Versie 4.1 (20150401) - Page 1

NUCLEUS  UPTIME  LEVEL  AGREEMENT  &  SERVICE  PACKS  

Table of contents 1.   About Nucleus ............................................................................................................................ 3  

Healthy grower .............................................................................................................................. 3  Hosting Solution Builder .................................................................................................................. 3  

2.   References ................................................................................................................................. 4  3.   Our Network .............................................................................................................................. 5  

Description .................................................................................................................................... 5  Advantages .................................................................................................................................... 6  

4.   Our datacenters .......................................................................................................................... 7  Locations ....................................................................................................................................... 7  Description .................................................................................................................................... 7  Advantages .................................................................................................................................... 9  

5.   Security ................................................................................................................................... 11  Physical security of the equipment ................................................................................................. 11  Network security .......................................................................................................................... 12  Monitoring the access rights at Nucleus ......................................................................................... 12  ISO 27001 ................................................................................................................................... 14  

6.   Uptime Level Agreement ........................................................................................................... 16  6.1.   Physical security ................................................................................................................. 16  6.2.   Power ................................................................................................................................ 16  6.3.   Automatic climate control .................................................................................................... 17  6.4.   Fire protection and water detection ...................................................................................... 18  6.5.   Network infrastructure & connectivity ................................................................................... 18  

7.   Availability ................................................................................................................................ 19  7.1.   Measuring method .............................................................................................................. 19  7.2.   Quality and availability connectivity ...................................................................................... 19  7.3.   Availability bandwidth ......................................................................................................... 19  7.4.   Availability of the supplied services ...................................................................................... 20  7.5.   Availability support ............................................................................................................. 20  

8.   Service Packs ........................................................................................................................... 21  8.1.   Review ............................................................................................................................... 21  8.2.   Summary ........................................................................................................................... 23  8.3.   Critical versus non-critical support ........................................................................................ 23  

Versie 4.1 (20150401) - Page 2

8.4.   Paid or free support? .......................................................................................................... 24  8.5.   24/7 emergency number ..................................................................................................... 24  8.6.   Response period ................................................................................................................. 24  8.7.   Solution Goal ...................................................................................................................... 25  8.8.   Updates and patches .......................................................................................................... 25  8.9.   Server management ........................................................................................................... 26  8.10.   Infrastructure monitoring .................................................................................................. 26  8.11.   Basic monitoring ............................................................................................................... 26  8.12.   Advanced monitoring & trending ........................................................................................ 27  8.13.   Trending surveillance ........................................................................................................ 28  8.14.   External Monitoring ........................................................................................................... 28  8.15.   Backup check ................................................................................................................... 28  8.16.   Restores ........................................................................................................................... 28  8.17.   Alert handling ................................................................................................................... 29  8.18.   Traffic reporting ................................................................................................................ 29  8.19.   Resource use .................................................................................................................... 29  8.20.   Incident reporting ............................................................................................................. 30  8.21.   Root Cause Analysis .......................................................................................................... 30  8.22.   Report analysis and executive summary ............................................................................. 30  8.23.   Advanced services ............................................................................................................ 30  

9.   Delivery and installations ........................................................................................................... 32  9.1.   Delivery server ................................................................................................................... 32  9.2.   Software installation ........................................................................................................... 32  

10.   Acceptable Use Policy .............................................................................................................. 33  10.1.   Access to the systems ....................................................................................................... 33  10.2.   Abusing the server ............................................................................................................ 33  

11.   Compensations and statutory provisions ................................................................................... 34  11.1.   Compensation when not realising the ULA .......................................................................... 34  11.2.   Difference between ULA and service pack description .......................................................... 34  11.3.   Submitting the claims ........................................................................................................ 34  11.4.   Relationship with general terms and conditions ................................................................... 35  

Versie 4.1 (20150401) - Page 3

1. About Nucleus Healthy grower Since its start in 2000 Nucleus has obtained a place at the top of the Belgian hosting companies. Our strength? The expertise of a small committed team. They are all specialists in their field of expertise who work complementarily. In the first place Nucleus wants to be a healthy company. No cowboy ways. A sensible policy in the operational and financial field. Stability on the balance sheet and in the racks. Hosting Solution Builder Nucleus is a hosting solution builder. We cannot formulate this any better.

• Hosting: The alpha and omega, our core business. Nucleus offers hosting and all things related to this. If there is no connection with hosting, we will not be involved.

• Solution: The background of the company managers is in consultancy. First listen, then speak, then take action. We identify the problems which (could) emerge and seek the optimal solution.

• Builder: Nucleus stands for a hands-on approach. Both in the field of software and hardware we are not afraid to soil our hands. We therefore do not depend on external technicians. This means that we can deliver tailor-made work for our clients. Efficient and effective.

