Habitat3 Service Level Statement

This Service Level Statement sets out Habitat3's obligations in delivering a service expected by a Habitat3 Client.

Habitat3's obligations, we will;

a) General 

  1. Provide clients with a unique, virtualised private server and charge fees for the use of that server which include software licensing and all hard drive space required by the server to function and to store client data.

  2. Ensure clients’ Virtual Private Servers (VPS) are available 24 hours a day, 7 days a week at 99.9% availability across a 12 month period (this does not include advertised maintenance windows which will be completed outside of business hours whenever possible).

  3. Host clients’ VPS in an Australian data-centre facility.

  4. Ensure a minimum of 14 days history of VPS backups is available for restores.

  5. Provide support between 8am and 6pm (Sydney time) Monday to Friday excluding national public holidays.

  6. Provide support for a server which is not accessible due to a Habitat3 fault 24 hours a day, 7 days a week (after hours) - the appropriate Helpdesk ticket must be submitted.

  7. Arrange with clients to complete VPS specific technical work that clients require to be done after hours for an agreed service fee (over and above the monthly subscription fees).

  8. Respond to client requests within 4 business hours of logging the request via the Habitat3 website.

  9. At it's own discretion charge additional support fees to provide support for clients’ local computers and networks to allow connectivity between the local network and the hosted server.

  10. Provide comprehensive training on how clients’ are to request support.

  11. Setup clients’ VPS including;

    1. Windows Server operating system - installation and configuration

    2. MS Office installation

    3. SQL Server installation

    4. Partner Software Applications and associated tools

    5. Printer drivers

    6. FTP folders to allow for scanning

    7. Virtual Private Networks if required

    8. All AntiVirus and other security tools

  12. Migrate client data from the local network to the VPS on a scheduled weekday at (or prior to) 2pm at no charge . If a date and time outside of these hours is selected by the client additional fees will apply.

  13. Charge a rescheduling fee if the data migration date is changed by the client.

  14. Charge additional fees if more than one set of data is required to be migrated.

  15. Recommend a server with RAM and CPU appropriate to the number of users using the server. We make a selection for you based on our experience and the number of users on your account. However, additional fees will apply for a more powerful server if more server resources are needed to support your specific requirements.

  16. Ensure a minimum of 5% of Hard Drive space is available to the VPS at all times.

  17. Reserve the right to

    1. restrict access to unlawful or unreasonable online information (websites) and other file sharing or internet based services from the VPS. However, internet access from onsite PCs will not be restricted in any way.

    2. disconnect access to your VPS if any activities are found to be initiated on that VPS that negatively impact the overall service including denial of service or other activities including uploading or downloading large data sets.

    3. restrict access to your Habitat3 VPS to any entity that would be considered a competitor of ours or our HSVPs.

    4. temporarily deactivate a server in the event that its storage is full and you are unwilling to delete data or increase your storage.

  18. Complete technical support only when a support ticket has been submitted via the Habitat3 support page.

  19. Complete training with you to ensure that you are sufficiently briefed in how to use the Habitat3 support service.

  20. Attempt to enable access to your Habitat3 VPS from Apple OSX and IOS but we may be unsuccessful. In addition we cannot ensure all Windows based printing functionality will function as expected from a Mac OS as printer drivers on the server and on Windows PCs are needed to provide full printing functionality.

  21. Install supported software into your VPS as user accounts do not have server administrative rights and therefore users will not be able to install some software. In some cases a fee may be charged for this service.
  22. Run all scripts that need to run under administrative rights under a Habitat3 controlled administrative account. Habitat3 will also need to check the scripts before they are run.
  23. Complete a maximum of 10 full VPS or file restores on request per month. Additional fees will be charged per additional restore requested within that same month.

  24. Export your data from your VPS to an FTP location to allow for download or to an external hard drive and post it to you on request. A fee will be charged to complete this export process. To receive data clients must send us an appropriate sized USB3 hard drive and a self-addressed express post envelope/satchel.

  25. Charge a fee per GB of data that is sent out of the client's VPS over 5GB per active user in a single calendar month charged on the 1st of the month for the prior month's usage at a rate of $0.55 per GB (inc GST) over the 5GB per active user level. Example: If you have 5 users you have a 5 x 5GB allocation = 25GB of outgoing data. More than 25GB will be charged at $0.55 per GB.

