Shared Responsibility Managed Database

This English version is provided for convenience only. The German version is legally binding; in the event of any discrepancy between the two versions, the German version shall prevail.

1. Introduction

The Shared Responsibility Model (SRM) describes the allocation of responsibilities between centron GmbH, Heganger 29, 96103 Hallstadt, Germany (the “Provider”) and the Customer when using Managed Database Services.

With Managed Databases, the Provider assumes a larger share of the operational responsibility than with conventional IaaS services. Nevertheless, key security and configuration tasks remain with the Customer.

The Provider provides a managed database platform and takes over the operation, maintenance and protection of the underlying systems. The Customer, by contrast, is responsible for the use of, access control over and protection of its data.

2. Basic principle

The Provider is responsible for the security of the database platform and infrastructure, in particular:

• physical data centres
• hardware and virtualisation layer
• network infrastructure
• basic platform services
• availability and operation of the database clusters

The Customer is responsible for the security of the use of the database, in particular:

• data and content
• users and permissions
• access controls
• database configuration at application level

This model follows the principle that the Provider operates the platform, while the Customer remains responsible for the use and protection of its data.

3. Data security

The Customer is responsible for the security of the data stored or processed within the Managed Database.

The following is recommended:

• protecting the access credentials for the centron account
• using individual user accounts
• restricting access to data to the necessary systems and users
• encrypting data appropriately

The Provider makes the platform and security mechanisms available but assumes no responsibility for the content in the database instances or for its protection.

4. User and access control

The Customer is fully responsible for the management of database users and their permissions.

This includes in particular:

• creation and management of database users
• granting and restricting access rights
• implementing appropriate access controls

Improper assignment of rights may lead to unauthorised access and falls within the Customer’s area of responsibility.

5. Network security and access

The Provider provides basic mechanisms for securing database connections.

The Customer is responsible for:

• restricting access to trusted sources
• configuring network or firewall rules
• securing connections between applications and the database
• protection against unauthorised access

Control over which systems may access a database lies entirely with the Customer.

6. Encryption

The Provider provides the following security mechanisms:

• encryption of data at rest (“Encryption at Rest”)
• encrypted data transmission (“Encryption in Transit”, e.g. SSL/TLS)

Managed Database systems are operated with encryption by default in order to increase data security.

The Customer is additionally responsible for:

• secure use of access credentials
• client-side encryption, where applicable
• protection of sensitive data beyond the platform mechanisms

7. Operation, maintenance and updates

The Provider takes over:

• installation and operation of the database software
• security updates and patching
• maintenance of the infrastructure
• automated operating processes

The Customer is responsible for:

• correct use of the database
• optimisation of queries and applications
• adjustment of configurations at application level

Managed Databases relieve the Customer of operational tasks but do not replace its responsibility for the use of the database.

8. Backup and recovery

The Provider makes backup and recovery functions available, for example automated backups or recovery options.

The Customer is responsible for:

• using these functions
• reviewing the backup strategies
• ensuring that recovery processes meet the requirements

The Provider makes the technical capabilities available, while the Customer must ensure that they are used correctly.

9. Monitoring and logging

The Provider carries out basic monitoring of the platform, including system state and infrastructure.

The Customer is responsible for:

• monitoring database usage
• setting up alerting
• analysing logs and access
• detecting anomalies or security incidents

Monitoring of the application level and of database usage lies entirely with the Customer.

10. High availability and scaling

The Provider makes mechanisms available to enable high availability, for example:

• replication
• standby nodes
• automatic failover

The Customer is responsible for:

• selecting suitable configurations
• scaling the database
• adapting the architecture to requirements

Managed Databases offer technical capabilities for high availability that can be actively used by the Customer.

11. Compliance and regulatory requirements

The Provider operates the infrastructure in accordance with common security and compliance standards.

The Customer is responsible for:

• compliance with statutory requirements
• use in compliance with data protection law
• classification and protection of the data

The use of a secure platform supports compliance requirements but does not replace the Customer’s obligations.

12. Summary of responsibilities

The Provider provides a secure, managed database platform and takes over the operation, maintenance and protection of the underlying infrastructure.

The Customer is responsible for the secure use of this platform, in particular for:

• data and its protection
• user and access control
• use of backup and security functions
• application configuration and database usage

Security in the cloud is therefore a shared responsibility in which both parties must fulfil clearly defined tasks.