Hack-fix guarantee: terms
Effective from 25 May 2026 · Version 1.0.
These terms apply to the hack-fix guarantee included in the ResaHost Premium plan. They form part of the service agreement.
1. Work covered
Following a security breach, Resaco Oy, referred to here as ResaHost, carries out the following work for a Premium customer without a separate charge:
- Incident analysis and forensic investigation.
- Removal of malicious code from the WordPress installation.
- Website restoration from a clean backup.
- Installation of updates whose absence caused the breach.
- Password changes and invalidation of sessions.
- Technical preparation of a notification to Finland's Data Protection Ombudsman where GDPR requires notification. The customer's data protection officer submits the notification.
This work is included in the Premium price of €189 per month excluding VAT.
2. Incident handling times
From receipt of a breach notification to the start of forensic work: less than four hours, 24/7. Website restoration to a working state typically takes 24 hours from notification, or up to 72 hours in more complex cases.
A written post-incident report is delivered within 14 days after the incident is closed.
3. Exclusions
The guarantee does not cover:
- Damage caused by the customer's actions, including leaked passwords, customer-created accounts or third-party plugins installed by the customer that ResaHost has not checked.
- Damage involving plugins or themes that ResaHost actively recommended removing but the customer retained.
- Business losses caused by DDoS attacks. The guarantee covers only the cost of restoring the service.
- Loss of data predating the most recent working backup. ResaHost provides backups at 24-hour intervals.
- Compensation for brand damage, lost profit or reputational loss. Liability is limited to restoration work and the maximum damages in section 6.
- Malicious code on end-user devices. Cleaning is limited to the server and website.
4. Frequency of use
The guarantee applies once in a 12-month period per customer, measured from the date the agreement takes effect. A second incident in that period is charged at €75 per hour excluding VAT. ResaHost supplies a cost estimate before starting work.
5. Conditions
The customer must keep the Premium plan active and payments up to date, and report a discovered or suspected breach promptly, no later than 24 hours after discovery.
The customer must not change the WordPress installation's DNS settings without ResaHost's prior written approval. They must permit updates, hardening and changes to security controls without separate permission for each action, and must not install plugins on ResaHost's prohibited-plugin list. That list is maintained in the customer portal.
6. Liability limit
ResaHost's liability for an incident is limited to directly carrying out the repair work under this guarantee and a maximum of €5,000 for other damage in a calendar year.
ResaHost recommends separate cyber insurance for indirect losses and can help the customer find cover through a partner insurer. The customer enters the insurance contract directly with the insurer, under that insurer's conditions.
7. Force majeure and third parties
ResaHost is not liable for interruptions at Hetzner or other infrastructure providers, natural disasters or official orders that prevent service delivery. Failures in third-party payment, analytics, CDN or similar services used by the customer's site are excluded.
8. End of the guarantee
The guarantee ends when the Premium plan ends. ResaHost is not responsible under it for incidents occurring afterwards.
Repeated breaches of section 5 allow ResaHost to terminate the guarantee with at least 30 days' written notice and return the Premium plan to Pro level at a reduced price.
9. Governing law and disputes
Finnish law applies and Helsinki District Court is the competent court. Consumer customers may refer disputes to the Finnish Consumer Disputes Board.
10. Contact and changes
Resaco Oy · VAT number FI32598705. Contract matters: [email protected]. Breach incidents, 24/7: [email protected] or +358 9 747 929 29.
ResaHost reserves the right to update these terms. Customers receive at least 30 days' email notice of changes. See also the SLA and cyber insurance terms.