Vendor assessment of CUZY Hosting: the answers

Who you sign with

• Contracting party: Marc Farré, sole trader, trading as CUZY
• Registration: business name CUZY, registration number 760136, at the Irish Companies Registration Office (core.cro.ie, public register of business names)
• Business registration number: 0117829GB (Ireland)
• Address: 80 St. Columbanus Road, Dundrum, Dublin 14, D14 WP98, Ireland
• History: hosting HumHub communities for organizations since 2017; publishing HumHub modules since 2020, most of them on the official HumHub marketplace, the free ones used by more than 2,000 HumHub installations
• Applicable law: Irish law; the Irish Data Protection Commission is CUZY's supervisory authority

CUZY is a small business, not a limited company: the person who signs is the person who answers for it. Our partnership with HumHub GmbH, the publisher of HumHub, is described in how we work with HumHub; more about us on the about page and in the legal notice.

If CUZY's founder is unavailable

A small provider has to answer this question openly.

• The platform runs by itself. Backups, security updates, monitoring and alerts are scheduled tasks, not people; each tenant server keeps running even if CUZY's own systems stop.
• A second person can step in. A trusted person holds the emergency access to every account and key the platform depends on, receives the same critical alerts, and follows written recovery procedures that do not need the founder.
• You are never stuck. Your complete export is in your customer account at any time, and everything your community runs is open source: it can be restored on your own server or with another HumHub host, HumHub GmbH included.

Where your data is, and who processes it

Organizations whose members are in the European Union choose Germany (EU), the default: hosting and backups then stay in the EU. Every sub-processor, its purpose, its location and its transfer safeguard is listed in the privacy policy (section 4); you are told at least 30 days before one is added or replaced and may terminate without penalty if you object. Details: data privacy.

GDPR documents

• Data Processing Agreement under Article 28 GDPR, part of the terms of sale and accepted with every subscription; a signed copy on request. It also covers the UK GDPR, Swiss, Canadian (Quebec included) and US state laws: read the agreement.
• Roles: you are the controller of your members' data, CUZY the processor acting only on your instructions, using the data for nothing of its own: no advertising, no selling, no AI.
• International transfers rest on an adequacy decision, the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, with encryption as a supplementary measure.
• Public authorities: data is disclosed only on a binding legal order, which CUZY checks and contests when there are grounds; you are told first unless the law forbids it.
• Audit: once a year on request, the information that shows compliance (the results of the last restore test, the sub-processors' certifications, answers to your questionnaire), or an audit with 30 days' notice (agreement, section 12).

Security controls

• Isolation: each community has its own container, database, file store and credentials, with memory and CPU limits.
• In transit: HTTPS only, certificates renewed automatically, custom domains included.
• At rest: the databases are encrypted at rest; uploaded files on the server disks are not. The database key is stored on the server, apart from the data files, and in an encrypted vault; backups and the platform's secrets are encrypted too, with keys stored apart from the data. The files are protected by isolation, the access rules below and the physical security of Hetzner's ISO 27001 certified data centers.
• Privileged access: named staff only, with SSH keys, from restricted networks; two-factor authentication on the staff accounts of our management platform; administrative interfaces are not exposed to the internet.
• Support access: only if you allow it, through one-time login links that expire within minutes and are recorded in your community's audit log; you can switch it off.
• Your administrators: two-factor authentication is installed in every community and required for administrators from the start; you can extend it to other groups.

Certifications. The data centers are ISO 27001 certified; CUZY itself holds no ISO 27001 certificate or SOC 2 report and has not yet commissioned an outside penetration test. In their place: the published measures, made binding by the Data Processing Agreement; a security review of every new piece of CUZY code before release; servers built from one hardened configuration and audited weekly; and read-only SFTP access, so you or your auditor can read every line of code your community runs.

Patching and vulnerabilities

Release windows and support hours: update and support policy. Security problems are reported to security@cuzy.app (disclosure policy).

Backups and recovery

Backups hold the full database, files, configuration and modules, are encrypted before upload, stored with a second provider in the same region, checked weekly, and you can download or restore any of them from your customer account. Every figure: backup and retention schedule.

Incidents and breaches

• Detection: every community is checked from outside every minute; servers, backups, certificates and email delivery are monitored, and alerts reach our team day and night.
• Response: written procedures for every risk of our register, reviewed quarterly; a compromised server is isolated, its secrets rotated and it is rebuilt with communities restored from clean backups.
• Information: incidents are posted on the status page and sent to your administrators.
• Personal data breach: notified to you without undue delay and within 72 hours at the latest, by email, with the nature of the breach, the data and people concerned, the likely consequences and the measures taken (agreement, section 11).

Leaving CUZY

• Complete export of the database and files from your customer account, once a day: with the open-source code, it rebuilds the same community on any HumHub server.
• Stop when you want: ask us to end your subscription and the unused days are refunded pro rata (terms of service, section 10).
• Deletion: the community is archived about 30 days after the end and deleted with its backups 6 months after the end at the latest, earlier on request, with written confirmation.

References

Organizations whose HumHub community CUZY hosts include Enercoop, ATD Quart Monde, Transition Network, Inforisque, Mentalify, ADI Nouvelle-Aquitaine, Fondation SEVE, Université du Nous. Public reviews of a specialist host are few; a conversation with a customer tells you more. Ask us and we put you in touch with a customer who has agreed to answer prospects.

Questions from vendor assessments