Three parties share responsibility. The supplier runs the data center: physical security, power, cooling, hardware, network backbone and, for virtual products, the hypervisor. BroadNet Cloud runs your account, the accuracy of your quote, access requests, support, any configuration we perform and incident communication to you. You own your data, users, keys and, on unmanaged products, the operating system and applications.
The three parties and what each one does
BroadNet Cloud is the hosting and cloud brand of BroadNet Technologies LLC. We design, quote, provision and support infrastructure that runs in established third-party data centers and cloud platforms. That delivery model means three parties touch every service, and each needs a clear boundary.
BroadNet Cloud
- Your account, contacts and who may act on it.
- Quote accuracy: the specification, supplier, region and terms in writing.
- The access process: identity checks before any change or credential reset.
- Support handling: logging, tracking and escalating your cases to the supplier.
- Configuration we perform, such as an OS install or a firewall we build, recorded and handed over.
- Telling you about incidents that affect your service.
The supplier
- Physical security of the facility and its access control.
- Power, cooling and fire protection.
- Servers, disks and network hardware, and their replacement.
- The network backbone up to your server or virtual network.
- The hypervisor and control plane for virtual products.
You
- Your data and what you are allowed to store.
- Users, passwords, MFA and SSH or API keys.
- On unmanaged products: the operating system, patches, firewall rules and applications.
- Backups and restore tests, unless you bought backup from us.
- Your own legal and regulatory obligations.
The supplier for your service is named in your quote. We do not name suppliers on this site while contracts are being finalized.
Responsibility by product
The split changes with the product. On managed hosting we take on the operating system; on bare metal you have the whole machine. Where a row says "Confirmed at quote", the quote decides and states it.
| Product | Hypervisor or hardware | Operating system and patches | Applications | Backups |
|---|---|---|---|---|
| Shared hosting | Supplier | Supplier / BroadNet Confirmed at quote | You | Confirmed at quote |
| VPS | Supplier | You | You | You unless bought |
| Virtual server | Supplier | You | You | You unless bought |
| Managed hosting | Supplier | BroadNet scope in quote | You | BroadNet if included |
| Cloud hosting | Supplier | You unless managed | You | You unless bought |
| Bare metal | Supplier (hardware only) | You unless managed | You | You unless bought |
| GPU hosting | Supplier | Drivers and base image confirmed at quote | You (models, serving stack) | You unless bought |
Some areas are the same for every product:
| Area | BroadNet Cloud | Supplier | You |
|---|---|---|---|
| Physical security, power, cooling | - | Responsible | - |
| Network backbone | - | Responsible | - |
| Account and authorized contacts | Responsible | - | Keeps the list current |
| Quote accuracy | Responsible | Confirms supply | Checks before signing |
| Support case handling | Responsible | Resolves its layer | Raises cases |
| Incident communication to you | Responsible | Notifies us | Keeps contacts reachable |
| Data, users, keys | - | - | Responsible |
The reasoning behind these splits is in the shared responsibility guide.
How we handle access to your account
The most common way into a hosted system is not a technical exploit. It is someone persuading a support desk to reset a password or add a user. So we treat every access request as a security event.
- Named contacts only. At setup you tell us who may request changes. We act only for people on that list.
- Verify through a second channel. A request by email is confirmed by phone to a number on file, or the other way round, before credentials are issued or reset.
- Least access. We hold only the access needed for what we were asked to do, and remove temporary access when the job is done.
- Record. Every change we make is noted against your account with who asked and when.
Your part is to keep the contact list current, remove people the day they leave, and use MFA on everything you log into.
When something goes wrong
If the supplier reports an incident that affects your service, or we find one, we tell your named contacts what is affected, what is known, what you should do, and when we will next update you. We keep updating until it is closed. If you find an incident on your side, such as a compromised account, tell us at once so we can help contain it at the layers we control.
