Shared Responsibility Shared Responsibility Policy

This English version is provided for convenience only. The German version is legally binding; in the event of any discrepancy between the two versions, the German version shall prevail.

1. Purpose and scope

This Policy on the Shared Responsibility Model (“Shared Responsibility Policy”) governs the allocation of responsibilities between centron and the Customer in connection with the use of the centron Cloud Services.

In particular, the Policy specifies the security-related, operational and organisational obligations of the parties and supplements the existing contractual provisions, in particular the General Terms and Conditions, the Terms of Use and the Service Description.

2. Basic principle of the Shared Responsibility Model

The use of cloud services is based on a shared responsibility model in which both centron and the Customer assume their own areas of responsibility with regard to the security, operation and use of the services provided.

This model ensures that each party fulfils those tasks that it can perform most effectively on the basis of its technical and organisational control.

As a matter of principle, the following applies:

• centron is responsible for the security and operation of the underlying cloud infrastructure (“Security of the Cloud”)
• the Customer is responsible for the security and use of the systems, applications and data operated within this infrastructure (“Security in the Cloud”)

This principle corresponds to the customary understanding in the industry, according to which cloud providers secure the infrastructure, while customers must protect their applications, data and access.

3. centron’s area of responsibility

centron is responsible for the provision and protection of the cloud infrastructure on which the products and services are operated.

This includes in particular:

3.1 Physical and infrastructure security

• protection of the data centres against unauthorised access
• ensuring physical security measures
• power supply, air conditioning and environmental conditions

3.2 Network and platform security

• securing the network infrastructure
• protection against external attacks at infrastructure level
• operation and hardening of the virtualisation layer

3.3 Operation and availability

• ensuring operation of the platform in accordance with the SLA
• monitoring of the infrastructure
• provision of redundancy and failover mechanisms

3.4 Infrastructure-related compliance

• compliance with relevant security standards and certifications
• implementation of organisational and technical measures

3.5 Basic security functions

• provision of security functions such as encryption at infrastructure level (where provided for)
• provision of optional security and backup functions

centron thereby makes a secure and functional infrastructure available to the Customer but assumes no responsibility for the Customer’s specific use of it.

4. The Customer’s area of responsibility

The Customer is responsible for all content, systems and configurations operated within the centron Cloud.

This includes in particular:

4.1 Data and application security

• protection of its own data against unauthorised access
• implementation of suitable encryption measures
• ensuring data integrity

4.2 Identity and access management

• management of user accounts and access rights
• securing access credentials and authentication mechanisms
• control over authorised users

4.3 System and operational security

• securing and updating operating systems
• installation and maintenance of security updates
• hardening of the software components used

4.4 Application security

• development, operation and protection of its own applications
• avoidance of security vulnerabilities
• protection against attacks at application level

4.5 Configuration and use of the services

• selection of suitable configurations
• setting up secure network settings
• use of security functions

4.6 Monitoring and incident management

• monitoring of its own systems
• detection and handling of security incidents
• implementation of appropriate response measures

In particular, the Customer is responsible for configuring and operating the cloud resources provided in such a way that no security risks arise for its systems, data or third parties.

5. Shared areas of responsibility

Certain security and compliance matters are subject to shared responsibility between centron and the Customer.

These include in particular:

• data protection and data processing
• encryption (depending on the implementation level)
• business continuity and backup strategies
• security configurations and access controls

In these areas, the specific allocation of responsibilities depends on the type of service used and on the individual configurations.

6. Dependency on the service model

The scope of the respective responsibilities varies depending on the type of cloud service model used.

As a matter of principle, the following applies:

With Infrastructure-as-a-Service (IaaS), the Customer bears a larger share of the responsibility, in particular for operating systems, applications and data.

With Platform-as-a-Service (PaaS), parts of the responsibility shift to centron, while the Customer remains responsible for applications and data.

With Software-as-a-Service (SaaS), centron assumes a larger part of the technical responsibility, while the Customer remains responsible in particular for data and access management.

This graduated allocation of responsibilities corresponds to the industry-standard model of cloud security.

7. No assumption of full security responsibility by centron

The Customer acknowledges that the use of cloud services does not constitute a complete transfer of security responsibility to centron.

In particular, the following applies:

• centron is not responsible for security incidents attributable to faulty configuration or use by the Customer
• centron assumes no responsibility for applications operated or data stored by the Customer
• compliance with statutory requirements in connection with the use of the services is incumbent on the Customer

An incorrect assumption that all security aspects are covered by the cloud provider may lead to considerable security risks.

8. Use of security functions

centron may make security functions, tools or options available to the Customer.

The use of these functions falls within the Customer’s area of responsibility unless expressly agreed otherwise.

The Customer is obliged to configure and use the functions provided appropriately in order to protect its systems and data.

9. Liability and allocation of risk

To the extent permitted by law, centron shall not be liable for damage attributable to a breach of the obligations incumbent on the Customer under this Shared Responsibility Model.

In all other respects, centron’s liability is governed by the General Terms and Conditions.

10. Final provisions

This Shared Responsibility Policy supplements the existing contractual provisions between the parties.

In the event of conflicts, the rules on the order of precedence set out in the Terms of Use shall apply.