Hikube service agreement

Internal Ref.: 003-HikubeServiceDetails, Edition: October 2025

HIDORA SA (CHE-286.910.173) – Avenue des Morgines 12, 1213 Petit-Lancy, Switzerland

Website : https://hidora.io/

HIDORA SA, CHE-286.910.173, Avenue des Morgines 12, 1213 Petit-Lancy (Switzerland),

hereinafter referred to as « HIDORA »,

[Client], [identification complète],

hereinafter referred to as « Client »

Collectively, the << Parties >>

Object and contractual documents

These HIKUBE Special Terms and Conditions (the “HIKUBE STCs”) govern, together with the documents listed below, the provision by HIDORA of the cloud infrastructure and platform services “HIKUBE,” as well as associated services (support, backups, managed options, and integration projects).

Applicable documents (in descending order of precedence) :

The Order(s) or Statement(s) of Work (SOW) approved by the Client (quantities, durations, prices, and options) ;

lThese HIKUBE STCs ;

HIDORA SA’s General Terms and Conditions (the “GTCs”), including their appendices (Hosting SLA, Notice & Action Procedure, Data Processing Agreement/DPA, Confidentiality/NDA) ;

Technical documentation published on the HIDORA Portal and/or attached to the Orders ;

The “HIKUBE Service Sheet” (summary), as updated from time to time for technical, security, or operational reasons, in accordance with the documentation update rules of the GTCs (operational rank).

Hierarchy : In case of conflict: (i) Special Terms of an Order/SOW, (ii) these HIKUBE STCs, (iii) the GTCs, (iv) commercial documents. Lower-ranked documents are interpreted in a complementary manner.

Functional evolution : HIDORA may publish new HIKUBE components/services or evolve existing ones without materially degrading security or key functionalities. Purely operational updates (service sheets, published SLAs, procedures) are governed by the documentation update regime set out in the GTCs; any substantial change adversely affecting the Client’s essential rights will be notified with reasonable prior notice and will apply only prospectively.

Gateway clause : Terms in capital letters not defined in the HIKUBE STCs have the meaning set out in the GTCs.

Reference language : Unless otherwise specified, the French version prevails. Translations may be provided as a courtesy.

Specific definitions

Outre les définitions des CG, les termes suivants s’appliquent aux CP HIKUBE :

Service description and scope

Summary: HIKUBE provides the resources and services described in Appendix A – HIKUBE Service Sheet (summary).

Location & Sovereignty: HIKUBE is operated from data centers located in Switzerland (currently: Plan-les-Ouates, Gland, and Lucerne), with inter-site redundancy. Ancillary processing (e.g., anti-DDoS, monitoring, support) may involve subcontractors, managed in accordance with the GTCs (Appendix DPA).

Shared Responsibility Model: HIDORA operates and secures the Environment. The Client administers its resources (OS, middleware, applications, IAM, secrets, L7 policies, hardening, backups when not included) and remains responsible for the legality of its processing and content.

Encryption: Optionally, the Client may enable “at-rest” encryption on eligible resources, in accordance with the Order.

Activation of Additional Components/Services: HIDORA may offer additional HIKUBE Services (e.g., new database engines, network features, storage classes, AI/GPU modules) as described on the Portal and/or the HIKUBE Service Sheet. Their activation requires an Order/validation via the Portal. In the absence of specific terms, these HIKUBE STCs and the GTCs (including their appendices: SLA, Notice & Action, DPA, NDA) apply by default to these additional components. Availability targets and credit scales remain those published in the Hosting SLA for the relevant service

Provision, changes, and maintenance

HIDORA may evolve the Environment (hardware/software upgrades, patches, configuration changes) without materially degrading functionality or security. Planned interventions are performed during the Maintenance Windows published on the Portal. Emergency maintenance related to security or stability may be carried out with the best reasonable notice.

The Client accesses HIKUBE via API/CLI/Portal using Client Access credentials (MFA mandatory for administrative profiles, recommended for others). Permissions are granted according to the principle of least privilege.

Security, AUP, and compliance

The Client must at all times comply with the Acceptable Use Policy (AUP) in the GTCs. Prohibited activities include illegal, intrusive, or disruptive actions (malware, DDoS/DoS attacks, scanning, spamming, “bulletproof” hosting, etc.).

HIDORA implements technical and organizational measures in line with industry best practices and its internal policies. HIDORA SA is ISO/IEC 27001 certified; this certification applies to the scope indicated on the current certificate, which the Client may review upon request. HIDORA strives to maintain this certification for the duration of the HIKUBE STCs and informs the Client of any material changes to its status or scope. HIDORA may limit or suspend a Service to protect the Environment, comply with an injunction, or in case of a manifest violation.

LPD/GDPR Compliance: Processing of Personal Data is governed by the Data Processing Agreement (DPA) appended to the GTCs. The Client must ensure it has an appropriate legal basis and informs the data subjects. International transfers rely on mechanisms recognized by the DPA (e.g., EU SCCs + Swiss addendum, adequacy decision).