Versie 4.1 (20150401) - Page 4

2. References Nucleus manages more than 1,600 servers divided over 4 datacenters. Below we show some of our clients, because it shows you that we have experience with working with large and small companies, private companies and the government, IT and other sectors, …

Versie 4.1 (20150401) - Page 5

3. Our Network Description

A double redundant dark fibre ring connects the datacenters in Nossegem, Antwerp, Zaventem and Diegem. The first ring connects Nossegem, Zaventem and Diegem. The second ring includes Antwerp, Zaventem and Diegem. All locations have redundant 10Gig Ethernet connections on this dark fibre ring, so that our network throughout the four datacenters form one logical network. Failover solutions in a multidatacenter approach are made possible in this way. In InterXion Zaventem and LCL Antwerp our backbone ring is connected with several national and international TIER1 providers. In order to always be able to offer sufficient capacity all these connections are equipped with at least 10GE uplinks. The network is also peered with all large providers in the largest hub of Europa through NL-IX and AMS-IX. These uplinks and

Versie 4.1 (20150401) - Page 6

peerings are evaluated on a regular basis. When selecting these uplink providers of peering connections we will always let the quality (latency etc.) prevail. If you want to let your solution at Nucleus be part of your own private network between, for example, various locations, we can also offer different solutions here. For example, Nucleus has partnerships with Proximus (Explore), Eurofibre, Destiny, Mobistar. Other providers are also always possible. The border routers in Zaventem and Antwerp are Juniper MX routers, with a total routing capacity of 480 gigabit/s. The core and distribution switches are fully connected with multiple 10Gig Ethernet connections. Clients can be connected from redundant distribution switches to multiple connections. For example, Nucleus can guarantee all requirements regarding bandwidth, however large. Each colocation datacenter is also equipped with redundant Juniper firewalls which can be switched on as a shared firewall for those who also want to subcontract the security to Nucleus. Besides this shared firewall solution it is also possible to install numerous dedicated firewall solutions for your project. Advantages

• Virtual Ethernet possible between datacenters • Location non-bound IP network • Backbone by the company itself • Several TIER1 as uplink • High bandwidth routing • Optimal security for your hosting solution

Versie 4.1 (20150401) - Page 7

4. Our datacenters Locations At present Nucleus operates from four datacenters: Antwerp, Nossegem, Diegem and Zaventem. Nossegem and Antwerp are completely equipped as high density datacenters. This datacenter is owned by Mobistar and is located along Leuvensesteenweg in Nossegem. The Antwerp datacenter is situated in the North Trade Building, Noorderlaan 133 in Antwerp. Diegem is equipped as a network datacenter. Diegem is also our location where we connect our fibre network to various uplink providers. After all, Diegem has more than 50 carriers. The datacenter is owned by LCL and is located at Kouterveldstraat in Diegem. Zaventem is our second location in our Brussels ring. Here we only develop colocation services after an explicit request and do not have an own suite. The aim of this POP is to guarantee the full redundancy of our network. After all, Zaventem also has more than 50 uplink providers to which we can connect, including the known BNIX hub. Zaventem is operated by InterXion and is located at Wezenbeekstraat in Zaventem. Description Own suites

In Nossegem and Antwerp we have our own suites. This means that we can check everything within our own space ourselves: each cable is placed under our supervision and we can therefore place installations and connections without any restrictions. Strict security

All our racks and rack compartments are locked with individual combination locks. Clients who use shared colocation or dedicated servers only have access after a request and under supervision. Clients who have dedicated racks or compartments, have independent 24/7 access on the basis of previously defined access lists. All buildings and spaces are fully monitored by all kinds of access and alarm systems. Nossegem and Zaventem are monitored 24/7 by a security agent on the spot, while Diegem and Antwerp are under surveillance of a video room.

Versie 4.1 (20150401) - Page 8

It is obvious that there are also extensive movement detection systems and camera surveillance systems through a CCTV system. At the same time there are also extensive fire detection, extinguishing and water detection systems. Cold contained corridors create high density

In our datacenters we work with the principle of cold contained corridors (sometimes also called aisles). In this set-up a double row of racks is always arranged as a closed island. The middle corridor is closed by automatic doors along both sides and is under pressure of cold air. The hot air is therefore blown this island at once outside by the servers and sucked off again alongside the outside above. Inside in the racks we strictly monitor the use of blinding panels in order to avoid that cold air mixes with hot air. This method of working has numerous advantages: high density (until 32 amperes per rack), whereby we guarantee that servers at the top in the racks are also cooled sufficiently, but at the same time are used less (your fans have less work) and your servers have a longer life. For these systems we rely on Minkels, which does not only supply high-quality material to us, but is also involved in designing our rooms, so that they can make use of their worldwide expertise in arranging data center rooms in an efficient way. The cooling of the air is guaranteed by redundant air-conditioning units. The control units of the air conditioning are double in our suites. The cooling takes place outside by a whole battery of chillers, whereby various chillers may fail without any problems for the datacenter. This therefore also implies transparent maintenance. Extensive power supplies

The Brussels datacenters are all arranged according to the 2N principle regarding their power supply. Antwerp has been built up according to the N+1 principle. Each building has two separated high-voltage lines, each of which has an own transformer and is fully redundant. That is to say, if one transformer would fail, the other transformer is powerful enough to fully power the datacenter. From there the power goes to two separated UPS rooms. Each UPS room has been built redundantly, so that each separate UPS is sufficient in itself to power the double circuits. This is not only handy when the external electricity network fails, but also when maintenance has to be performed. This is always planned for each UPS separately. In Antwerp the situation is slightly different: there are 3 UPSs in 1 room (1 UPS per circuit and 1 as a backup for both active UPSs).