  26. Provide a report to clients on request to show outgoing client VPS data traffic volumes. 
  27. Hold the appropriate levels of Insurance

  28. Email clients via a subscriber email list to provide information about the service including price increases and service notifications. If a client unsubscribes from the list they will no longer receive these important updates. 

b) Software Support within the VPS

  1. Software hosted by clients within their VPS is only supported by the Habitat3 HelpDesk if the software is supported by the associated software vendor under the operating system used by Habitat3 (eg. Windows Server 2019 using Windows Remote Desktop).

  2. Habitat3 does not accept any responsibility for application or data related problems associated with any software you choose to host within your Habitat3 VPS.

  3. We reserve the right to refuse to support and may uninstall any software you have installed or requested to be installed on the Habitat3 VPS other than provided by a Habitat3 Software Partner Vendor (HSPV).

  4. Habitat3 may charge additional fees to host a non-HSPV provided software. Examples include CCH, MYOB and Reckon.

  5. MYOB Specific Support - Habitat3 provides support for MYOB when hosted within a client VPS for a monthly fee based on the application year version (2016, 2017) and the application edition (eg AccountRight and Essentials).  

  6. If you use the OzBiz/Optomate/MYOB link solution OzBiz are responsible for ensuring your MYOB is functioning correctly and can import the data from Optomate (via OzBiz). If you use sync software to receive your Optomate export data to be imported into MYOB via OzBiz a monthly fee will apply.

  7. Habitat3 supports the VPS to ensure your software performs as expected. In some cases if you require Habitat3 to complete software maintenance activities that are not related to the server's functionality or a standard upgrade process we will charge an hourly rate to complete the work.

  8. We expect you to have a basic working understanding of Windows PC operating systems and the basic functions required to access the Habitat3 service.

  9. Remote access software is not supported on your VPS. These types of programs can negatively impact your internet quota, can reduce bandwidth and performance, can introduce a range of trojans and malware/viruses and ultimately can allow your data to be sent to external server outside of Australia which we specifically do not allow as part of our commitment to ensure all data stored on our system does not leave Australian borders.

  10. If you do not use Microsoft's MS Office 365 email service we may not be able to restore emails due to your email service provider's functionality. We strongly recommend the use of MS Office 365 email.

  11. Although in some cases we complete software upgrades for our clients, there are occasions where our clients do need to complete parts of an upgrade process specific to their needs (eg. Roll-Over of clients in HandiSoft

  12. We reserve the right to charge additional fees if you wish to host two or more instances and associated databases of your primary software (eg. HandiSoft, Optomate, FittingWizard, MedicalDirector, FilePro etc) or two SQL based applications (eg Medical Director and Best Practice).

  13. We reserve the right to introduce additional support fees to maintain software hosted on your VPS which is in addition to your primary software.

  14. We reserve the right to introduce additional support fees to host and maintain SQL databases.

  15. Connecting your Noah software on your PC to your Noah Database on your Habitat3 server is not officially tested or supported by Noah and therefore is not recommended by Habitat3 and Habitat3 does not accept any responsibility for any security or data loss related issues associated with the Noah database. However, Habitat3 will implement the solution as securely as possible at all times. Therefore Habitat3 requires all clients to use a Habitat3 provided VPN connection to link the Noah software on their PCs to the Noah database on the Habitat3 server. Habitat3 also expects you to use a unique password to protect your Noah database (functionality provided by Noah) when hosted on your Habitat3 server and setup a Noah specific backup (also functionality provided by Noah).

  16. Software associated with VOIP and Video Conferencing (eg. Teams) is not supported on Habitat3 virtual servers. This software is designed to be used on a PC operating system and not within Microsoft's Remote Desktop (RDP). You will have issues with ensuring microphones and cameras operate reliably from the local PC to the RDP session

  17. All HandiSoft software updates released/published via the HandiSoft website can be completed by you our client. 

  18. MedicalDirector/PracSoft/Bluechip updates are completed on your behalf at no additional charge.

  19. FilePro updates are completed by FilePro .

  20. FittingWizard updates are completed by Biotronic.

  21. Optomate has an auto-update feature which automatically upgrades the software to the latest version.

  22. If you require us to complete any software upgrades for you a fee may apply.

  23. We do not support file syncing applications including Dropbox, Google Drive and OneDrive. These applications will be blocked unless approved by Habitat3 and the Account Holder.

