1.  Product variants

DRACOON GmbH (hereinafter referred to as DRACOON) enables its customers to easily use a storage solution compliant with the EU General Data Protection Basic Regulation (GDPR) in order to securely and easily exchange data between multiple participants, network-compatible devices, or software services internally and externally. Additional services for processing and managing data can be obtained from third-party providers. The DRACOON end-user license terms as of January 2022 apply.

1.1  DRACOON Cloud product variants

DRACOON offers three cloud product variants, which adapt to the requirements of the customers: DRACOON Basic, DRACOON Pro, and DRACOON Premium. These are operated on a SaaS platform by DRACOON in the European Union while maintaining data residency in Germany and are invoiced based on consumption.

Within the scope of technical and operational possibilities, DRACOON provides the services shown in the product matrix below. A detailed description of these services can be found in the corresponding chapters.

  Service included in the product variant
  Service not included in the product variant
​ ​ Service can be added to the product variant for an additional fee

1.2  DRACOON Server

The product variant DRACOON Server is deployed on the customer's hardware. The necessary server services have to be provided separately by the customer. DRACOON will provide the customer with a list of the required hardware and software components and transmit the access data for downloading the DRACOON software components.

The customer is obliged to support DRACOON with all measures necessary for the operation of the server that are not within DRACOON's sphere of influence.

  Service included in product variant
  Service not included in product variant
​ ​  Service can be added to the product variant for an additional fee

2.  Users and storage

2.1  Storage usage for DRACOON Cloud products

The customer receives unlimited cloud storage space for storing his data. The size of the storage space is limited by a so-called fair-use clause. Each licensed user automatically adds 0.1TB of storage to the total usable amount. Guest licenses do not add additional usable storage space.

Sample calculation: 50 users ∗ 0.1 TB = 5 TB gross storage capacity

The usable storage space, the provided bandwidth, and the computing power are realized on a system used by several customers (shared). The logical separation of the storage space and the separation of the tenants take place at application level.

2.2  Usage of own storage infrastructure – Hybrid Cloud

If a customer integrates his own object storage, there is no entitlement to the cloud storage space described above, and this is not provided. Further information can be found at: https://support.dracoon.com/hc/en-us/sections/360002210000-S3-Object-Storage

2.3  Storage usage DRACOON Server

The available storage space depends on the hardware used by the customer.

2.4  Account sharing

Please note that the sharing of individual user accounts is not permitted with DRACOON. Each user must use their own named user account to access DRACOON (except when using public share links). This is necessary to ensure that each user has their own set of access rights to ensure the confidentiality, integrity, and availability of your data.

Excluded from this rule are so-called "service accounts," which are used for the technical integration of third-party systems and are, therefore, not tied to a specific person by name.

3.  Security and data protection

3.1  Encryption

By using modern cryptographic algorithms, DRACOON offers the highest level of security for stored data. This is achieved by using an optionally available client-side encryption (end-to-end encryption).

As a process-technical reference of the implemented client-side encryption, the whitepaper at www.dracoon.com/en/crypto-whitepaper is valid.

All encryption methods used are disclosed and available in the source code. The following is a reference example: github.com/dracoon/dracoon-java-crypto-sdk

3.2  Certifications and testings

Information security and data protection are of central importance for DRACOON in the operation and further development of the DRACOON platform. Therefore DRACOON operates an Information Security Management System (ISMS), which is audited and certified according to ISO 27001. Furthermore, compliance with the high demands on information security according to the BSI's Cloud Computing (C5 2020) requirements catalog has been certified by an independent auditor.

You can find proofs for download and further information about our certifications at www.dracoon.com/de/certifications.

DRACOON operates all cloud products in its own managed data centers. To increase resilience, these are provided by the providers noris network AG and OVH SAS at various locations. Both providers have various security certifications, such as ISO 27001, ISO 27017, PCI DSS, and SOC3 Type II.