Versie 4.1 (20150401) - Page 9

The UPS rooms are not only connected to the double transformers, but are also back-upped by at least 4 emergency generators, of which in principle only 2 are necessary to keep the datacenter in operation. They are tested monthly under a full load, so that surprises are excluded. A circuit leaves from each UPS room. This A+B arrangement is continued up to each rack. Each rack is separately fused. If there are smaller compartments all compartments are even fused. This gives you a guarantee, in contrast with other providers, that you cannot be a victim in your quarter rack of a short-circuit of your neighbour. With compartmented racks all cables, both the power and network cables, are fully separated from the other racks. Network cabling of the new generation

All cabling between the core and distribution switches as well as to the individual racks consists of CAT6A/10GigE cabling. We decide to prepare our internal backbone for 10 gigabit Ethernet, that we can not only comply with high bandwidth requirements on our fibre network, but also for your switch or servers. However, if you also need fibre connections, we can also build this for you tailor-made. Due to the expansion of our distribution switches and the VRPP protocol, we can give each switch a redundant uplink, without you having to apply extensive configurations yourself or place complex and unreliable voltage tree switches. Just plug in two Ethernet cables and you can start, Nucleus will do the rest. Due to our own fibre network we can also offer you a virtual Ethernet connection between Nossegem and Antwerp. We will give you an extra Ethernet cable along both sides and your both locations will act as one virtual LAN. It is obvious that we make extensive use of VLAN’s to separate your traffic from other traffic, so that you can always have the best guaranteed uplink speed. As a standard all our connections are burstable up to 1 gbit/s. Advantages

• Own suites for more flexibility • Extensive security measures • High density, up to 32A per rack • Cold contained corridors • Qualitative Minkels racks

Versie 4.1 (20150401) - Page 10

• 2N+1 power supplies • Double redundant network • CAT6A/10GigE cabling up to the racks • Separate fuses per rack compartment

Versie 4.1 (20150401) - Page 11

5. Security Physical security of the equipment The datacenter is 24/7 guarded by a security team on the spot. This team makes rounds and has a CCTV system which monitors the perimeter around the building, as well as all accesses and passageways. The entrance itself is closed with gates and a barrier, which is operated by the security agent. Access to the building is only possible by persons who have been placed on the access list in advance. Nucleus manages this access list for its suite. Furthermore, the building is equipped with access and movement detectors. The suite itself is equipped with fire and water detection systems. Fire is combated on the basis of Argon gas. The gas supply is sufficient to fill the entire building in one go. The suite itself is filled with a cold contained aisle racks. Each rack is locked with an individual combination lock at the front and back. Its code is only known by the competent persons. Each individual server is equipped with sensors which detect unauthorised opening. It is also detected when the power is removed (and therefore switched off). The functioning of the servers is also checked by an external monitoring system. In case of failure of a component, our NOC will be informed automatically at once, 24/7.

Versie 4.1 (20150401) - Page 12

Network security Another aspect of security is what goes to the servers through the internet. Optionally we work with a double security: First of all, the perimeter is monitored. The redundant Juniper Firewalls have been placed near the border routers. These physical firewalls are suitable for inspecting high traffic in depth. These firewalls provide protection as follows:

• Flood attacks: detection of superfluous traffic of one of several origin points if these certain parameters are exceeded. In a cascade of counter measures these attacks are blocked automatically and reported to the NOC. If necessary, the NOC will then nullroute such origins to definitely guarantee the traffic to the network.

• Scans: IP and port scans are detected very fast and the traffic coming from such scans will then be blocked from access to the network during a random period. Repeated attempts of the same origin may result in a longer blockage of this origin.

• Intrusion Detection: based on the renowned system of Juniper itself it is checked whether there is intrusion in masked packets on the basis of in-depth scanning of the IP packets. In case of detection they are blocked and reported at once.

• Access control: clients who take this option can obtain certain access rights through VPN. The VPN tunnels are then terminated on the Juniper firewalls which can set up fully IPSEC compliant tunnels with other branch connection points, also of other brands. By using high-level Juniper technology these tunnels can be set up with AES encryption without loss of network speed.

Setting and configuring the security may only be done by Nucleus staff that has been trained and authenticated for this purpose. Monitoring the access rights at Nucleus We apply a central access policy. A central authentication server manages the access rights of each individual staff member. Revoking rights of an employee therefore takes place on a central basis and can be done with one push on the button. Managing this central security is the responsibility of both managing partners. The second highest clearance is reserved to the senior system engineers. Only the above-mentioned persons can delegate rights to others. Each individual employee of Nucleus has included the following provision in its employment agreement:

During the term of this agreement and after its termination the employee is obliged to not provide any reliable information or confidential procedures and programs regarding

Versie 4.1 (20150401) - Page 13

the functioning and policy of the company to third parties, irrespective of its importance and possible impact. Confidential information refers to the details, data, programs or procedures which are not known to the public, or which can be known to others through an illegal action. This clause regarding the confidential handling of data also applies to the data and documents received by the company as part of its work for clients. This information is owned by clients and may never be used for other purposes than those for which the company received an assignment. They may never be made available to non-accepted third parties.

The labour regulations also clearly state the following:

At the company the following actions, amongst others, are considered as serious shortcomings which make all forms of professional cooperation impossible at once and definitely:

• […]

• violation of business secrets;

• […]

• violation of business secrets of clients. We attach much importance to this and our employees know that this violation will be sanctioned at once. If they cause damage, to us or the client, they will be prosecuted. Since we started we never have had to make use of these provisions.

