Shared Responsibility Volumes

This English version is provided for convenience only. The German version is legally binding; in the event of any discrepancy between the two versions, the German version shall prevail.

1. Introduction

The Shared Responsibility Model (SRM) describes the allocation of responsibilities between centron GmbH, Heganger 29, 96103 Hallstadt, Germany (the “Provider”) and the Customer when using Block Storage (Volumes).

Secure use of Block Storage requires that both the Provider and the Customer understand and fulfil their respective responsibilities. The Provider provides and secures the underlying storage infrastructure, while the Customer is responsible for the use, configuration and protection of the data stored on it.

As is customary for Infrastructure-as-a-Service offerings, responsibility for the stored data and its protection lies largely with the Customer.

2. Basic principle

The Provider is responsible for the security of the underlying infrastructure, in particular:

• physical data centres
• hardware and storage systems
• network infrastructure
• operation of the storage platform

The Customer is responsible for the security of the data stored on the Block Storage Volumes and its use, in particular:

• file systems
• data and content
• access controls
• integration into compute instances

This model follows the general principle that the Provider protects the infrastructure, while the Customer is responsible for the use and protection of its data.

3. Data security

Data on Block Storage Volumes is stored by the Provider in encrypted form at infrastructure level (“Encryption at Rest”), which reduces the risk of unauthorised access at the physical level.

The Customer nevertheless remains responsible for the protection of its data, in particular during ongoing operation within the connected systems.

The following is recommended:

• protecting the access credentials for the centron account
• managing user accounts separately
• using multi-factor authentication
• encrypting data appropriately

For increased security requirements, the Customer may implement additional encryption at file system level.

4. Operating system and file system responsibility

The Customer is fully responsible for:

• creation and management of file systems on the volume
• mounting and configuring the volumes
• access controls within the operating system
• maintenance and updating of the connected systems

Volumes are provided to the Customer as block storage and must be managed by the operating system of the respective compute instance.

5. Access security

The Provider provides the technical means to use volumes but assumes no responsibility for access control within the connected systems.

The Customer is responsible for:

• control of user access
• management of system permissions
• securing applications that access the volumes

Insufficient access controls may lead to unauthorised access to stored data and fall within the Customer’s area of responsibility.

6. Encryption

The Provider provides the following security mechanisms:

• encryption of data at storage level (“Encryption at Rest”)
• secured infrastructure for data storage

The Customer is additionally responsible for:

• optional client-side encryption
• encryption within the operating system
• secure key management

Additional encryption within the file system may be necessary in order to meet increased security or compliance requirements.

7. Logging and monitoring

The Provider provides the infrastructure but does not assume full responsibility for logging and monitoring at volume level.

The Customer is responsible for:

• monitoring the use of volumes
• analysing access
• setting up logging within the connected systems
• detecting anomalies or security incidents

As a rule, the Provider does not provide comprehensive logging or monitoring functions specifically for volumes.

8. Compliance and certifications

The Provider operates the underlying infrastructure in accordance with common security and compliance standards and may be subject to corresponding audits.

Volumes may be part of audits, for example in the context of ISO/IEC 27001 on the basis of IT-Grundschutz and C5:2026 audits.

However, the Customer is responsible for:

• compliance with statutory and regulatory requirements
• protection of sensitive data
• implementation of necessary security measures

The use of a certified infrastructure does not replace the Customer’s own compliance obligations.

9. Availability and data backup

The Provider ensures the availability and durability of the storage infrastructure.

The Customer is responsible for:

• creation and management of backups
• snapshot strategies
• data replication (where required)
• recovery processes

The Provider provides the platform but assumes no responsibility for data loss resulting from a lack of backup measures by the Customer.

10. Summary of responsibilities

The Provider provides a secure and reliable block storage infrastructure and protects the underlying systems as well as the physical storage of the data.

The Customer is responsible for the secure use of this infrastructure, in particular for:

• data and its protection
• access controls
• file systems and configuration
• backup and recovery strategies

Security in the cloud is therefore a shared responsibility in which both parties must fulfil clearly defined tasks.