Security · Data protection · Evidence
In brief
At managed-cluster.net, security and compliance are split across three layers: the operator Maincubes runs the FRA01 data center, we operate the cluster platform, and you are responsible for your application and data. GDPR compliant hosting in Germany starts with our data processing agreement (DPA) under Art. 28 GDPR; we process and store your cluster data exclusively in Germany.
Shared responsibility
Every security measure in a managed Proxmox cluster belongs to one of three layers and therefore to one responsible party: the data center operator, us as the platform operator, or your organization. That keeps your risk assessment and vendor review traceable, because you can attribute every statement to its source.
Layer 1 · Operator
Our primary site is the Maincubes FRA01 data center in the Rhine-Main area. According to the operator, it is certified to ISO/IEC 27001 and ISO 9001 and has a redundant, uninterruptible power supply, multi-level access controls and a 24-hour security service (source 2).
Our second site, NBG01 in Nuremberg, holds backup copies outside the primary site and supports multi-site deployments.
Our FRA01 and NBG01 sitesLayer 2 · managed-cluster.net
We run everything underneath your application: the nodes with Proxmox VE, storage, network and firewalls. That includes 24/7 monitoring with on-call duty as well as updates and security patches. Backups run on infrastructure separate from the cluster, with regular restore tests.
Your clusters connect through our own autonomous system, AS47263. Network-level DDoS protection is included in every fixed price.
DDoS protection and our own networkLayer 3 · Your organization
You take care of your application; we take care of everything underneath it.
You or your agency are responsible for the code, plugins and updates of your application or online store, as well as for user management and the data you process in it.
Data processing
At managed-cluster.net, the data processing agreement (DPA) for your hosting is part of every fixed price: a contract under Art. 28 GDPR, known in German as the AV-Vertrag. If personal data resides on your cluster, we process it on your behalf on that basis. The operations contract, SLA and DPA are governed by German law.
Under Art. 28(3) GDPR, such a contract sets out (source 1):
It also lays down the processor's obligations, for example that it processes personal data only on documented instructions from the controller. The controller is usually your organization, because it determines the purposes and means of the processing (Art. 4(7) GDPR); we act as the processor on your behalf.
Under Art. 28(1) GDPR, a controller may only use processors that provide sufficient guarantees to implement appropriate technical and organizational measures. The measures we take in operations are listed under operational security.
We process and store your cluster data exclusively in Germany. Our sites are the Maincubes FRA01 data center in the Rhine-Main area and NBG01 in Nuremberg. Backups are kept separate from the cluster, also in German data centers. On request, we name the site, including its address, in the contract.
This commitment covers the data on your cluster. The data collected when you visit this website or send an inquiry, and where it is transferred, is described in the privacy policy of this website.
managed-cluster.net is a brand of Cube-Hosting.net (owner: Jesse Röhsler, Gerolzhofen, Germany). We operate managed Proxmox and high-availability clusters in German data centers (Maincubes FRA01, NBG01 Nuremberg) on our own network, AS47263.
Our address, contact details and way of working are on the page that explains who is behind managed-cluster.net.
Security in day-to-day operations
At managed-cluster.net, our part of your hosting security consists of nine technical and organizational measures that we carry out in day-to-day operations, from patch management and hardening to separate networks, backups and 24/7 monitoring. Operations, monitoring, updates and support are billed at a fixed monthly price, with no hidden hourly rates.
Our pages on patch management and hardening and on backup & disaster recovery describe the processes in detail.
Access control
At managed-cluster.net, firewalls at every level and separate networks for management, storage and public traffic limit access to your platform. A redundant firewall and load balancer layer with health checks sits in front of the nodes, and SSH access is secured. We document the access paths to your environment in writing.
The documentation of your environment belongs to you. On request, you get read-only access to a dashboard with live metrics for your cluster.
If your access control policy sets further requirements for accounts and roles, talk to us about them.
Enterprise Added in the Enterprise package
The Enterprise package adds separate networks, VPN, IP whitelisting and role-based access.
With IP whitelisting, connections are only possible from approved addresses; with role-based access, permissions are granted through roles.
Responsibilities
We take on the operation of the platform, network, backups and monitoring. Your application, its users and data, and your organization's regulatory obligations stay with you. The overview assigns responsibilities across five areas; the section documents for your vendor assessment shows what you receive from us in writing.