Versie 4.1 (20150401) - Page 14

ISO 27001 Nucleus has had an ISO 27001 certificate since June 2014. This quality label is the result of an extensive external audit in the field of Security Management. We therefore offer our clients an extensive guarantee for the security of their hosting solution bij Nucleus. ISO/IEC 27001:2005 is part of the growing family of ISO/IEC 27000 standards. ISO/IEC 27001:2005 is a standard regarding an Information Security Management System (ISMS) and was published in October 2005 by the International Organisation for Standardization (ISO) and by the International Electrotechnical Commission (IEC). The norm specifies requirements for establishing, implementing, carrying out, monitoring, assessing, updating and improving a documented Information Security Management System (ISMS). The ISMS has been designed to guarantee the choice of adequate and proportional security measures that protect the information and give confidence to interested parties. The ISO 27001 standard regards all aspects of data protection:

1. Policy-related (management) 2. Organisational (responsibilities) 3. Operating assets (infrastructure, network, systems and other operating assets) 4. Staff (company rules, errors, theft, fraud, abuse) 5. Physical (locks, fire protection) 6. Communication and operation (managing systems, processes and procedures) 7. Access control (logical & physical) 8. System and software development and maintenance (documentation, processes) 9. Incident management (anticipating and responding to security problems) 10. Continuity (disaster provisions) 11. Regulations (Computer Crime Act, Personal Data Protection Act)

ISO 27001 requires that the management:

• systematically investigates the security risks of the company and makes others aware of the threats, weaknesses and their impact;

• designs and implements a coherent and comprehensive system of security control, so that all forms of risk management (such as risk avoidance) and the risks which are considered to be unacceptable are tackled;

• introduces a coordinating management process to constantly to monitor the evolving security risks.

Versie 4.1 (20150401) - Page 15

The advantages of ISO 27001 are:

• It is an expansion of the general quality system to include everything related to security;

• It offers an opportunity to map and manage all risks in connection with IT systems; • Creates confidence with and a guarantee of a sound security management for

commercial partners and clients; • Offers an independent audit of all procedures related to security.

Versie 4.1 (20150401) - Page 16

6. Uptime Level Agreement Nucleus has rooms in four different carrier neutral datacenters: Antwerp (LCL), Nossegem (Mobistar), Zaventem (InterXion) and Diegem (LCL). These datacenters are all equipped with UPS (Uninterruptable Power Supply), an emergency power generator, automatic climate control, fire detection, temperature control, access control, circuits and network connections. Nucleus sees to it that the facilities are extended redundantly. In Nossegem and Antwerp we have our own suites. This means that we can check everything inside our own rooms ourselves: each cable is placed under our supervision and we can therefore place installations and connections without any restrictions.

6.1. Physical security Our datacenters are guarded 24/7 by an external security company. There is also camera surveillance and movement detection in each room. Access to the datacenter is either checked though electronic access, or through checks by the security agent. Access is only allowed by persons who are reported individually on the access list. All our racks and rack compartments are locked with individual combination locks. Clients who make use of shared colocation or dedicated servers only have access after requesting this and under supervision. Clients who have dedicated racks of compartments have the same independent access 24/7 on the basis of previously defined access lists.

6.2. Power The datacenters are all arranged according to the 2N principle regarding their power supply. According to the 2N system, there are two separated high-voltage lines, each of which has an own transformer and is fully redundant. That is to say, if one transformer would fail, the other transformer is powerful enough to fully power the datacenter. From there the power goes to two separated UPS rooms. Each UPS room has been extended redundantly, so that each separate UPS is sufficient in itself to power the double circuits. This is not only handy when the external electricity network fails, but also when maintenance has to be performed. This is always planned for each UPS separately. The UPS rooms are not only connected to the double transformers, but are also back-upped by at least 4 emergency generators, of which in principle only 2 are necessary to keep the datacenter in operation. They are tested monthly under a full load, so that surprises are excluded.

Versie 4.1 (20150401) - Page 17

In Antwerp the situation is slightly different: there are 3 UPSs in 1 room (1 UPS per circuit and 1 as a backup for both active UPSs) and 1 emergency generator. A circuit leaves from each UPS. This A+B arrangement is continued up to each rack. Each rack is separately fused. If there are smaller compartments all compartments are even fused. This offers you a guarantee, in contrast with other providers, that you cannot be a victim in your quarter rack of a short-circuit in another compartment. With compartmented racks all cables, both the power and network cables, are fully separated from the other racks.

6.3. Automatic climate control In our datacenters we work with the principle of cold contained corridors (sometimes also called aisles). In this set-up a double row of racks is always arranged as a closed island. The middle corridor is closed by automatic doors along both sides and is under pressure of cold air. The hot air is therefore blown this island at once outside by the servers and sucked off again alongside the outside above. Inside in the racks we strictly monitor the use of blinding panels in order to avoid that cold air mixes with hot air. This method of working has numerous advantages: high density (until 32 amperes per rack), whereby we guarantee that the servers at the top in the racks are sufficiently cooled, but at the same time are used less (your fans have less work) and your servers have a longer life. For these systems we rely on Minkels, which does not only supply high-quality material to us, but is also involved in designing our rooms, so that they can make use of their worldwide expertise in efficiently arranging data center rooms. The cooling of the air is guaranteed by redundant air-conditioning units. The air conditioning in our suites has double control units. The cooling takes place outside by a whole battery of chillers, whereby various chillers may fail without any problems for the datacenter. This therefore also implies transparent maintenance. The cooling of the air is guaranteed by redundant chillers. The air conditioning in our suites has double control units. This therefore also implies transparent maintenance. The cooling of the rooms guarantees that the inlet temperature of the equipment never fluctuates very fast and remains below the critical point of the servers (18-28° Celsius). At the same time the air humidity is normalised (35-65%).

Versie 4.1 (20150401) - Page 18

6.4. Fire protection and water detection All suites are equipped with extensive detection and smoke, fire and water combatting systems. The detectors can be found on top and below the floor. The necessary alarm systems give an adequate response in order to prevent fire or water seepage.

