Shared Responsibility Network

This English version is provided for convenience only. The German version is legally binding; in the event of any discrepancy between the two versions, the German version shall prevail.

1. Introduction

The Shared Responsibility Model (SRM) describes the allocation of responsibilities between centron GmbH, Heganger 29, 96103 Hallstadt, Germany (the “Provider”) and the Customer when using Networking Services, including virtual networks (VPC), load balancing and other network functions.

Secure use of network services requires that both the Provider and the Customer understand and fulfil their respective responsibilities. The Provider provides and secures the underlying network infrastructure, while the Customer is responsible for the secure configuration and use of its network resources.

As is customary for cloud infrastructure services, a substantial part of the responsibility for security and configuration remains with the Customer.

2. Basic principle

The Provider is responsible for the security of the underlying network infrastructure, in particular:

• physical data centres and network hardware
• routing infrastructure and backbone networks
• basic network services, network security and platform operation
• protection against infrastructure-level attacks

The Customer is responsible for the security of the network configuration and use, in particular:

• network architecture
• access controls
• routing and firewall rules
• securing applications and endpoints

This model follows the principle that the Provider protects the infrastructure, while the Customer is responsible for the use and configuration of its network resources.

3. Data security

In the context of using Networking Services, the Customer is responsible for the security of the data transmitted over the networks.

The following is recommended:

• protecting the access credentials for the centron account
• using separate user accounts
• activating multi-factor authentication
• using secure communication protocols

Responsibility for securing data during the use of cloud services lies, as a matter of principle, with the Customer.

4. Network architecture and configuration

The Customer is fully responsible for the planning and configuration of its network architecture.

This includes in particular:

• setting up and segmenting networks
• definition of subnets
• configuration of firewall and routing rules
• design of security zones

Misconfigurations within the network architecture may lead to security risks and fall entirely within the Customer’s area of responsibility.

5. Access control and network security

The Provider provides basic network functions but assumes no responsibility for access control on the Customer’s side.

The Customer is responsible for:

• configuration of firewalls and security rules
• control of incoming and outgoing data traffic
• restricting access to the necessary systems
• securing public endpoints

Insufficient access controls may lead to unauthorised access to systems or data and fall within the Customer’s area of responsibility.

6. Encryption and secure communication

The Provider provides the infrastructure for network communication but does not assume full responsibility for the encryption of data streams.

The Customer is responsible for:

• use of secure protocols such as HTTPS and TLS
• securing communication channels
• implementation of additional encryption measures

The secure transmission of data is the responsibility of the Customer, in particular in the case of sensitive information.

7. Logging and monitoring

The Provider provides the network infrastructure but does not assume full responsibility for monitoring and logging at application level.

The Customer is responsible for:

• monitoring network traffic
• setting up monitoring and alerting systems
• analysing access, logs and anomalies
• detecting security incidents

Without appropriate monitoring measures, security incidents or misconfigurations may go undetected.

8. Compliance and certifications

The Provider operates the underlying infrastructure in accordance with common security and compliance standards.

However, the Customer is responsible for:

• compliance with statutory as well as regulatory requirements
• implementation of security policies
• correct use of the network services

The use of a secure infrastructure supports compliance but does not replace the Customer’s obligations.

9. Availability and network operation

The Provider is responsible for:

• operation and availability of the network infrastructure
• stability of the routing and switching systems
• basic network connectivity

The Customer is responsible for:

• design of highly available network architectures
• redundancy concepts
• load balancing and failover mechanisms
• securing critical connections

The Provider provides the technical basis, while the Customer remains responsible for the resilience of its applications and networks.

10. Summary of responsibilities

The Provider provides a secure and high-performance network infrastructure and protects the underlying systems.

The Customer is responsible for the secure use of this infrastructure, in particular for:

• network design, configuration and operation
• access controls
• data and secrets
• securing data transmissions
• monitoring

Security in the cloud is therefore a shared responsibility in which both parties must fulfil clearly defined tasks.