1. A person may become a user (service consumer) of CESNET Data Storage (DS) facilities only if the person is an employee or a student of an organisation that meets the “Principles for access to CESNET Large infrastructure (Access Policy)”, see http://www.cesnet.cz/doc/podminky.html (in Czech).
   
   
2. The user may only use data storage for data transfer and storage which are associated with activities in science, research, development, dissemination of education, culture and prosperity. For details, see “Acceptable Use Policy CESNET Large Infrastructure (Acceptable Use Policy, AUP)” which is an attachment of the Access Policy, see above.
   
   
3. CESNET Data Storage is operated by CESNET, http://www.ces.net/.
   
   
4. Users of DS services are organized in so-called virtual organizations (VO). VO has a manager and members. The VO manager and the DS administrators negotiate conditions of service use and technical means of user access to DS. Portfolio and the level of services provided to a specific user depends on user's membership in VOs. A user can be a member of multiple VOs.
   
   
5. Users of services that are accessible primarily with federated identities (e.g., FileSender and ownCloud) are considered to be members of a special VO administered by the DS administrator for the purpose of these Terms.
   
   
6. The level and basic properties of provided data services are expressed in the technical documentation on the website http://du.cesnet.cz. This site thus serves as a Service Level Declaration (SLD).
   
   
7. The requirements for non-standard configurations DS solve DS administrator with VO administrator. Such requirements may include providing specific access protocols, special handling of stored data (e.g., a single copy of the data on tapes considered sufficient, or on the contrary, data that require higher level of security, greater number of geographically separate tape replicas) or similar. The DS administrator may require the user to explain necessity and usefulness of such a configuration. The DS administrator decides the technical solution based on the purpose of required storage, required capacity, available capacity on the systems, type of data access and required quality of data protection.
   
   
8. DS is technically implemented as hierarchical. This means that it has a tier of fast disk arrays and a slower tape library and/or MAID (Massive Array of Idle Disks, i.e., disks that can be switched off). The data is automatically migrated among tiers based on migration policies. Data migration is transparent to the users, all the data appear to be on the disks. When migrated data is accessed, it has to be recalled by the system, i.e., migrated back to the disk arrays which takes some time. Reasons for this solution are economical; keeping the data on tapes or MAID is significantly less expensive in terms of operational costs.
   
   
9. Data migration policies are configured based on DS and VO administrators agreement, taking user needs into account as well as technical and economical aspect of storage operations. The users are advised to keep in mind that recall time of data that has not been used recently may be longer.
   
   
10. User access methods to the DS as well as authentication mechanisms are described in manuals available on https://du.cesnet.cz/.
    
    
11. DS administrators are entitled to require the users to demonstrate that the user is allowed to use the infrastructure as described in paragraph 1 of this Terms. This is usually demonstrated once a year by means of extending membership in the VO. The user is (repeatedly) asked to extend the VO membership by the account management system with an email sent to user's administrative mail contact. The notification also contains instructions how to perform membership handling. Typically, accessing with the eduID.cz federated account is sufficient for the operation.
    
    
12. Has user's VO membership expired, the DS administrator usually makes user's data inaccessible by means of access permission setting. The VO administrator can negotiate other means of handling of data of expired VO members. Such means must oblige the Terms of Service of the DS as well as the purpose of the VO. Six months after the user's VO membership expired, the DS administrator is entitled to delete data of the user in the particular VO. The data is usually deleted after much longer periods of time when technically possible on the storage facility.
    
    
13. The user is obliged to use the DS services taking other users into consideration.
    
    
14. The user is obliged to protect access with non-trivial passwords. Such passwords must not be a derivative (i.e., a simple mutation) of the data available about the user, and/or a derivative of a name of a person, animal or thing (even for simple mutations).
    
    
15. DS administrators are allowed to test passwords strength. In case of a positive result, the user will be notified through the secure channel and is required to change his password without delay (user's access can be suspended until the password is changed).
    
    
16. The user is obligated to notify via email addressed to support(at) cesnet.cz if he/she is aware or suspecting that the infrastructure was compromised, misused, access passwords disclosed, or in case of other events which may indicate a security incident, such as strange account behaviour, appearance or disappearance of files and so on.
    
    
17. The user agrees that information about users and their usage of the infrastructure are archived for the purpose of administration, operation, statistics, monitoring, and security.
    
    
18. The DS administrator is authorized to regulate or deny access of a user for administrative, operation, and/or security reasons. Has the user violated the Terms of Service and security rules in a severe manner, the DS administrator may deny access of such user to the infrastructure permanently.
    
    
19. The user may not provide access to the infrastructure to another person disclosing user's credentials (passwords, private keys, and so on). The user is obligated to keep access credentials in secret.
    
    
20. The user may not use DS in way that violates any laws (in particular copyright law and the law on the protection of personal data). The user may not bypass and/or attempt to bypass any administrative and/or security measures for access to DS.
    
    
21. The user should not enforce migrating data from tape to disks if this data is not intended to be used immediately. The users are advised to consult transfers of unusually large amounts of data with the DS administrator in advance.
    
    
22. Mechanisms of quotas are deployed on the DS, limiting the amount of data that can be stored by the user. The main purpose of quotas is to increase protection against user errors that could interfere with infrastructure operation. Quotas do not guarantee that the space is actually available in the infrastructure. Guaranteed data space reservations are not provided to individual users. Space usage is monitored by the accounting system for technical reasons.
    
    
23. DS is operated in “best effort” mode. DS administrators put the best effort possible to guarantee security and availability of data services and to safely store and keep data in the infrastructure. DS administrators guarantee that the protection of the data and overall modes of operation are state of the art of data technologies deployed in similar infrastructures. The DS administrators also guarantee high technological and moral standards of the technical personnel. High availability and security of the data services is supported by hardware component redundancy, security policies of the hierarchical systems, backups of required user data and also by means of technical and system support that is held by the technology supplier in 24×7 mode. The storage system architecture was designed for top level data retention (up to 99.99999999 %). The DS administrators do not declare other formal guarantees except the “best effort” described above.
    
    
24. The DS administrator declares that the devices deployed in the infrastructure are located in the Czech Republic.
    
    
25. DS administrator is authorized to change these Terms. A new version of the Terms is published on the web of CESNET association at least one month before the Terms become valid.
    
    
26. The Terms are published in Czech and English versions. In case of different interpretations of language versions, the Czech version is binding and obligatory.
    
    

The Terms of Service were published on June 13, 2014. They come into effect on September 15, 2014, replacing any previous versions.