6.5. Network infrastructure & connectivity We decided to prepare our internal backbone for 10 gigabit Ethernet, so that we can not only comply with high bandwidth requirements on our fibre network, but also for your switch or servers. The Nucleus network is built up on the basis of two connectivity POP’s (Zaventem and Antwerp). Because of the geographic distribution of both POP’s we offer the guarantee that we are independent from similar fibre backbones. The border routers are Juniper MX routers, with a total routing capacity of 480 gigabit/s. The core and distribution switches consist of Juniper and Cisco equipment. As a standard all our connections are burstable up to 1000 mbit/s. Each colocation datacenter is also equipped with redundant Juniper firewalls, which can be switched on as a shared firewall for those who also want to subcontract the security to Nucleus. A double redundant dark fibre ring connects the datacenters in Nossegem, Antwerp, Zaventem and Diegem. The first ring connects Nossegem, Zaventem and Diegem. The second ring includes Antwerp, Zaventem and Diegem. All locations have redundant 10 gigabit Ethernet connections on this dark fibre ring, so that our network forms one logical network throughout the four datacenters. In InterXion Zaventem and LCL Antwerp our backbone ring is connected with several national and international uplink providers. The Nucleus network is also connected with the AMS-IX and NL-IX. The Amsterdam Internet Exchange (AMS-IX) is the most important internet hub of the Netherlands and the second largest one in the world.

Versie 4.1 (20150401) - Page 19

7. Availability

7.1. Measuring method For the calculation of the availability, Nucleus applies the following formula

𝑨(𝑻 − 𝑺)

∗ 𝟏𝟎𝟎

Whereby A = the actual availability of the service, expressed in minutes, as measured by the Nucleus monitors T = total number of minutes in the month in question S = number of minutes scheduled downtime Scheduled downtime = each announced maintenance to the service in question. Nucleus always must announce this maintenance at least 5 working days in advance, unless it is necessary to intervene at once in order to not interrupt the general service or because security reasons.

7.2. Quality and availability connectivity The availability of the Nucleus network is measured both inside and outside the own network. The network is considered as unsuitable when more than 1.5% packet loss is established from these contact points. Nucleus also guarantees that the average latency on its network within Europe will be 90 ms or less and will be 200 ms or less on the transatlantic part. Nucleus reserves the right to carry out urgent interventions on the network when required. Nucleus cannot be held responsible by Denial of Service for attacks from outside its network. Average latency on the European Nucleus network <= 90 ms Average latency on the transatlantic Nucleus network <= 200 ms Average packet loss on the Nucleus network <= 1.5%

7.3. Availability bandwidth Nucleus always guarantees sufficient burst capacity on its uplinks. Every 5 minutes Nucleus measures the average speed on its network. Nucleus guarantees at least an overcapacity of 30% on the average of the top 5% measurements. In this way we do not guarantee an extra capacity above the average, but the certainty of extra peak capacity on top of the already measured peaks. Availability bandwidth >= 30% compared to top 5% peaks

Versie 4.1 (20150401) - Page 20

7.4. Availability of the supplied services

At Nucleus we do not apply complex ULA’s for the various components. You purchase a service from us and you want to be sure that it is available. What difference does it make that your server cannot be accessed because of a cooling or a network problem. The guaranteed availability is laid down for each service in the following way:

ULA Max unavailability

per month shared hosting best effort not applicable DNS 99.95% 22' colocation 99,90% 44’ dedicated server 99.25% 5hr30 Open Cloud 99.50% 3hr40 VMWare Cloud 99.97% 13’11”

7.5. Availability support Our support services are available for everybody during office hours (Monday-Friday from 09.00-18.00 hours). The emergency number is available 24/7 for all clients with a colocation, dedicated server or Open/VMWare cloud server contract.

Versie 4.1 (20150401) - Page 21

8. Service Packs

8.1. Review Essentials Essentials+ Managed Managed+ 24/7 emergency number þ þ þ þ

Including support Infrastructure Infrastructure Unlimited Unlimited

Critical support

Response period <2hrs <30’ <15’ <15’ Solution goal <4hrs <1hr <30’ <30’

Non-critical support* Response period NBD <8hrs <4hrs <1hr Solution Goal RE <16hrs <8hrs <2hrs

Operations Update & patch management

þ þ

Server management þ þ

Monitoring

Infrastructure þ þ þ þ

Basic monitoring þ þ þ

Advanced monitoring þ þ þ

Trending graphs & alerts þ þ þ

Trending surveillance þ

External monitoring þ

Alert follow-up

By the client þ

By Nucleus 24/7 þ þ

Reports

Traffic use þ þ þ þ

Resource use þ þ þ

Incidents þ þ

RCA þ

Report analysis & executive summary

þ

Advanced services**

Security testing þ

Penetration testing þ

Stress testing þ

Versie 4.1 (20150401) - Page 22

þ = included RE = Reasonable Effort NBD = Next Business Day

* only during office hours ** upon request

Versie 4.1 (20150401) - Page 23

8.2. Summary Our Service packs can be divided into two groups:

• Unmanaged servers: Essentials and Essentials+ • Managed servers: Managed and Managed+

With the Essentials service pack you manage your server yourself, but in Essentials+ you can count on a better response period and extra services. For Managed and Managed+ clients we manage the servers without any support restrictions. We provide a total solution. This implies updating and monitoring your server (updates, patches, monitors, monitoring alerts, security, …) every day as well as supporting our clients with regard to server management. Advice and DevOps support is also included. Major changes such as architecture changes or a rearrangement of the structure are not included in the daily functioning of the server and will be carried out at a remote-hands rate. Architectural changes may include: change from Apache to Nginx, change of database server, Varnish installation, structure OTAP environments, … The Managed and Managed+ packs therefore include all that concerns the correct functioning of the server. There will not be any additional costs for having your server function normally. Contacting our support for small adaptations, emergency interventions and daily advice will not cost anything extra for Managed and Managed+ clients.

