Responsibility for server data and backups

This article summarizes what the Terms and Conditions and the Data Processing Agreement (DPA) say about the data on your server: who is responsible for the content, the security, the backups and the personal data of your users. You can open both documents from the footer of any blackbox.md page, with the “Termeni și condiții” (Terms and conditions) and “Acord privind prelucrarea datelor” (Data processing agreement) links.

Available to: the holder of a BLACKBOX server (VPS or dedicated server), including companies that host their own users' data on it.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

Note This is a summary. The legally binding text is the one on the blackbox.md/info/terms and blackbox.md/info/dpa pages, in Romanian.

In brief: who is responsible for what

Your server: content and security

The server comes with root access: you install the applications and manage the users, the SSH keys and the updates. Chapter 3, “Răspunderea Clienților” (Customer liability), of the Terms states that:

• you are fully responsible for your own activity and for that of everyone you give access to: employees, contractors, visitors of the hosted resources;
• you are responsible for securing your passwords, SSH keys, API tokens and second authentication factor, and for keeping them confidential;
• if a violation is found (through an external report, automated monitoring or an internal audit), BLACKBOX may suspend or terminate the services, fully or partly, with or without prior notice, depending on how serious it is.

What is not allowed on the server: Acceptable use policy: what is not allowed. How to protect your server: Securing a new server: checklist. If your server has been hacked: Your server was hacked or is under attack: what to do.

Besides you, two tools can carry out actions on the server, but only at your request:

• The panel. Actions such as “Reset password” or “Add SSH key” run on the server with the key shown in the list as “Management key (blackbox.md)”. See BLACKBOX keys on your server.
• The AI assistant. An AI assistant connected with your API token runs commands on your behalf. Under chapter 3, you are responsible for the people you give access to and for keeping your tokens confidential. See Token and AI agent security.

Your users' personal data

If a website, an online store or an application that processes personal data runs on your server (for example, your visitors' accounts and orders), the roles are:

Chapter 8, “Date cu caracter personal” (Personal data), of the Terms: “Clientul este responsabil pentru respectarea legislației aplicabile în ceea ce privește datele personale pe care le procesează în cadrul Serviciilor găzduite la BLACKBOX (de exemplu, datele utilizatorilor finali ai unui website Client).” (The Customer is responsible for complying with the applicable legislation regarding the personal data it processes within the Services hosted at BLACKBOX (for example, the data of the end users of a Customer website).)

The DPA sets out how BLACKBOX processes this data:

• Only on your instructions, that is, according to the configuration you chose when ordering and your settings in the panel.
• No access to content: “Nu accesăm și nu citim conținutul aplicației dvs., cu excepția cazului în care este necesar pentru suport tehnic la cererea dvs. explicită, sau atunci când legea ne obligă (caz în care, dacă nu ne este interzis prin lege, vă vom informa în prealabil).” (We do not access or read the content of your application, except when this is necessary for technical support at your explicit request, or when the law requires us to (in which case, unless the law prohibits it, we will inform you in advance).)
• Incidents: if the security of the hosted data is breached, BLACKBOX notifies you without undue delay, so that you can fulfill your obligations as controller (Articles 33–34 of Law No. 195/2024).
• Reasonable assistance: with security, incident notification, impact assessments and your users' requests regarding their rights, as far as technically possible at the level of the hosting infrastructure.

You accept the DPA together with the Terms when you activate a service, with no separate signature. If your company needs a signed copy, write to support@blackbox.md. Details: Data Processing Agreement (DPA) for companies.

Impact assessment (DPIA)

If the processing in your application requires a data protection impact assessment (Article 35 of Law No. 195/2024), the controller carries it out, that is, you: BLACKBOX does not know what data your application processes. The assessment is done before the processing starts, in particular for automated profiling with legal effects on people, large-scale processing of special categories of data, or systematic, large-scale monitoring of a publicly accessible area. If you need information about the infrastructure for the assessment, write to us.

Backups and data loss

BLACKBOX currently offers no automatic backups and no snapshots. The “Backups” button on the server card, on the “My Servers” page of the app.blackbox.md panel, is not active: if you click it, the error message backup_extra_disabled appears. The server is not affected. The DPA's mention of backup “dacă este activat de dvs.” (if enabled by you) does not mean that BLACKBOX makes copies: no such service exists at the moment, so the only copies are the ones you set up yourself.

Chapter 9, “Limitarea răspunderii” (Limitation of liability), of the Terms states that BLACKBOX “nu răspunde pentru daune indirecte, pierdere de profit, pierderi de date sau întreruperi de activitate suferite de Client sau terți” (is not liable for indirect damages, loss of profit, data loss or business interruptions suffered by the Customer or third parties). To the extent permitted by law, BLACKBOX's total liability is limited to the amount paid for the affected Services in the 12 months before the incident. This limitation does not apply in cases of willful misconduct or gross negligence on BLACKBOX's part.

Important The only copies of your data are the ones you make yourself. Keep at least one copy outside the server: at another provider, on your computer or on a NAS. A copy in another directory on the same server disappears along with the server.

What to back up, where to keep it and how to automate it: Backup strategy for your server. If you want the BLACKBOX team to set up the backups, that is a professional service with a separate offer: Professional services on request: administration, DevOps, migration.

Before you delete a server or your account

Irreversible A deleted server cannot be recovered, not even by the BLACKBOX team. Copy your data off the server before any of the actions below.

Before you delete anything:

1. Copy your files, database dumps and configuration files off the server: Transferring files to the server (scp, rsync, SFTP).
2. Check that you can restore from the copy, for example by importing the database on another server.
3. Move the domains and services that use the server's IP address: after deletion, the address may be assigned to another server.
4. Only then delete the server: Permanently deleting a server.
5. If you are also closing your account, first download your account data with “Descarcă datele mele” (Download my data) (Downloading your data (“Datele mele”)). The full sequence: Closing your BLACKBOX services: the steps in the right order.

Under the DPA, when the service ends, the hosted data is deleted or, if you choose, returned to you. If you need it returned, write to support@blackbox.md before you delete the server or cancel the order.

Frequently asked questions

Does BLACKBOX back up my server? No. There is currently no automatic backup service; you make the copies yourself, outside the server.

Can BLACKBOX employees read the files on my server? Under the DPA, BLACKBOX does not access the content of your applications, except for technical support you explicitly request or a legal obligation. Panel actions run on the server only when you request them.

My server is marked “Managed”. Do the same rules apply? Servers marked “Managed” are administered by the BLACKBOX team. To find out what the team does on them, including whether it makes backups, ask support: How to contact BLACKBOX support.