Hosting security questionnaire: uptime, backups and data protection at LJPc hosting

Has your cyber insurer, accountant or auditor sent you a questionnaire about your hosting? For LJPc hosting, this is what you can fill in: we aim for 99.9% availability per year, we back up your website, databases and email every night to a separate backup server in the Netherlands, and the customer portal asks for a second step at every sign-in. Our data processing agreement is part of our terms and conditions. Below you find the answer to each question and where it is laid down, so you can refer to it.

At a glance: what to fill in for your hosting

Our terms and conditions and privacy statement are written in Dutch; the Dutch text is the binding version.

What uptime does LJPc hosting commit to?

Article 21 of our terms and conditions states that we aim for 99.9% availability per year. That works out at about 8 hours and 45 minutes of downtime a year. Three situations do not count towards it: planned maintenance that we announce in advance, force majeure (such as a major internet outage or a DDoS attack) and outages caused by something on your side. If you have an SLA with us, the percentages and agreements in your SLA apply.

You can see how our services are doing right now on the system status page. It shows automatic checks of the mail servers, the hosting servers, the name servers and the network. What the colours mean, and what to do if your website is down while everything looks fine, is explained in checking the system status during an outage.

How are backups handled?

Every night at midnight (Dutch time) we automatically back up your website files, databases and email. The backup goes to a separate backup server in the Netherlands, apart from the hosting server your website runs on. Once a week it is a full backup; on the nights in between we store the changes. You request a restore with a support ticket. What exactly is in the backup and how a restore works is covered in hosting backups and restores.

Article 26 of the terms and conditions states that you are responsible for keeping your own backups of your data. For an audit, that combination is strong: our nightly backup on a separate server, plus your own copy in a place and for a retention period you choose. How to create and download a backup in Plesk is explained in back up your website.

Which security measures are built in?

• Sign-in with a second step. After your password, the customer portal always asks for a second step: a code by email, an authenticator app or a passkey. With a sub-account, every colleague gets their own login with their own second step. See set up two-factor authentication and sub-accounts in the customer portal.
• Encrypted connections. Your website automatically gets a free SSL certificate from Let's Encrypt, which Plesk renews in time. Your email app connects to ljpc.email over SSL/TLS, as described in set up email on your phone and computer.
• Brute-force protection. fail2ban automatically blocks any IP address that tries to sign in with a wrong password too often.
• Nightly malware scan. If we find files that look harmful, you get an email and a notice on your dashboard in the portal. What to do next is explained in malware alert.
• DNSSEC. If your domain is registered with us and uses our name servers, we turn on DNSSEC automatically.
• Modern internet standards. LJPc hosting is listed in the internet.nl Hall of Fame for hosters. One of the requirements is a 100% score on both the website and the email test for our own domain.

Part of the security is in your hands. Keep your website, plugins and themes up to date, as described in update WordPress safely, and use a strong, unique password for every login. If a web developer or IT partner needs access, read share passwords securely.

GDPR: the data processing agreement and where your data is stored

If your hosting holds personal data, such as the email in your mailboxes or the customer details in your web shop, we process that data for you as a processor under the GDPR. The data processing agreement for this is Annex 1 of our terms and conditions. It applies as soon as we process personal data for you as a processor. Among other things, it states that:

• we report a data breach without undue delay, and in any case within 48 hours of an employee or sub-processor becoming aware of it;
• we process personal data within the European Economic Area (EEA);
• you get the current list of sub-processors on written request;
• you can have one audit carried out per calendar year, at your own expense and with at least 30 days' notice.

According to our privacy statement, our servers are hosted with data centre partners in Amsterdam. The nightly backups are stored on a separate backup server in the Netherlands.

Support and emergencies

Monday to Friday, 09:00 to 17:00 Dutch time, you can reach us with a support ticket, by phone on +31 85 130 6429, on WhatsApp or by email. Outside office hours there is the emergency call for problems that cannot wait, such as a web shop that is completely offline. An engineer is alerted straight away and calls you within 15 minutes. How it works is explained in emergency support after hours.

Does NIS2 apply to your organisation?

The NIS2 directive is an EU law that each member state implements in its own legislation. In the Netherlands that is the Cyberbeveiligingswet (Cybersecurity Act), in force since 15 August 2026. Whether it applies to your organisation is something you determine yourself; the Dutch NCSC explains what the act requires (in Dutch), such as registration, the duty of care and the reporting obligation. If you have to answer questions about your hosting provider for it, the overview at the top of this article will help.

Is your question not listed?

If your insurer or auditor asks for something not covered here, such as a recovery time objective (RTO) for your website, the list of sub-processors or details about your own server, ask us in a support ticket in the customer portal. Attach the questionnaire, so we can see exactly what is being asked.