8.3. Critical versus non-critical support Critical support includes matters that block the corrected functioning of the server and require attention at once in order to guarantee a sound service and functioning. This is defined by Nucleus as: defects in the datacenter infrastructure, the Nucleus network, the hardware and the server services which result in a proved unavailability of the supplied services. The services which are described in chapter 6, such as network, hardware, cooling, … are obviously monitored 24/7. Support will be given at once if a failure is established there. All other questions with regard to matters that do not result in unavailability of the supplied services are by definition non-critical questions. They include (non-imitatively):

• all questions in the connection with the use of the offered services; • software support; • configuration changes (which are not necessary to solve a critical problem); • orders & deliveries.

Critical support must always be requested by phone (extra information can obviously be provided by email, such as logs, extra information, …). If critical support is only requested through email, the baseline measurement for the response period will only start from the moment that an employee confirms that he has opened the ticket (and therefore not merely through an automatic acknowledgement of receipt of the ticket).

Versie 4.1 (20150401) - Page 24

Non-critical support can both be requested by phone or by email.

8.4. Paid or free support? All work and costs connected to solving failures which are covered by the ULA (see chapter 6 on page 16), are non-paid services. If a client reports a failure through the emergency number which is not covered by the ULA, this will be reported to the client and the option will be offered to further handle this ticket as 2nd line support, whether or not this is paid support according to your service pack. The services which are stated in the summary table (see point 8.1) as included, are non-paid services or already included in the fixed monthly price. In brief, it means that Essentials and Essentials+ are unmanaged packets, whereby you yourself guarantee the management of the server or rely on our services at payment of the hourly rate that you can find in your contract. Managed and Managed+ imply that Nucleus will take all actions to manage your server, without any restrictions under a Fair Use Policy1.

8.5. 24/7 emergency number As a dedicated server, Open or VMWare server client you also have access to a 24/7 number, to which you can report critical failures. The person on the line is a qualified system engineer who has been trained to answer all your questions. So there are no unnecessary waiting times through a call center and escalation of tickets. You can always find your emergency number in your online control panel.

8.6. Response period The response period gives you a guarantee about when a qualified employee will answer your ticket. These times vary according to the critical/non-critical nature of the ticket and the service pack that you purchased with your server.

1 For Managed and Managed+ service packs there is no restriction on the number of hours of support offered by us. However, we reserve the right to restrict the supplied support if you deviate more than 50% from the average use of our support services per service pack. You will be informed about this in advance.

Versie 4.1 (20150401) - Page 25

Critical support must always be requested by phone (extra information can obviously be provided by email, such as logs, extra information, …). If critical support is only requested through email, the baseline measurement for the response period will only start from the moment that an employee confirms that he has opened the ticket (and therefore not merely through an automatic acknowledgement of receipt of the ticket). For non-critical support the measurement only runs during office hours. For critical support the measurement runs from the correct application of the problem, 24/7. The measurement of the response period ends as soon as an employee starts to work on the ticket.

8.7. Solution Goal It is difficult to give an absolute guarantee for recovery periods in the IT sector. They greatly depend on the established problem. However, the objective is that the recovery period should not exceed the initial response period, that is to say with regard to offering a work-around solution, except when a restore has to take place. Since a restore of a backup greatly depends on the amount of data, the moment that the restore procedure has started is regarded as the point of recovery for a restore of a backup. The Solution Goal is therefore the guaranteed period that we offer you a solution, which either concerns a correction of the problem or a solution with which you can continue your work temporarily.

8.8. Updates and patches Every month your server is checked to see whether the Operating System and the software designated for maintenance and installed by Nucleus have to be updated. The standard maintenance window for this is every Tuesday morning between 05.00 and 07.00 hours. Critical updates are installed within 24 hours, after informing the client. Patch management is performed at Nucleus by qualified personnel who log-on into your server itself and carry out the updates and then check to see whether they were installed successfully. The correct functioning of the server is also checked. So we do not make use of a one-size-fits-all solution, whereby updates are centrally deployed on all servers in an automatic way. One week before we plan to place updates on your system you will be informed through an e-mail (technical contact persons). You then have 6 days to postpone these updates to a later moment, if that suits you better. You will also be informed when we have finished the updates on your server.

Versie 4.1 (20150401) - Page 26

8.9. Server management For Managed and Managed+ clients we manage the servers without any support restrictions. We provide a total solution. This implies updating and monitoring your server (updates, patches, monitors, monitoring alerts, security, …) every day as well as supporting our clients with regard to server management. Advice and DevOps support is also included. Major changes such as architecture changes or a rearrangement of the structure are not included in the daily functioning of the server and will be carried out at a remote-hands rate. The Managed and Managed+ service pack therefore includes all that concerns the correct functioning of the server. There will not be any additional costs for having your server function normally. Contacting our support - both for small adaptations, emergency interventions and daily advice will not cost anything extra for Managed and Managed+ clients.

8.10. Infrastructure monitoring The entire Nucleus infrastructure is monitored 24/7 by our Network Operating Center. This includes the work for all common infrastructure, such as datacenter infrastructure (including power and cooling) and the Nucleus network (including all Nucleus switches, routers and uplinks). A failure of one of these components will result in an alarm which will be considered as critical at once, without informing the client. Servers and equipment of the client himself are not covered by infrastructure monitoring.

