Cloud Storage Richtlinien zur Nutzung

Last edited:   

Version: 1.6

These guidelines describe subject-specific aspects of operation and specifications that must be observed when using the service. They supplement the usage guidelines for information processing systems of the LRZ (PDF), as well as the respective usage guidelines of the university or organization to which the user belongs.

Scope of application and authorized users and institutions

These guidelines apply to all users of the service and the IT infrastructure provided by the LRZ for this purpose. Authorized users are employees and students of the Technical University of Munich, the Ludwig Maximilian University of Munich and the Bavarian Academy of Sciences and Humanities, as well as other registered Bavarian universities and institutions according to the LRZ Dienstleistungskatalog. 

Readability of the data

The Leibniz Supercomputing Center makes every effort to create the best possible technical conditions for a long service life and data security with the resources available. This also includes adequate climatic conditions and building protection.

To protect against ransomware/cryptotrojans, software is used that analyzes all storage system transactions in real time for anomalies and blocks the access of affected users when anomalies are detected in order to prevent them from spreading. However, this software offers no guaranteed protection.

Accountability

There is no one hundred percent guarantee for the unlimited readability of the data on the storage systems. Neither the manufacturer of the storage systems or the software used nor the LRZ as a service provider can be held liable in the event of an error. The aforementioned security measures create a reliable framework. Nevertheless, they are not a guaranteed protection against operating errors or ransomware attacks. The correct application and configuration of the service is the responsibility of the user.

Responsibility for file contents

The person using the service is solely responsible for the legal and constitutional conformity of the content of the stored data. The processing of special categories of personal data (Art. 9 (1) GDPR) is excluded.

By default, all data is stored unencrypted at the Leibniz Supercomputing Center. The users themselves are responsible for ensuring that the data can be interpreted.

In the storage areas provided for this purpose, it is possible to share or exchange data with other users by assigning appropriate access rights. The release and exchange of data is the responsibility of the users, in particular compliance with copyright law. As the owner of a data area (personal cloud storage) and user of a shared data area (institutional cloud storage or temporary cloud storage), it is advisable to check the content regularly. This also applies to the risk of distributing malware or malware-infected files. It is recommended to perform a decentralized virus scan on the local device using suitable antivirus software. It is expressly pointed out that a central virus check does not take place at the LRZ.

The LRZ assumes no responsibility for any misuse.

Data security and encryption

The data is stored exclusively on LRZ-owned devices in the data rooms of the data center without encryption. The LRZ takes appropriate precautions to ensure that the security and integrity of the data is maintained. Furthermore, the LRZ uses the means at its disposal to ensure that no unauthorized external access is possible to the data stored in the storage system.

The data is only passed on to third parties if legal obligations must be met.

Communication between the users' end devices and the LRZ service infrastructure is encrypted.

Data protection according to DSGVO

The handling of personal data is regulated in the LRZ Privacy Policy.

Availability, maintenance times

The LRZ makes every effort to ensure the highest possible availability. For this reason, the most important components of the system are configured redundantly. An annual availability of the systems of at least 99% is aimed for. Work on troubleshooting is only guaranteed on weekdays during normal business hours. Maintenance agreements have been concluded with the manufacturers for all hardware and software components. The agreed SLAs generally only cover normal business hours on working days with an on-site response within the next working day. Service interruptions necessitated by planned maintenance work on hardware and software are announced several days in advance ion the LRZ service status page (available at https://status.lrz.de). In exceptional cases (emergency maintenance), an immediate service interruption can also be announced.

As a rule, the following times apply to the announcement:

  • Interruption shorter than 1 hour: 5 working days

  • Interruption longer than 1 hour: 15 working days

Retention period, deletion of data

The use of the service or the provision of the data is always linked to the user's registered account in the MWN directory of the LRZ. If this ID is deactivated or deleted (e.g., when a person leaves the institution authorized to use the service), the associated files are automatically and irretrievably removed from the storage system. This may result in system-related delays in deleting the data. If the user still requires the data after deletion of the identifier, he/she is responsible for transferring the data from the cloud storage system in good time.

No files of a user with a deactivated ID that are located within a storage area shared by several users (project storage) will be deleted.

If desired, a user can request deactivation or deletion of his/her account via the service desk of his/her institution or via the LRZ service desk.

Access blocking

The LRZ reserves the right to block the use of the service and thus access to the stored data in individual cases. The service will be blocked, for example, if the user violates applicable law or the guidelines stated here.

Salvatory clause

Should individual provisions of these guidelines be invalid or unenforceable or become invalid or unenforceable after coming into force, this shall not affect the validity of the remaining provisions of these guidelines.

Final provisions

The LRZ reserves the right to change these guidelines. Changes may become necessary due to mandatory legal requirements, among other things. It is recommended that you re-read the current usage guidelines from time to time. This policy is effective immediately and supersedes all previous policies.