Terms of Service
Last updated: 21 October 2026
1. Provider and applicability
securityserver.io is operated by CloudExp OÜ, Estonian registry code 16263842, registered address Juurdeveo tn 18-9, Kesklinna linnaosa, 11313 Tallinn, Harju maakond, Estonia (“we”, “us”). Contact: support@securityserver.io. These terms govern the website, dashboard and hosted X-Road security server service.
The service is offered to organisations for business or professional use only, not to consumers. Anyone creating an account must be at least 18 and authorised to represent the organisation. An individually signed Service Agreement prevails where inconsistent, followed by the Data Processing Agreement for personal data processing, the Standard Service Terms for technical service arrangements, and these Terms of Service, unless the individually signed agreement establishes a different priority.
2. Service and limitations
We host and operate a dedicated X-Road security server for the customer. You remain the X-Road member and are responsible for your membership, subsystems, connected information systems, lawful data exchange and permissions. We are not the X-Road centre or a certificate issuer. Unless separately agreed, we do not provide a hardware security module (HSM) or issue certificates; you obtain certificates from the relevant trust service provider.
Provisioning and membership or certificate timelines may depend on third parties. The exact scope, security measures, support, maintenance and any service-level commitments are set out in the Standard Service Terms or a separate contract. No particular uptime percentage is guaranteed by this document.
3. Accounts and authority
You must provide accurate current information, protect authentication credentials and limit access to authorised people. Individual accounts must not be shared. Notify support@securityserver.io promptly of security incidents or unauthorised access. To the extent legally permitted, your organisation is responsible for actions performed by its users.
4. Prices and billing
Each server is billed monthly in advance at the price displayed at checkout. CloudExp OÜ is not registered for VAT, so prices include no VAT. If we register for VAT, we will tell you and show VAT in the price before it applies to you. Payments are handled by Stripe. Subscriptions renew automatically until cancelled. No standard free trial applies unless expressly offered. We provide at least 30 days’ notice of recurring price increases, and you may cancel before they take effect. See the Refund and Cancellation Policy.
5. Permitted use and customer responsibilities
Use the service only for lawful X-Road data exchange. You must not attack or unreasonably overload the service or other customers, circumvent security controls, distribute malware, access systems without authorisation, transmit unlawful material or resell the service without our prior written permission. You must follow the rules of the applicable X-Road instance, ensure a valid legal basis for processing personal data, and maintain and renew your certificates. Automated reminders do not replace your own obligations.
6. Our responsibilities and service changes
We provide the service with reasonable professional care and apply appropriate technical and organisational safeguards. We may perform maintenance and updates to maintain security and reliability. Where practicable, we notify you in advance of significant planned changes that reduce paid functionality. External registration, trust and data-exchange services are outside our control.
7. Suspension and termination
We may suspend access or a server where fees remain unpaid, these terms are breached, significant security risks exist or suspension is required by law. Where practicable, we will notify you and allow remediation; immediate action may be necessary for urgent risks.
When a subscription ends, the running server and its disks are deleted at once, and its backups are permanently deleted 30 days after suspension begins. Subscribing again within that time sets up a new server; old data is not restored automatically. You may cancel effective at the end of the paid period under the Refund and Cancellation Policy. Before termination, arrange to retain any necessary data and configuration. No additional post-termination export period or unverified export feature is promised. You are responsible for X-Road deregistration and certificate revocation.
8. Personal data
See our Privacy Policy for account and website data. The Data Processing Agreement governs processing on your behalf through the hosted security server. You remain responsible for the legal basis for your processing and required information to data subjects.
9. Intellectual property
The website, dashboard and proprietary service elements belong to us or our licensors. You receive a limited, non-exclusive right to use them during the service term. NIIS open-source X-Road software remains governed by its own licences. Your rights in your data are not transferred to us; we process it as needed to provide the service.
10. Liability
Each party is responsible for breach according to the agreement and applicable law. To the extent permitted by law, we are not responsible for indirect loss, lost profits or interruption attributable to you or third parties. Our aggregate liability arising from an event or connected series of events is limited to the fees actually paid for the affected server during the 12 months preceding the event, except where a limitation is legally prohibited, including intentional misconduct. Nothing removes mandatory statutory rights. An individually signed agreement may allocate liability differently.
11. Changes to these terms
We give at least 30 days’ advance notice of material amendments, except where urgent legal or security reasons require faster action. If you disagree, you may terminate before the change takes effect. Changes do not retroactively alter accrued obligations.
12. Governing law, disputes and language
Estonian law governs. The parties will first seek an amicable solution; otherwise disputes are heard by the competent Estonian court, subject to mandatory jurisdiction rules. The Estonian and English versions are intended to have equivalent meaning. If they differ, the Estonian version prevails, unless an individual contract provides otherwise.