8.11. Basic monitoring Basic monitoring includes monitoring the functioning of the server of the client. Basic monitoring is performed agentless, so completely on an external basis. The following services are tested every 30 seconds, if applicable and if requested by the client:

• ICMP (ping) + packet loss • POP3, IMAP and SMTP • http(s) • SSH/remote desktop • TCP port checks (indicated by the client) • RBL Blacklist checking • Forward/Reverse DNS match on server IP

At most 15 services can be checked for each basic monitoring pack. The client can offer unlimited email addresses and at most 3 GSM numbers to which an alert can be sent (through email and SMS).

Versie 4.1 (20150401) - Page 27

If the client has a Managed(+): • the alerts are monitored 24/7 by Nucleus; • the alerts which result in critical support are monitored at once, without the requirement

of informing the client. The client will be informed later about the actions taken by Nucleus;

• if required, the alerts can also be sent to the client. In other cases the client is responsible for informing Nucleus (considering the provisions regarding critical/non-critical & paying/non-paying support).

8.12. Advanced monitoring & trending Advanced monitoring includes basic monitoring plus the following matters (if applicable):

• CPU load (alert > certain load) • Disk capacity (alert with certain % free space) • Memory load (alert > certain load) • Content check of a certain webpage • Detail-checks per service (for example, MySQL, Apache, Nginx, PHP, Memcached,

Lighttpd, Mailqueues, …) Advanced Monitoring takes place on the basis of an agent, software which must be installed your server. If you have a Managed(+) service pack, this will be done by our services and we guarantee its functioning. For Essential+ service packs the client must install this himself on the instruction of Nucleus and Nucleus cannot offer a guarantee on the functioning of this agent. The client can give unlimited email addresses and at most 3 GSM numbers to which an alert can be sent (through email and SMS). The client also has a login on the monitoring system whereby diagrams can be consulted of the monitors, so that the trend over the past months can give a prediction about the required resources in the future. For Managed and Managed+ clients it applies that Nucleus will also intervene when the advanced monitoring indicates a problem with resources, where or not in the near future. If the client has a Managed(+):

• the alerts are monitored 24/7 by Nucleus; • the alerts which result in critical support are monitored at once, without it being

necessary to inform the client. The client will be informed later about the actions taken by Nucleus;

• if required, the alerts can also be sent to the client. In other cases the client is responsible for informing Nucleus (considering the provisions regarding critical/non-critical & paying/non-paying support).

Versie 4.1 (20150401) - Page 28

8.13. Trending surveillance For Managed+ clients a system engineer of Nucleus will examine and interpret the diagrams and reports every month and offer advice in the medium and long term. In this way you can be sure that you can plan for further expansions on time. In addition, you can be sure that if certain reports use may refer to a possible problem, this will be examined by a system specialist who will take action, if necessary.

8.14. External Monitoring Upon request Managed+ clients can also make use of the external monitoring of the uptime of at most 3 services per department. Nucleus believes in transparency and in the quality of our services and proves this by its external checks. This external monitoring agency is appointed by Nucleus as a third party and an independent party. Nucleus does not have any links with this external monitoring service and does not give any guarantees regarding their service, but obviously will select a service provider with much experience and who is worthy of your trust.

8.15. Backup check This section only applies to the Managed and Managed+ service packs. This check includes investigating whether the planned backup procedures have worked and the backups were concluded with a confirmation (an OK). If there is an error report on the backup routine, this error will be examined. If it concerns a critical failure, the backup will be carried out again. If this backup check is not included in the service pack, the client remains fully responsible for checking the backup and Nucleus does not assume any responsibility for whether a possible restore correctly or not. This backup check includes the check on all backups which are offered in the contract, such as the online backup (data backup) and/or the snapshot backups2.

8.16. Restores Nucleus can restore a backup upon request of the client or in the event of a serious failure.

2 Snapshot backups are only possible on cloud servers.

Versie 4.1 (20150401) - Page 29

If this is not included in the service pack, this will be done in the form of paid support. If it is included is in the service pack, the number of restores per month is limited to two. Extra restores are available as paid support. Nucleus is not responsible for the correct functioning of the restores when the backup check is not included in the purchased services (see point 8.15).

8.17. Alert handling The alerts generated by the monitoring are monitored by:

• the client in case of Essentials+ pack • Nucleus in case of a Managed and Managed+ pack

Alert handling means that Nucleus for Managed(+) service packs will do all that is necessary to monitor and solve the problem according to the current response periods and solution goals. This service applies to Managed(+) service packs 24/7. After establishing the problem a classification will be made according to the principle of critical or Non-critical support and this will be handled accordingly.

8.18. Traffic reporting Through the control panel each client can receive a summary of the incoming and outgoing traffic for the IP’s allocated to him. This summary offers a measurement per 5 minutes in the form of a diagram and a table. There is also a summary of the top 10 per protocol. These figures only measure the traffic that is actually routed to and from the internet. It does not measure the internal traffic. These figures are accepted by all parties as the only correct figures with regard to establishing the used volume, which may result in additional invoicing if more was used than what was laid down in the contract. A summary of these figures is also stated in the monthly report.

8.19. Resource use Resources are measured with an agent, which is software that must be installed on your server. If you have a Managed(+) service pack, this will be done by our services and we guarantee its functioning. For Essential+ service packs the client must install this himself on the instruction of Nucleus and Nucleus cannot offer a guarantee regarding the functioning of this agent. The report of the resource use will be published in your monthly report and concerns the reporting of the advanced monitoring.