Third-party services are used to provide functionalities such as sending emails and SMS. Only providers who also ensure strong protection of information security and meet the requirements of the DSGVO are used. The providers must provide suitable evidence of this, e.g. certifications according to ISO 27001. The requirements for third-party providers are regularly monitored as part of DRACOON's supplier management, and compliance with these regulations is checked as part of the certified ISMS. Current technology partners can be viewed at https://support.dracoon.com/hc/de/articles/360011917220.

3.3  Handling of critical security incidents

In order to be able to handle security-critical incidents quickly and effectively, DRACOON has set up the email address security@dracoon.com. Incidents reported to this address are automatically forwarded to DRACOON's CERT team, which evaluates and prioritizes them based on their impact on information security.

All customers are therefore required to immediately send critical security incidents to the email address security@dracoon.com. The information transmitted is subject to confidentiality.

We would also like to encourage all security experts to report any security vulnerabilities they find to the email address security@dracoon.com.

All emails to security@dracoon.com can also be encrypted using PGP. For this purpose, the public key of the company DRACOON is available at the address https://www.dracoon.com/.well-known/dracoon.asc. This is also described in the file "security.txt", which can be found at the address https://www.dracoon.com/.well-known/security.txt.

4.  Access to DRACOON

4.1  Authentication

A prerequisite for access to DRACOON is the authentication of the customer by means of an access code. The initial login information will be sent to the customer when DRACOON provides the services for the first time. Further additional information about secure initial authentication is available at https://support.dracoon.com/hc/de/articles/360012007660.

The initial login password has to be changed by the customer immediately.

4.2  Access options

Universal access to DRACOON is the core of the DRACOON product philosophy. DRACOON provides customers with client software or apps for easy access to various end devices and operating systems. In concrete terms, access takes place via web browsers, native DRACOON applications for Microsoft Windows and Apple macOS, DRACOON apps for Apple iOS and Google Android, an add-in for Microsoft Outlook (under Windows), an app for Microsoft Teams, as well as in a restricted way with the help of compatibility protocols—here currently WebDAV.

Since recently DRACOON also offers the possibility to open and save documents from DRACOON directly in Microsoft Office applications (currently Word and Excel) with "DRACOON for Office". With "Print to DRACOON", a PDF (also PDF-A format available for long-term archiving) or JPEG file of the print output can be saved directly in DRACOON from any print-capable application in Microsoft Windows.

All DRACOON clients, except WebDAV, due to technical reasons, support complete end-to-end encryption. DRACOON provides an exact overview on the web for which end devices or operating systems a client software or app is available. The currently valid overview as well as a compatibility matrix and the necessary system requirements can be viewed at https://cloud.support.dracoon.com/hc/en-us/articles/360009344719. DRACOON reserves the right to change the system requirements according to the current technical standard or to extend or discontinue the DRACOON clients at any time.

4.3  API-based access

File-based process and software integrations can be connected directly via a JSON/REST API or abstracted using the DRACOON SDKs. The SDKs are available under a free license from https://github.com/dracoon. Current documentation of function calls of the DRACOON API can be found at https://dracoon.team/api.

Current available client SDKs and code samples are referenced in the development area of the support portal at https://developer.dracoon.com/ and distributed via the DRACOON GitHub account https://github.com/dracoon.

The use of the API by software not developed by DRACOON has to be registered on the website https://www.dracoon.com/de/api and activated by DRACOON.

The use of the API-based access is charged according to the remuneration model agreed upon when placing the order. DRACOON reserves the right to throttle or block individual API requests if any of the agreed-included services are exceeded.

4.4  Provision of access infrastructure 

The connectors and connections required for access to DRACOON, the necessary communication equipment as well as the protection of the used client hardware and software against vulnerabilities and malware are not part of the software and this contract.

It is the responsibility of the customer to provide any internet access that may be required; further costs may arise from this.

