Shared Responsibility ccloud³ / Compute Engine

This English version is provided for convenience only. The German version is legally binding; in the event of any discrepancy between the two versions, the German version shall prevail.

1. Introduction

The Shared Responsibility Model (SRM) describes the allocation of responsibilities between centron GmbH, Heganger 29, 96103 Hallstadt, Germany (the “Provider”) and the Customer when using ccloud³ and the centron Compute Engine (virtual machines).

Secure use of cloud services requires that both the Provider and the Customer understand and fulfil their respective responsibilities. The Provider provides and secures the underlying infrastructure, while the Customer is responsible for the security and configuration of its own workloads.

As is customary for Infrastructure-as-a-Service (IaaS), the Customer assumes a substantial part of the responsibility within the environment provided.

2. Basic principle

The Provider is responsible for the security of the cloud infrastructure, in particular:

• physical data centres
• hardware and virtualisation layer
• network infrastructure
• basic platform services

The Customer is responsible for security within the cloud instance, in particular:

• operating system
• applications
• data
• user access

This model follows the principle that the Provider operates the platform, while the Customer remains responsible for the use and protection of its data.

3. Data security

The Customer is responsible for securing all data that it stores or processes within ccloud³ Compute Engine.

In particular, the following is recommended:

• protecting the access credentials for the centron account
• managing user accounts separately
• implementing appropriate access controls
• encrypting data appropriately

The Provider makes the platform and security mechanisms available but assumes no responsibility for the content in the instances or for its protection.

4. Operating system and system configuration

The Customer is fully responsible for:

• installation and maintenance of the operating system
• applying security updates and patches
• system hardening and configuration
• management of user accounts and access rights

The compute instances provided functionally correspond to virtual servers that are operated independently by the Customer.

5. Network and access security

The Customer is responsible for configuring network security within its instances, in particular:

• configuration of firewall rules
• access restrictions (e.g. IP whitelist)
• securing open ports
• protection against unauthorised access

The Provider provides basic network mechanisms but assumes no responsibility for misconfigurations on the Customer’s side.

6. Logging and monitoring

The Provider provides basic infrastructure but does not assume full responsibility for logging within the instances.

The Customer is responsible for:

• setting up monitoring solutions
• monitoring system states
• analysing logs
• detecting security incidents

Without appropriate monitoring measures, the Customer may not be able to detect security incidents or misconfigurations in good time.

7. Compliance and certifications

The Provider operates the underlying infrastructure in accordance with common security and compliance standards.

This may include, in particular:

• audits by independent third parties
• compliance with industry standards

The Customer itself is responsible for ensuring that its use of the services complies with the regulatory requirements applicable to it.

The use of a certified infrastructure supports the Customer’s compliance but does not replace the Customer’s own obligations.

8. Availability and operation

The Provider is responsible for:

• operation and availability of the infrastructure
• stability of the virtualisation platform
• network connectivity and data centre operation

The Customer is responsible for:

• high availability of its applications
• redundancy and scaling
• backup strategies
• recovery processes

The Provider provides the technical basis, while the Customer remains responsible for the resilience of its applications.

9. Summary of responsibilities

The Provider provides a secure and stable infrastructure and protects the underlying systems.

The Customer is responsible for the secure use of this infrastructure, in particular for:

• configuration and operation
• access controls
• data and secrets
• applications

Security in the cloud is therefore a shared responsibility in which both parties must fulfil clearly defined tasks.