Context
This overview describes how our operations support your security measures. It is neither a certification nor legal advice.
| Area | We take on | Stays with you |
|---|---|---|
| Platform and network | Operating nodes, virtualization, storage and network; hardening, patches and node-by-node updates | You choose the window for announced exceptions such as a major database upgrade. |
| Application | Health checks from the user's perspective: we check whether your application responds. | Code, plugins and updates of the application, plus its user management |
| Security incidents | 24/7 monitoring, alerting with escalation paths, analysis, containment, recovery and a post-incident report | Assessing what an incident means for your business, and any obligations it may create for your organization, for example toward authorities, customers or affected individuals |
| Backup and recovery | Separate backup infrastructure, defined retention periods, regular restore tests | Your targets for the recovery time objective (RTO) and recovery point objective (RPO); they become binding in the operations contract we agree on together. |
| Data protection | Processing on your behalf under the DPA, exclusively in Germany | Deciding on the purposes and means of the processing, which usually makes you the controller under the GDPR (Art. 4(7), source 1). |
Evidence
From managed-cluster.net, you receive six documents in writing for your vendor assessment and your own records, from the design proposal before you place the order to the monthly operations report. They include the DPA, the failover test report and a post-incident report for every incident. The documentation of your environment, covering architecture, access and emergency plans, belongs to you.
| Document | Contents | When you receive it |
|---|---|---|
| Design proposal | Architecture diagram, component list, fixed price for build and operations | after the requirements analysis, usually within a few business days |
| Data processing agreement | Data processing under Art. 28 GDPR, governed by German law | as part of the contract, together with the operations contract and SLA |
| Failover test report | Procedure and results of the failover tests | before go-live, then for each test at the interval agreed with you |
| Documentation | Architecture, configuration, access details and emergency plans | with the handover of your cluster |
| Operations report | Availability, incidents, utilization and recommendations; the Business package adds SLA reports | monthly |
| Post-incident report | Root cause of an incident and follow-up measures | after every incident |
Need further documents for your vendor assessment? Tell us what you require, and we will tell you plainly what we can document today. Our provider selection checklist lists the questions to ask any hosting provider.
Certifications
Operator The ISO/IEC 27001 and ISO 9001 certifications apply to the FRA01 data center and belong to its operator, Maincubes. They do not cover how managed-cluster.net operates your cluster.
The operator lists the certifications on its FRA01 site page (source 2, as of October 2026). Facilities and the role of both sites are covered on our page about the certified FRA01 data center (operator).
For your vendor assessment
Assess the data center layer based on the operator's certifications and the operations layer based on the measures and documents on this page.
Security contact
Report a security vulnerability affecting managed-cluster.net by email to support@cube-hosting.net. The same contact details are published in machine-readable form in our security.txt file, following RFC 9116. If possible, describe which system is affected and how the issue can be reproduced. The file lists German and English as preferred languages.
Contact for security reports
Email: support@cube-hosting.net
File: /.well-known/security.txt
Preferred languages according to security.txt: German, English
RFC 9116 specifies that the file is located at /.well-known/security.txt and contains at least the “Contact” and “Expires” fields (source 3).
FAQ
Yes. A data processing agreement (DPA) under Art. 28 GDPR is part of every fixed price and governs how we process personal data on your cluster on your behalf. It applies together with the operations contract and SLA, all governed by German law.
Not your cluster data: we process and store it exclusively in Germany, and backups are also kept in German data centers, separate from the cluster. Visits to this website and inquiries are covered by the privacy policy.
You, or your development team or agency. Code, plugins and application updates are your responsibility; we operate and protect everything underneath, from the nodes and virtualization to the network, monitoring and backups.
Patch management with priority for critical vulnerabilities, system hardening, separate networks, versioned configuration, TLS and certificate management, separate backups with restore tests, 24/7 monitoring with on-call duty, and incident handling with a post-incident report. The Enterprise package adds VPN, IP whitelisting and role-based access.
By email to support@cube-hosting.net. The contact details are also published in machine-readable form at /.well-known/security.txt in line with RFC 9116; the file lists German and English as preferred languages.
Accessed and checked on · As of October 2026
Security & compliance
Bring the requirements from your information security, data protection and procurement teams. We will go through them with you and show which ones our operations cover and which remain with you.
Discuss security requirements