DRACOON customers are recommended to inform themselves regularly about the "state of the art". The current handbook of TeleTrusT is recommended: https://www.teletrust.de/publikationen/broschueren/stand-der-technik/

5.  Features

5.1  Branding

If desired by the customer, the appearance of DRACOON can be adapted to the customer's company. This can be done by the customer himself without any additional costs via a branding self-service.

Independent of the adaptation of the visual appearance to the client's corporate design (logos, colors, etc.) the lettering "DRACOON" as well as the logos of possibly existing reselling partners are displayed in the client applications to identify the platform.

Further information about branding is available at https://cloud.support.dracoon.com/hc/en-us/articles/360001517960.

5.2  Digital signature

The integration of the FP Sign electronic signing service enables the user to digitally sign individual PDF files in DRACOON with an advanced electronic signature. The number of signature operations is limited by a so-called fair use clause. Per licensed user, in the DRACOON Premium license model, 50 signing operations are available per year. Guest licenses do not add additional signing operations.
Calculation example: 50 users * 50 signatures = 2,500 signature operations/year for a customer environment.
Additional signature quotas can be booked for a fee.

5.3  Guest licenses

Guest licenses, which provide additional access to DRACOON, can be booked for external users. The remuneration of these licenses will be agreed upon individually with the client. Guest licenses may not be used by employees or other members of the client's staff or any other company of the same group family. Guest licenses may not be resold or passed on against payment.

When calculating cloud storage space in accordance with the fair use clause, guest licenses are not taken into account and therefore do not add any additional usable storage space.

DRACOON may check on the instance of the Client whether booked guest licenses are used according to the conditions described above. Misused guest licenses have to be paid as normal user licenses against additional payment to DRACOON.

5.4  Integration of hybrid components

The following hybrid technologies can currently be connected after approval by the Operations team of DRACOON:

• IAM (Identity Access Management) / IDP (Identity Provider): Supported are IAM and IDP systems, which can be connected via OpenID Connect. Supported configurations can be found at https://support.dracoon.com/hc/de/articles/360012346239.
• Object Storage: Supported are object storage systems listed under https://support.dracoon.com/hc/de/articles/360012345579.
  AWS S3 policies using S3 tags are supported.
• Syslog: The transmission of the events of the application-side audit log is supported with the configuration options as listed at https://cloud.support.dracoon.com/hc/de/articles/360017873679#3.

Availability, bandwidth, and IT security of the respective technology must be ensured by the customer and are not subject matter of this contract. Further information on the integration of hybrid components is available at https://cloud.support.dracoon.com/hc/en-us/categories/360001552679.

5.5  Reporting

With the reporting functionality, it is possible to create an asynchronous report of events and user actions in data rooms. The feature is only available to users who have been assigned the global role of Auditor.

5.6  Virus protection

Integrating G DATA's virus protection service enables users to have newly uploaded files and files already existing in data rooms checked for malicious code. In the event that malware has been detected, downloading and sharing the affected file is no longer possible.

The number of file scans is limited by a so-called fair use clause. Per licensed user (the availability of the feature depends on the booked product variant, see 1.1) 1,000 file scans are available per month. Guest user licenses do not add additional file scans.
Calculation example: 50 users * 1,000 file scans = 50,000 file scans/month for a customer environment.
Additional quotas can be booked for a fee.

The checking of files for viruses is subordinate to the regular operation of the DRACOON cloud and might therefore be throttled.

6.  Product support

DRACOON provides its customers with all the necessary information to use their DRACOON instance online. The support portal at https://support.dracoon.com/ serves as a starting point. Current system and process requirements, as well as known problems and limitations, can also be accessed via the support portal.

The support portal and the Service & Support section support the languages German and English.

DRACOON may provide additional services, such as consulting and training services, within the existing technical and operational possibilities for a separate fee. The remuneration for these services will be agreed upon individually with the customer.

