as Confidential if it is already lawfully known by Recipient without restriction, is or becomes public through no fault of Recipient, or is independently developed by Recipient without reference to Discloser's Confidential Information. Recipient may disclose Confidential Information if required by law or court order, but must give Discloser prompt notice and cooperate to limit disclosure.

Duration

These confidentiality obligations survive termination of this Agreement for a period of three (3) years (or longer if required by applicable law or contractual duty).

Intellectual Property

Provider IP

Arckipel (and its licensors) retain all ownership rights in ACS and any software, tools, or documentation provided to Customer ("Provider Technology"). Customer is granted no rights in Provider Technology except the limited license to use the Service as specified in this Agreement. Customer may receive APIs, SDKs or documentation to interact with ACS; such items remain copyrighted and proprietary to Provider or its suppliers.

Customer IP

All applications, source code, content, and data developed or owned by Customer (including mobile or backend applications deployed on ACS) remain the sole property of Customer ("Customer Technology"). The use of ACS for deployment or hosting does not grant Arckipel any ownership rights over Customer's intellectual property. Arckipel will not claim any IP rights over Customer-developed software, nor restrict its use beyond what is necessary to operate the Service.

Feedback

If Customer provides suggestions or feedback to Provider (e.g. feature requests), Provider may freely use such feedback to improve ACS without any obligation to Customer.

Warranties and Disclaimer

Provider Warranty

Provider warrants that it will perform the Service in accordance with this Agreement using reasonable care and skill, and in a professional manner. Provider warrants the Service will materially conform to the descriptions in this Agreement and any applicable documentation.

Disclaimer

Except as expressly stated herein, the Service is provided "AS IS" and "AS AVAILABLE," without any other warranties of any kind. Provider expressly disclaims any implied warranties, including warranties of merchantability, fitness for a particular purpose, title, or non-infringement. Provider does not guarantee that the Service will be uninterrupted or error-free. Customer acknowledges that Internet-based services can experience delays and outages, and Provider's sole responsibility is to use commercially reasonable efforts to resolve them.

Third-Party Components

The Service may use third-party software or services. Provider disclaims all warranties to the extent arising from third-party components. Provider does not warrant any third-party software used in ACS (these are licensed "as is" by their own licensors).

Limitation of Liability and Indemnification

No Indirect Damages

To the fullest extent permitted by law, neither party will be liable to the other for any indirect, incidental, special, punitive, or consequential damages (including loss of profits, revenue, data or business interruption), even if such party has been advised of the possibility of such damages.

Liability Cap

Except for liability arising from gross negligence, willful misconduct, violation of data protection laws, or breach of confidentiality, each party's total aggregate liability for any and all claims under this Agreement shall not exceed the fees paid by Customer to Provider in the twelve (12) months preceding the event giving rise to the claim. The parties agree that this limitation is reasonable in light of the fees and risks in this Agreement.

Indemnification by Provider

Provider will defend, indemnify and hold harmless Customer from any third-party claim alleging that the Service as provided infringes a third party's U.S. or EU patent, copyright or trademark, and will pay any damages finally awarded, provided Customer promptly notifies Provider in writing of the claim and gives Provider control of the defense. Provider's obligations do not apply if the claim arises from (a) modifications made by Customer not authorized by Provider, or (b) use of the Service in combination with non-Provider software where the combination causes infringement. If a claim is made, Provider may, at its option, (i) obtain rights for Customer to continue using the Service, (ii) modify the Service to avoid infringement (without reducing functionality materially), or (iii) if neither is feasible, terminate the affected portion of the Service and refund the prorated fees for the unused period.

Indemnification by Customer

Customer shall indemnify, defend and hold harmless Provider from any third-party claim arising out of Customer's violation of law or infringement of third-party rights (including claims related to Customer Data or applications), and any claim resulting from Customer's negligence or willful misconduct. Customer's indemnity obligation is contingent on Provider giving prompt notice of any such claim and reasonable cooperation in the defense.

Procedure

The indemnified party will give prompt written notice of any claim and allow the indemnifying party to control the defense and settlement. The indemnifying party shall not settle any claim imposing an obligation on the indemnified party without its prior written consent.

Force Majeure

Neither party will be liable for any delay or failure to perform its obligations under this Agreement (other than payment obligations) if and to the extent caused by events beyond its reasonable control ("Force Majeure Events"), such as acts of God, war, terrorism, riots, strikes, pandemics, cyberattacks by state actors, or large-scale Internet outages. The affected party shall promptly notify the other of the event and use reasonable efforts to resume performance. Customer acknowledges that maintenance, power failures, or third-party outages may fall under Force Majeure if they are beyond Provider's control.

Governing Law and Dispute Resolution

This Agreement is governed by and construed in accordance with the laws of Estonia (without regard to conflict-of-law principles). Any dispute arising out of or relating to this Agreement shall be resolved by the courts of Tallinn, Estonia, which shall have exclusive jurisdiction. The parties waive any objection to venue in these courts. All notices under this Agreement must be in writing (email is acceptable) and sent to the address specified in the Order Form or as otherwise provided.

General Provisions

Entire Agreement

This Agreement (including any Order Forms or exhibits) is the entire agreement between the parties regarding its subject matter and supersedes all prior agreements and understandings. No additional terms shall apply unless agreed in writing.

Amendments

Any modifications to this Agreement must be in a written amendment signed by both parties. However, Provider may update service policies (such as payment instructions or contact info) with notice to Customer.

Assignment

Customer may not transfer or assign this Agreement or any rights hereunder without Provider's prior written consent. Provider may assign this Agreement (for example, in connection with a sale or corporate reorganization) without Customer's consent, provided the successor agrees to be bound by its terms.

Relationship of Parties

The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship between them.

Waiver and Severability

No waiver of any breach shall be deemed a waiver of any other breach. If any provision of this Agreement is held invalid or unenforceable, the remainder shall remain in full force.

Survival

Sections that by their nature should survive termination or expiration of this Agreement (including Fees, Confidentiality, Limitation of Liability, and Governing Law) will survive.

By subscribing to ACS or allowing ACS provisioning, Customer agrees to these terms. The current version of this Agreement is maintained online at https://arckipel.com/terms-arckipel-cloud and shall be deemed the binding version unless otherwise agreed in writing.