  24. Third party cloud backup services can be used if authorised by Habitat3 but clients must complete all file selections, scheduling and monitoring of backup success. Habitat3 is in no way responsible for ensuring the correct files are backed up and that the backup facility is functioning as expected. 

  25. We do support the use of all i360 Cloud Services within the Habitat3 remote desktop environment.

c) Habitat3 Security - Secure support web-portal website
 

  1. Account Holders are provided with access to a secure, support web-portal to make requests relating to security (eg. updating a password) and billing (eg. adding a user account)

  2. Account Holders can nominate an Authorised Representative (AR) to act on their behalf. This is done via the support web-portal or on the initial service activation web-form. An Authorised Representative can only be nominated on the service activation form if the Account Holder is completing the form. Authorised Representatives can be nominated by the Account Holder at a later date.

  3. Authorised Representatives can access the support web-portal and therefore can make all billing and security requests.

  4. Exceptions are that Authorised Representatives cannot; 

    1. cancel a subscription/service

    2. nominate another Authorised Representative

    3. remove an Account Holder

    4. request a full copy of data via FTP or Hard Drive

    5. change the password of the Account Holder on the VPS

  5. The requests above must be made by the Account Holder not an Authorised Representative.

  6. Account Holders must provide an email address, the first and last name and the mobile phone number of the nominated Authorised Representative/s.  

  7. Authorised Representatives must be employed by the Habitat3 client they are representing.

  8. Habitat3 does not record the password set by Account Holders for the support web-portal.

  9. The support web-portal and all associated support ticket information (including Habitat3 client personal details are hosted by FreshWorks - privacy policy located at: https://www.freshworks.com/security/

  10. It is the client's responsibility to advise Habitat3 that an Authorised Representative has left the client's employment and should be disabled. This is done via a ticket in the Habitat3 web portal.

  11. If Habitat3 determines an Authorised Representative has left the client's employment we will automatically revoke that Authorised Representative's web portal account and they will no longer be able to make requests.

d) Habitat3 Server & Data Security

Habitat3 is committed to keeping your VPS and the data stored within the VPS environment secure and we take all reasonable precautions to protect it from unauthorised access, modification or disclosure.

DataCentre and Geolocation

  1. Habitat3 uses DataCentres located in Australia only to store VPS data. At no time does Habitat3 send VPS data outside of Australia.

  2. VPS and all associated data and primary backups are stored by the following providers:

    1. Rackspace Australia - The Rackspace facilities within Digital Realty’s Sydney DataCentre are maintained with both ISMS ISO 27001 and EMS ISO 14001 accreditation.

    2. Amazon Web Services - Sydney. AWS has certification for compliance with ISO/IEC 27001:2013, 27017:2015, 27018:2019, 27701:2019, 9001:2015, and CSA STAR CCM v3.0.1. 

 

Data Ownership and Control

  1. Account Holder's warrant that the data they upload (or ask Habitat3 to upload) to their Habitat3 VPS is lawfully theirs to access and control.

  2. Habitat3 will not host data owned by multiple entities on the one Habitat3 VPS.

  3. Habitat3 clients’ store, modify and delete their business data as required and are able to request Habitat3 provide a full copy of their complete data set at any time. Fees do apply to complete these requests.

  4. Habitat3 may grant Habitat3 HPSV entities permanent admin level access to clients’ VPS when requested to do so by clients via the Habitat3 Helpdesk Portal.

  5. Under all and any circumstances client data stored on Habitat3 servers remains the property of the organisation that has signed the Habitat3 Service Supply Agreement.

  6. The account is controlled by the Account Holder nominated in the Habitat3 Service Supply Agreement.

Recommended Security Upgrades

  1. The use of Two Factor Authentication when users login to Your VPS
  2. accessing the VPS via encrypted Virtual Private Network access
  3. the disabling of copy/paste functionality between the VPS and the PCs logging in
  4. the locking down of VPS access to physical source IP addresses.

The recommendations listed above are not mandatory but are very strongly recommended to keep your data safe.

Habitat3 access

  1. Habitat3 staff have access client VPS to provide support and therefore do have access to information stored on the VPS. 

  2. Habitat3 completes rigorous background checks on all Habitat3 staff including an Australian National Police Check and all staff are required to sign a confidentiality agreement.

