Shared Responsibility Object Storage

This English version is provided for convenience only. The German version is legally binding; in the event of any discrepancy between the two versions, the German version shall prevail.

1. Introduction

The Shared Responsibility Model (SRM) describes the allocation of responsibilities between centron GmbH, Heganger 29, 96103 Hallstadt, Germany (the “Provider”) and the Customer when using Object Storage (S3-compatible object storage).

Secure use of Object Storage requires that both the Provider and the Customer understand and fulfil their respective responsibilities. The Provider provides the underlying storage platform and secures the infrastructure, while the Customer is responsible for the security, management and use of its stored data.

As is customary for Infrastructure-as-a-Service offerings, responsibility for data and access to it remains largely with the Customer.

2. Basic principle

The Provider is responsible for the security of the underlying infrastructure, in particular:

• physical data centres
• hardware and storage systems
• network infrastructure
• operation and protection of the Object Storage platform

The Customer is responsible for the security of the stored content and access to it, in particular:

• data and objects
• access controls
• keys and access credentials
• use of the storage functions

This model follows the principle that the Provider protects the infrastructure, while the Customer is responsible for the use and protection of its data.

3. Data security

The Customer is responsible for securing all data stored in the Object Storage.

In particular, the Provider recommends:

• protection of the access credentials for the centron account
• use of separate user accounts
• use of multi-factor authentication
• restriction of access to the necessary applications and users
• encrypting data appropriately

The Customer is responsible for ensuring that only authorised users and applications are given access to the stored data.

4. Access control and permissions

The Customer is responsible for the correct configuration of access settings within the Object Storage.

This includes in particular:

• defining permissions for objects and buckets
• configuration of public and private access
• management of API access

Misconfigurations, in particular unintended public sharing, fall entirely within the Customer’s area of responsibility.

5. Encryption

The Provider provides security mechanisms by default in order to protect data.

Data is stored in encrypted form in the Object Storage (“Encryption at Rest”), which reduces the risk of unauthorised access at the physical level.

Data is transmitted via secure connections (HTTPS/TLS), which protects data during transmission.

The Customer is additionally responsible for:

• optional client-side encryption
• selection of suitable encryption methods
• protection of sensitive data beyond the platform mechanisms

6. Key management

The Provider makes access keys available that are required for access to the Object Storage.

The Customer is responsible for:

• secure storage / safekeeping of these keys
• prevention of unauthorised access
• regular rotation of access credentials
• management of API access

Any misuse of access keys falls within the Customer’s area of responsibility.

7. Logging and monitoring

The Provider provides the basic infrastructure but does not assume full responsibility for monitoring its use.

The Customer is responsible for:

• monitoring access and activities
• analysing access patterns
• detecting unauthorised access
• implementation of logging mechanisms

Without appropriate measures, the Customer may not be able to detect security incidents in good time.

8. Compliance and certifications

The Provider operates the infrastructure in accordance with common security and compliance standards and may be subject to corresponding audits.

However, the Customer is responsible for:

• compliance with statutory and regulatory requirements
• use in compliance with data protection law
• classification and protection of the stored data

The use of a certified infrastructure supports compliance but does not replace the Customer’s obligations.

9. Availability and data durability

The Provider ensures the availability and durability of the Object Storage infrastructure.

The Customer is responsible for:

• suitable backup strategies
• data replication (where required)
• versioning of objects
• recovery processes

The Provider provides the technical platform, while the Customer remains responsible for ensuring the availability of its data in the application context.

10. Summary of responsibilities

The Provider provides a secure and highly available Object Storage infrastructure and protects the underlying systems.

The Customer is responsible for the secure use of this platform, in particular for:

• data and secrets
• access controls
• key management
• configuration and operation

Security in the cloud is therefore a shared responsibility in which both parties must fulfil clearly defined tasks.