Our incident handling follows the structure in NIST SP 800-61 Rev. 3 and the NIST Cybersecurity Framework 2.0: prepare, detect, respond, recover, and learn from it. Specific notification time targets are not published yet; they will be set in supplier contracts and then in your quote.
Reliability: what we will publish, and when
The hosting offer is new. We would rather tell you what is planned than imply a track record we do not have.
| Item | Status | What it will contain |
|---|---|---|
| Public status page | Planned | Current state of each service and region, with dated incident updates |
| Incident write-ups | Planned | For significant incidents: timeline, cause, impact, and what changes as a result |
| Availability targets | After supplier contracts are signed | Per-product targets and the credit terms, written into quotes |
| Measured performance | Method published | Results from the benchmark method once customer plans are live |
Until those exist, the commitments that apply to you are the ones written in your quote. Measurements we have already made, of our own build server and this website, are on the evidence hub.
How to report a vulnerability
If you think you have found a security problem in this website, in a service we run, or in how we handle accounts, please tell us.
- Email sales@broadnetcloud.com with the subject line Security report. A dedicated security address is planned and will be listed here when it is live.
- Describe what you found, where, how to reproduce it, and what impact you think it has.
- Do not access, change or delete data that is not yours, and do not run tests that degrade service for others.
- Give us reasonable time to fix the issue before you publish details.
We will acknowledge your report, keep you updated and tell you when it is fixed. This follows the coordinated disclosure approach described in ISO/IEC 29147. We do not run a paid bug bounty. A security.txt file under RFC 9116 is planned for this site, so that the reporting address can be found by standard tools. For issues in a supplier's platform, we will pass your report to the supplier and tell you that we have.
What we do not claim
- No certifications. BroadNet Cloud does not hold ISO/IEC 27001, SOC 2, PCI DSS or any other security certification today. Where a supplier holds attestations, we share what it makes available with your quote. See secure hosting for what evidence to ask for.
- No availability percentage. We do not publish an availability figure until supplier contracts are signed and we can stand behind it in writing.
- No track record claims. BroadNet Group has worked in telecoms and software since 2003, but the hosting offer is new.
- No round-the-clock security monitoring service. We do not operate a security operations center for your systems.
If a buyer, auditor or regulator needs any of these from your hosting provider today, we are not the right choice yet, and we would rather you knew before you buy.
Your first-week security checklist
- Turn on MFA for every account that can reach the service, including email accounts that can reset passwords.
- Replace SSH passwords with keys and disable root login over SSH. The Linux hardening guide walks through it.
- Close every port you do not need; keep databases on private networks.
- Set up automatic security updates or a written patch schedule.
- Take a backup to a separate location, then restore it to prove it works. See the backup and recovery guide and the recovery feasibility tool.
- Send us your list of authorized contacts.
Frequently asked questions
Who is responsible if the data center loses power?
The supplier operates power and cooling. We track the incident, keep you informed and handle any follow-up under the terms in your quote.
Do you patch my VPS?
Not on an unmanaged VPS: the operating system is yours. If you want us to patch it, choose managed hosting and the patch scope is written into the quote.
Can BroadNet staff see my data?
We only access your systems when you ask us to do work that needs it, using access you grant, and every change is recorded. On unmanaged products you can withhold access entirely.
Is there a status page?
Not yet. A public status page and incident write-ups are planned. Until then, we notify your named contacts directly about incidents that affect your service.
Where do I report a security issue?
Email sales@broadnetcloud.com with the subject "Security report". A dedicated security address is planned.
Do you have a bug bounty?
No. We welcome responsible reports, but we do not pay rewards.
Sources
- NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, NIST
- The NIST Cybersecurity Framework (CSF) 2.0, NIST
- RFC 9116: A File Format to Aid in Security Vulnerability Disclosure, IETF
- ISO/IEC 29147: Vulnerability disclosure, ISO
- NIST SP 800-145: The NIST Definition of Cloud Computing, NIST
Related
Last reviewed . Facts on this page are checked against the sources listed; anything not yet contracted is marked “confirmed at quote”.