Passwords

  1. Habitat3 recommends all clients password protect all their applications and data for additional security.

  2. It is the client's responsibility to select strong passwords for all Habitat3 related services (eg; servers and secure web-portal), to change them regularly and to safeguard them appropriately.

 

Third Party Access

  1. Habitat3 grants third party entities (eg. software vendors) temporary access to clients’ VPS when requested to do so by Account Holders and Authorised Representatives.

  2. If the third party entities require administrative rights Habitat3 will require the third party to make an appointment with Habitat3 and the remote session will be supervised by Habitat3 throughout the access period to ensure no damage is done to the Habitat3 server environment.

  3. In some cases, although difficult, it may be possible for third parties to copy data from the server even under supervision. Only trusted persons should be granted access - even under supervision.

  4. Clients are able to authorised ongoing 3rd party access HPSV entities with Habitat3's approval.


Data Backups

  1. Each VPS is backed up once every 24 hours allowing for full server and granular file restores.

  2. Full VPS backups provide for a 14 day history of data restores.

  3. Full VPS backups can be extended to 4 weeks retention for additional quoted fees.

  4. Email stored within an Outlook OST file (Office365) is not restorable but a separate backup service is offered and recommended for additional quoted fees.

  5. Each client's main database (eg. HandiSoft or Optomate) is also backed up internally within the VPS.

 

Data Provision

  1. Data is provided in accordance with the Habitat3 Data Provision Policy.

Data Synchronization 

  1. Habitat3 may facilitate the connection of applications hosted on the Habitat3 server with external cloud based applications on request from the Account Holder.

  2. In some cases users may be able to create data synchronizations without the assistance or knowledge of Habitat3.

  3. In all cases any file syncing websites or applications (including API based) are controlled and managed by the Client and it is the responsibility of the Client to ensure the cloud based applications or websites are appropriate and secure. 

  4. Habitat3 is able to block user access to specific websites and/or syncing applications if requested by the Client.

 

Server Security

  1. Each VPS is a fully complete installation of Windows Server using Microsoft’s Remote Desktop Services.

  2. Each VPS is made accessible via Windows Remote Desktop using a unique (non-standard) RDP port number.

  3. All users on each VPS will be disconnected from the remote session after 1 hour of idle time.

  4. All users on each VPS will be logged off at 3am daily unless logged in at that time. Clients may opt to remove this auto-log-off feature however it may negatively impact your VPS performance.

  5. All users on each VPS will be completely logged off the server (includes the closing of documents and applications) at least once every week outside of business hours (typically late on Sunday night).

  6. If VPS passwords are entered incorrectly 3 times the user account will be “locked” to prevent brute force access.

  7. Each VPS server’s access can be limited to Virtual Private Network access if requested.

  8. Each VPS access can be limited to source IP address if requested.

  9. Each VPS is protected by a secure firewall as well as mandatory web filtering and AntiVirus.

  10. Cryptolocking trojans (often called Ransomware) are activated by user actions (eg. malicious website or email attachment) and cannot always be detected by Habitat3's security protocols. If clients identify any encrypted files or know they have activated this type of attack on your VPS clients must advise Habitat3 as soon as possible as restoring encrypted files from backup is the only solution (each nightly backup is retained for a maximum of 14 days).

  11. Each VPS has a unique set of user passwords for user access which can be changed by you on demand by accessing the Habitat3 support portal.

  12. Habitat3 conducts penetration testing which is completed on a regular basis to identify any potential security risks.

  13. Each VPS logs when users on that specific VPS log in and log out

  14. Those VPS hosted at AWS are encrypted "at rest".

 

Data Breach

  1. Habitat3 will always notify you via email as soon as possible if a data security breach affecting your data is identified.

  2. The Office of the Australian Information Commissioner’s Guide to securing personal information: ‘Reasonable steps’ to protect personal information discusses security considerations that may be relevant under APP 11 when outsourcing your server hosting requirements.

  3. If any illegal activities (eg. copyright infringement) are conducted by any Habitat3 clients within any Habitat3 hosting services then Habitat3 holds the Habitat3 client responsible and liable to all relevant authorities.​

  4. Habitat3 expects clients to only connect to the Habitat3 Virtual Private Server from PCs that are protected by business grade AntiVirus software. In the pre GoLive Audit, PC security will be tested. If no AntiVirus is detected Habitat3 can quote on and arrange for the appropriate software to be installed.