Personality Rights and Third-Party Content: HIDORA applies the Notice & Action Procedure of the GTCs in the presence of credible claims of rights infringement (image, voice, sensitive data, defamation, IP, trade secrets).

SLA, support, and proof agreement

Availability Targets: The availability objectives, measurement method, exclusions, and Service Credits are those specified in the Hosting SLA appended to the GTCs.

Support: Business days 08:00–18:00 CET via Portal/ticket and email; 24×7 infrastructure monitoring and on-call support. Target response times by severity are as published in the SLA. Repair times are not guaranteed unless specifically stated in the Order/SOW.

Proof Agreement: HIDORA’s logs, metrics, and technical records are conclusive, except where contrary evidence is provided by corroborating technical data from the Client.

Specific GPU (Passthrough) Exclusion: SLA/MTTR commitments do not apply to Incidents caused by a prohibited operation (section 8.3) or by risks inherent to the Client’s chosen GPU Passthrough; no Service Credit is owed in such cases.

Client obligations

The Client administers its deployments and configurations on HIKUBE, including, without limitation: IAM/RBAC, L7 security, public exposure (networks/ports/domains/IP/CDN), messaging (e.g., Kafka/RabbitMQ) and database schemas/topologies and ACLs; the Client plans and executes backups and restoration tests according to its RPO/RTO objectives and validates application behavior.

The Client manages its software licenses, content, and updates, and ensures regulatory compliance of its activities.

Use of GPUs requires the Client to install and manage the necessary drivers, frameworks, and licenses.

Dedicated GPUs – direct access (passthrough)

Scope: GPU Passthrough consists of presenting a GPU Card directly to a Client’s VM/Pod. This mode grants sensitive hardware privileges and involves increased technical risks assumed by the Client.

Client Administration & Obligations: The Client fully administers the guest OS, GPU drivers, and tools; ensures hardening, updates/patches, access management, and necessary logging.

Strictly Prohibited Operations: The following are prohibited unless prior written approval is obtained from HIDORA:

Flashing/upgrading/downgrading GPU firmware/vBIOS/microcode or the host server;

Unvalidated hardware/PCIe/SR-IOV/ACS reconfigurations or re-binding;

Installation/activation of rootkits, kernel modules, or tools intended to bypass the hypervisor or disable integrity controls.

Safety Measures and Suspension: In the event of a serious and imminent risk to hardware/infrastructure, HIDORA may immediately suspend the affected Service and notify the Client without delay.

Material Breach and Termination: Any violation of section 8.3 constitutes a material breach, entitling HIDORA to terminate the Service (or the Contract for just cause) by written notice, without compensation and without prejudice to claims for damages.

SLA Limits: SLA/MTTR commitments and Service Credits do not apply to Incidents caused by a prohibited operation (section 8.3) or by risks inherent to GPU Passthrough chosen by the Client.

Support and Billing: Any HIDORA assistance relating to Client-managed elements may be billed according to the applicable rates.

Price, billing, and taxes

Pricing Model (PAYG – HIKUBE): Prices (excluding taxes) are those published on the HIDORA Portal and/or specified in the Order. Unless expressly stated otherwise (e.g., prepaid credits, reservations, discounts), HIKUBE Services are billed on a consumption basis (PAYG) according to HIDORA counters.

Consumption Measurement: Usage is measured and aggregated by HIDORA counters; units, billing steps, prorating, and rounding rules are those published on the Portal. In case of discrepancies between the Client’s internal measurements and HIDORA’s, HIDORA’s measurements prevail, except in the case of manifest error.

Billing and Due Dates: Billing is done monthly in arrears: an invoice is issued at the end of the month for consumption of the previous calendar month (Europe/Zurich). Project/consulting services, if ordered, are billed based on time spent or milestones, also in arrears, according to the applicable rates. Payment terms, taxes, and currency are governed by the GTCs.

Late Payment and Default: In case of late payment, HIDORA may apply the measures provided in the GTCs (interest, suspension after notice, early maturity, payment guarantees). No refund is due for amounts already paid for credits/reservations or services already rendered, except where mandatory legal provisions apply.

Price Adjustments: HIDORA may adjust applicable rates for future periods in accordance with the GTCs; changes are notified via the Portal and/or by email with the required notice. Past consumption remains subject to the rates in effect at the time of execution.

Restoration Costs (GPU) and Interventions: In case of damage attributable to the Client (notably following a prohibited operation under section 8.3), the Client bears (i) the replacement of the GPU Card and impacted components, (ii) reasonable and documented costs for diagnostics, datacenter intervention, logistics, and labor (time-based, applicable rates), and (iii) services to restore operational conditions. These amounts are invoiced in addition, in arrears, independently of PAYG billing.

Duration, suspension, and termination

The initial term and renewal conditions are specified in the Order. At expiration without renewal, access is suspended.