The following services are offered:

• Set-Up/Installation by DRACOON: Mandatory service that needs to be booked when ordering the product variant DRACOON Server.
• Consulting:  Individual consulting of the customer, e.g. for the connection of external systems or consulting for individual technical questions
• Training: Product training can be carried out in varying degrees per webinar, on-site at the customer's location, or at the premises of DRACOON or a cooperating training provider.

7.  Service levels & availability

7.1  Availability

The annual availability (calendar year) is calculated for the respective year as the maximum available minutes minus downtime, divided by the maximum available minutes in the respective year. The maximum available minutes correspond to the total number of minutes in the respective year in which a contractual relationship between DRACOON and the customer exists. Downtime is the total number of minutes in the respective year in which the DRACOON instance of the customer was not available and in which a contractual relationship existed between DRACOON and the customer. The times of the used maintenance windows are not included in the calculation of the downtime (see also chapter 10).

7.2  SLA Standard

The services of the SaaS platform are available with an average availability of 99.5 % on an annual average. The availability can be tracked on the status page status.dracoon.com. Times in which maintenance windows are used by DRACOON are not included in the availability calculation (see also chapter 10).

The following features apply to the incident resolution provided by DRACOON:

• Pro-active issue resolution through automated monitoring of the systems
• Acceptance of issue reports daily from 0.00 to 24.00 hours by ticket system via the support portal at support.dracoon.com or by phone at +49 (941) 78385-112
• Reported issues are processed during business hours (Monday to Friday, 9:00 to 17:00 CET/CEST, except on public holidays in Bavaria and December 24 and 31.). A certain response time is not guaranteed.

7.3  SLA Premium

In the SLA Premium, the services of the SLA Standard are extended by increased availability commitments of the cloud platform and response times in the event of incidents. This SLA can be concluded with the customer for an additional fee. The duration and payment terms of the SLA are based on the underlying contract of the booked product variant.

If the annual average availability commitments are not met, a percentage service credit of the usage price of the respective year will be granted according to the following regulation:

Penalty: 0.5 % on the total amount of the annual invoice
The credit note is issued once with the subsequent invoice.

Furthermore, the processing of reported incidents begins within the time window below after acceptance of the incident, depending on the severity of the incident. DRACOON is responsible for the assessment of the severity of an incident. A resolution time is not guaranteed. The processing is only done remotely. The documentation of the processing of a reported incident can also be found on a publicly available website, such as the status page status.dracoon.com,

8.  Server and system component operation

8.1  Operation of the DRACOON Cloud products

All server and system components necessary for operation are operated in a technically and organizationally secure, high-performance computer network in Germany, which is protected by a firewall system against attacks and unauthorized access from the Internet.

The computer network is connected to the Internet via Internet backbone connections with a state-of-the-art transmission speed and is designed redundantly.

The data uploaded in the application and its backup are stored redundantly on geo-redundant storage systems in Germany.

The following performance features apply to operation and system management:

• Operating time daily from 0.00 until 24.00 hrs
• Automatic detection of faults within the computer network
• The backup states are subject to the retention period specified in the booked product variant under point 1.1 (backup retention period).
• The data backup is housed in a different data center location and is therefore stored separately from the actual data.

8.2  Special notes regarding operation of hybrid components 

• If hybrid components are operated by the customer, there is no automated error detection and repair of the hybrid components operated by the customer (IdP, storage) or any other components outside of DRACOON's sphere of action.
• If own object storage is connected, DRACOON will not back up the data. The customer is solely responsible for the creation of backups.
• If own Object Storage is integrated, data deletion cannot be guaranteed if the Object Storage integrated by the customer is not available. In particular, DRACOON is not liable for breaches of data protection if hybrid hardware embedded by the client is not available.

8.3  Operation of DRACOON Server

The operation of the server and system components in the product variant DRACOON Server is basically the responsibility of the customer. The requirements for the respective versions can be found at https://server.support.dracoon.com/hc/de/categories/360003042400.