 

e) Data Protection Laws

  1. Habitat3 is an Australian company with Australian shareholders focused on providing Australian based companies only with Australian-based technology services.

  2. Habitat3 does not consider itself an APP Entity based on the criteria set by the Office of the Australian Information Commissioner.

  3. Habitat3 does not warrant compliance with Data Protection Laws designed to protect those located in jurisdictions outside Australia including Europe.

  4. Habitat3 does not have a Data Processing Addendum in place with the providers of its Australian (Sydney) located DataCentre/infrastructure providers.

  5. Habitat3 clients as personal information controllers must not store the personal information of individuals located in the EU on Habitat3’s Hosted Virtual Private Servers (personal information processor) as Habitat3 does not warrant compliance with the GDPR.

f) Microsoft SQL Licensing

  1. Some software may require the use of Microsoft SQL 

  2. Habitat3 is able to install, support and license SQL

  3. Habitat3 supports SQL WebEdition, Standard Edition and Express 

  4. Where software vendors recommend the use of SQL Standard Edition Habitat3 will always install and charge for SQL Standard to ensure the performance, reliability and security of software databases. 

  5. Clients are able to apply to Habitat3 for an exemption but any exemptions can be revoked at any time.

  6. We reserve the right to introduce additional hosting fees if an additional server is required to host SQL Databases.

 

g) Microsoft Webservers

  1. Webservers will have as standard a non-default RDP port open to allow administrative access.

  2. Webservers will have port 80 open to allow http traffic.

h) Virtual Private Networks

  1. We will assist you in creating an IPSEC VPN link between your office and your Habitat3 VPS via Internet connections.

  2. We are able to do so via hardware (modem) or software (installed on your Windows PC)

  3. You will be charged a monthly fee for VPN connections which will be quoted prior to proceeding with the setup.

  4. You will be responsible for purchasing your own VPN modem/router and we will provide details of a recommended router.

  5. Using the recommended router is important as we will not provide additional assistance in connecting a non-recommended router to the your VPS.

  6. You must ensure a static IP is provided for your internet connection by your internet service provider (ISP).

  7. We will provide the required VPN configuration details to allow you (or your onsite technical representative) to complete the router VPN setup.

  8. If you are using the modem/router we have recommended and cannot establish a functional VPN connection for the first time we will work with you to complete a successful connection.

  9. If you are not using a recommended router and we are unable to successfully create a VPN connection then we can provide your onsite technical representative with the appropriate details to attempt to make the connection via the non-recommended router.

  10. If you are not using the recommended router and we are unable to successfully create a VPN connection to the VPS then we will require you to obtain the recommended router before further assistance can be provided.

  11. Using an Internet connection to access your VPS that is also used for VOIP services is not recommended due to the negative impact each service will have on the other.

  12. Accessing your Habitat3 VPS via a VPN will incur monthly fees.

i) Service Change Requests

  1. Any requests associated with changing your service that impacts your fee must be approved by the Account Holder of Authorised Representative.

  2. Adding or Upgrading server specification will incur a pro-rata fee from the provisioning date to the next billing date when a full monthly fee will be charged. If you remove or downgrade server specification the fee change will occur at the next billing date on the next monthly invoice. 

j) Miscellaneous 

  1. Habitat3 can provide specific information to assist end users (and their local IT support provider) in completing the Printer Vendor’s Installation forms however Habitat3 does not complete the Printer Vendor’s Installation form on their behalf.

  2. Scanning can be completed direct to the hosted virtual server via FTP.

  3. Internet service must not be a shared service with a 3rd party

  4. Internet service must not be shared with a VOIP service

  5. Recommended VPN modem/router if VPN connections are requested

  6. Although access to your VPS is available from Apple OSX 10.11 and above we are unable to ensure optimal performance from these devices. In additional Habitat3 cannot ensure all Windows based printing functionality will function as expected from a Mac OS as printer drivers on the server and on Windows PCs are needed to provide full printing functionality.

  7. Any data drives sent to Habitat3 by a Habitat3 Client for data uploading into the data centre must be clearly labelled with your business name. If this is not done we cannot guarantee the return of your drive (eg. flash or USB external hard drive). To allow for return of your drive please enclose an Express Post envelope fully addressed to the location you wish to have it sent.

  8. If the Habitat3 service is cancelled by either party Habitat3 will not deploy any additional services (eg. new user accounts) within the last 30 days of the service being provided.