HIDORA may suspend all or part of the Services in case of a material breach, non-payment, security incident, fraud, request from authorities, or threat to the Environment. Suspension does not affect amounts due.

Termination for just cause is governed by the GTCs, after notice if the breach is remediable.

Reversibility, return, and deletion

Upon expiration or termination, the Client may request the return of its Content in a reasonable standard format; fees may apply. Unless otherwise specified, HIDORA retains the Content for thirty (30) days to allow recovery, and then permanently deletes it within the following thirty (30) days, in accordance with the DPA of the GTCs.

Intellectual property

The Client retains all rights to its Content. HIDORA retains all rights to the Environment, its documentation, scripts, templates, and know-how, including those developed during execution, subject to applicable third-party/open-source licenses.

Subcontracting, location, and transfers

HIDORA may subcontract all or part of the service provision, under its responsibility and in compliance with the DPA appended to the GTCs (register of subcontractors, location, recognized transfer mechanisms for Switzerland/EU).

Commercial references

Unless the Client objects in writing, HIDORA may mention the Client’s name and logo as a reference (without disclosing confidential information). The Client may object at any time by contacting legal@hidora.io.

Notifications and miscellaneous

Notifications: Shall be made in writing (including email) to the contact addresses designated in the Order or on the Portal.

Assignment: The Client may not assign its rights or obligations without HIDORA’s prior written consent, except for non-substantial intra-group assignments. HIDORA may assign in the context of a reorganization or business transfer.

Force Majeure: As provided in the GTCs.

Partial Invalidity: The invalidity of any provision does not affect the validity of the others.

Applying law and jurisdiction

The HIKUBE STCs are governed by Swiss law, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG).

The exclusive jurisdiction is in Geneva, subject to legal remedies before the Swiss Federal Supreme Court according to applicable law.

Each Party confirms its acceptance of the HIKUBE STCs and the documents referenced therein.

HIDORA SA Place and Date :
Client Place and Date :

HIDORA SA – All Rights Reserved

Appendix A – HIKUBE Service Sheet (summary)

Included/Optional Components:

Purpose

This appendix sets the framework for classifying HIKUBE Components (included/optional) without establishing a fixed list.

Classification and Activation

Any component identified as such on the HIKUBE Service Sheet and/or the HIDORA Portal at the time of Service activation is included; any component requiring specific activation via Order or Portal, which may involve separate pricing and/or a distinct SLA, is optional.

References and Documentation Hierarchy

For each component, technical specifications, consumption metrics/units, prerequisites, and Managed Service scope are those published and updated on the HIKUBE Service Sheet and/or the HIDORA Portal. In case of discrepancies, the Order, HIKUBE STCs, and GTCs prevail for contractual obligations and SLAs; the Service Sheet/Portal prevails for technical specifications and metrics.

Component Families (non-exhaustive, illustrative)

Linux/Windows VMs (scalable instance families) and block storage (replicated/encrypted); managed Kubernetes (LB Services, PV, kubeconfig, Ingress-NGINX options, cert-manager, FluxCD, Velero, Passthrough GPU); S3 object storage; managed databases (PostgreSQL, MariaDB/MySQL, Redis); messaging (Kafka, RabbitMQ); managed VPN; dedicated GPUs (models subject to availability); backups & DR plans (plans, retention, restore tests).

This list is illustrative; refer to the Portal/Service Sheet for current details.

Lifecycle and End-of-Life (EOL)

HIDORA may add, modify, replace, or remove components in accordance with the documentation update rules of the GTCs. Changes do not materially degrade key functionalities actually used by the Client; reasonable notice and, where applicable, appropriate migration measures are provided (except in case of security urgency/legal requirement).

Location

HIKUBE Services are provided from data centers located in Switzerland; sites may change for redundancy, maintenance, or security reasons, without transfer outside Switzerland without the Client’s written consent, except in security emergencies or legal obligations.

Shared Responsibility:

HIDORA: Infrastructure availability, standard environment maintenance, Environment security, SLA, 24×7 monitoring.

Client: IAM/RBAC, L7 security, application lifecycle (manifests/Helm), public exposure, Kafka/RabbitMQ/DB schemas/policies, restore tests, regulatory compliance.

Encryption:

Optional at-rest encryption on eligible resources.

Support :

Business days 08:00–18:00 CET (Portal, email). 24×7 infrastructure on-call. Target response times by severity (High ≤ 1h; Normal ≤ 2h; Low ≤ 8h) as per the SLA in the GTCs.

SLA (summary) :

Availability per Service as published in the SLA; exclusions: announced maintenance, force majeure, use contrary to the AUP, components not provided by HIDORA. Service credits applied to subsequent invoices (exclusive remedy for covered downtime).

Security & Compliance:

Technical and organizational measures aligned with industry best practices; ISO/IEC 27001 certification within the certified scope; DPA (LPD/GDPR, subcontractors, transfers, breaches) appended to the GTCs. Notice & Action procedure for rights infringements.

HIDORA SA – All Rights Reserved