The following requirements for the customer's infrastructure have to be met:

1Infrastructure and network

2Server and operating system

3Virus scan 

9.  Product improvement & roadmap (updates)

9.1  Updates for DRACOON Cloud products

DRACOON is constantly being developed and regularly receives improvements, bug fixes, and feature enhancements.

These updates are installed by DRACOON within the defined maintenance windows. In the sense of continuous improvement, optimizations and extensions are carried out in short intervals that are not bound to fixed dates. Compatibility with current client applications is maintained. Deviations from this will be communicated by DRACOON with an appropriate lead time.

Planned and current development topics can be viewed online here: https://support.dracoon.com/hc/de/articles/360010945500

9.2  Updates for DRACOON Server

For the variant DRACOON Server, security updates and bug fixes are provided on an ad hoc basis. The software update is carried out by DRACOON when a fully managed service is booked.

DRACOON Server is a long-term-support version (LTS version) and will be provided with bug fixes and security updates until further notice. However, no new functionality will be added.

Client applications are also delivered in a synchronized cycle as LTS version and are compatible with the above LTS version. For the use of continuously updated client applications, compatibility cannot be guaranteed. An exception is mobile apps which are only offered via app stores as a continuously updated version.

Should important bug fixes (e.g. in case of a security issue) be necessary for an LTS version, DRACOON will immediately provide an update and inform the customers of DRACOON Server about the update. The customer agrees to provide DRACOON with an email distribution list where security-relevant information can be sent to the customer by DRACOON's CERT team.

The continuous update of the infrastructure is the responsibility of the customer. If updates are necessary for the operation, they have to be carried out by the client. 

10.  Maintenance

10.1  DRACOON Cloud maintenance window

For maintenance purposes - especially for changes and updates of the server configuration - the services can be taken out of service (maintenance window):

• DRACOON provides maintenance windows on Wednesdays from 8:00 pm CET/CEST until Thursdays 06:00 am CET/CEST.
• Maintenance that does not affect the availability of the system can also be carried out outside the maintenance window defined above.
• Furthermore, emergency maintenance windows, especially due to critical security updates (e.g. defense against hacker attacks or viruses or worms) are provided for. Due to their urgency, these maintenance windows can be carried out by DRACOON at any time and at short notice.

DRACOON will keep the impairment of the performance by maintenance windows (especially emergency maintenance windows) as low as possible and will carry out the necessary maintenance work outside the main hours if possible. Information about planned maintenance work and maintenance windows will be published on the status page status.dracoon.com.

The times of the used maintenance windows are not included in the calculation of availability.

Notes:

In order to be able to carry out maintenance procedures and emergency procedures efficiently, it is possible for designated employees of the DRACOON Operations department to access the data structures of the customer.

These operations are limited to copy, move, and restore operations in the DRACOON storage system and serve to prevent overload and error situations proactively.

Due to the use of end-to-end encryption on the customer side and the basic anonymization of metadata in the underlying storage system, there is no technical or organizational possibility of information leakage. When using a hybrid storage system, there is no access by employees of DRACOON.

All maintenance work is logged via the website status.dracoon.com; individual notification of the customer does not take place for reasons of efficiency.

10.2 DRACOON Server Full Managed maintenance window 

For maintenance purposes—especially for changes and updates of the server configuration—maintenance windows are planned in coordination with the customer. Should short-term (unscheduled) maintenance be necessary, the customer will be informed accordingly.

Hours worked will be documented by DRACOON via a suitable system (ticket system) and can be requested by the client in individual cases.

10.3  Availability of DRACOON's technology partners

System components of DRACOON's technology partners are also subject to regular maintenance work, which means that they may be temporarily unavailable or temporarily only available to a limited extent. The technology partners are encouraged to schedule their maintenance windows during periods of low usage.

The times of the used maintenance windows are not included in the calculation of availability.