Versie 4.1 (20150401) - Page 30

8.20. Incident reporting In the monthly report you will receive a summary of all support tickets that were opened. This reporting includes the ticket number, the date, the status and a brief summary. Details of the tickets can always be consulted online 24/through your control panel.

8.21. Root Cause Analysis A root cause analysis is carried out in case of serious security incidents. A first system engineer will describe the problem, together with the steps taken and the necessary suggestions to solve the problem permanently. A second system engineer will check these findings and draw the necessary conclusions and, if required, confirm the steps to be taken. This entire phase is also included in your monthly report.

8.22. Report analysis and executive summary Each month a senior system admin will check all tickets and RCA’s. On the basis of this he draws up an executive summary of what has happened, which steps have been taken and of the KPI’s of the service pack. It is even more important that this senior system admin keeps an overview of your project and seeks improvements proactively on the basis of the reporting and also recommends them in the executive summary.

8.23. Advanced services Our Managed+ clients can be guaranteed that our service packs greatly differ from other service packs. Upon request and in consultation with the client we can carry out extensive tests, with a maximum of twice a year. These tests may involve security, penetration testing and load testing. These tests are carried out by our own qualified personnel on the spot. On the basis of these tests an extensive report will be drawn up and the results will be discussed with you during a conference call, together with the security officer and senior system engineer involved.

Versie 4.1 (20150401) - Page 31

This security test can be extended to a full OWASP-10 testing & reporting, providing this is done in the form of a supplement.

Versie 4.1 (20150401) - Page 32

9. Delivery and installations

9.1. Delivery server As a standard a dedicated server is supplied within two weeks and a cloud server within 48 hours. Colocation installations usually take place within one week after the order. Departures from these normal delivery times cannot be a reason for a breach of contract if this has been discussed with the client on time. Nucleus cannot be held responsible for delayed deliveries by its suppliers, but will always communicate about this as soon as information is available.

9.2. Software installation With the delivery Nucleus will install the Operating System as selected by the client, according to the specifications which were established by mutual consultation. For the installation of a new server an employee of Nucleus will contact the technical staff-member of the client to discuss the delivery. Installations of software, such as a standard LAMP environment or a standard Windows/MSSQL environment, are also part of the set-up. The subsequent configuration and/or installation of accompanying software will be done by the client or upon request by Nucleus under the prevalent support rates or accompanying credits of the first month.

Versie 4.1 (20150401) - Page 33

10. Acceptable Use Policy

10.1. Access to the systems Nucleus reserves the right to have access to all systems that are placed in its network without prior permission. This will only be done for check and maintenance. Nucleus will hereby always act with due care and diligence and always treat the content of the systems of the client confidentially, unless a court order forces Nucleus to take other actions.

10.2. Abusing the server If Nucleus receives reports about any abuses regarding the server of the client, Nucleus is entitled to block the access of the server to the internet at once and without prior warning, if there are serious indications that the report is founded. An attempt will first be made contact the client before proceeding with this action, however if this is not done this cannot result in suspending this step to be taken in any way whatsoever. Examples of abuse include:

• Sending spam • Carrying out attacks on other systems (both within and outside the Nucleus network) • Hosting phishing sites • Hosting copyright material without permission of the entitled party/parties. • Hosting child pornography • Using the server in illegal actions • Hosting malicious code • …

The internet connection will be suspended until the client takes action to stop the challenged actions. When the server of the client is under fire of a network attack, Nucleus will also reserve the right to block the traffic from and to the IP’s of the client on its border routers. However, this will only be done in special cases if the stability of the Nucleus network is at risk and/or if other clients are inconvenienced. All costs caused by abusing the server will be recovered from the client.

Versie 4.1 (20150401) - Page 34

11. Compensations and statutory provisions

11.1. Compensation when not realising the ULA As stipulated in the general terms and conditions in the contract, Service Levels are calculated as indicated in point 7.1. Unless laid down otherwise in the contract, the credit points are calculated as follows:

A = (L – P)

If In this case the penalty is the following percentage of Q A ≤ 0.5% 5%

0.5% < A ≤ 1% 10% 1% < A ≤ 2.5% 15% 2.5% < A ≤ 5% 25%

A > 5% 50%

A =departure from the contractually laid-down percentage of availability L = the contractually laid down percentage of availability P = the actual percentage of availability Q = the charges which have been laid down contractually for the service in question according to which this availability is calculated. As laid down contractually in the general terms and conditions, the granted credit will never exceed 50% of the subscription of the service in question.

11.2. Difference between ULA and service pack description The service pack description shows the guarantees on our service. The ULA shows the uptime of the product. The guarantees that are given within a service pack description can never be stricter than the ULA of the underlying product. In other words, when a solution goal of 30’ applies according to the service pack description, but the underlying product has an ULA with a maximum unavailability of 44’, the calculation will only be based on the lowest guaranteed figure.

11.3. Submitting the claims All claims with regard to the given service levels must be sufficiently motivated and sent to the registered office of Nucleus within 15 days after the occurrence of the failure in a registered letter.

Versie 4.1 (20150401) - Page 35

11.4. Relationship with general terms and conditions This document will be read as a technical commercial supplement to the contract and will not affect the terms which are included in the contract itself. This document contains a general description of the services supplied by Nucleus. Departures are only valid if they are accepted by both parties as an addendum to the contract.