# Security

Source: https://docs.quake.ai/docs/platform/security
Markdown: https://docs.quake.ai/docs/platform/security.md
> The Quake AI shared responsibility model: the platform secures the infrastructure while you protect your workloads, data, and access.

---

# Security

Quake AI follows a **shared responsibility** model: the platform secures the underlying infrastructure, and you configure and protect your workloads, data, and access within your projects.

## Shared responsibility at a glance

| Area | Platform responsibility | Your responsibility |
|---|---|---|
| Physical infrastructure | Datacenter security, hardware, power, cooling | N/A |
| Hypervisor and host OS | Isolation between tenants, patching | N/A |
| Network backbone | Backbone integrity, DDoS mitigation | Security groups, firewall rules, and TLS on public endpoints |
| API authentication | Keystone identity, token issuance | Credential rotation, app credential scope, MFA |
| Compute instances | VM placement, host security | OS patching, SSH key management, user data scripts |
| Block storage | Volume encryption at rest (infrastructure layer) | Access control, snapshot policies, backup strategy |
| Object storage | Storage infrastructure availability | Bucket policies, SSE-C/SSE-OMK encryption, access control |
| Kubernetes | Control plane provisioning (via Magnum) | RBAC, network policies, image scanning, secrets |
| Service availability | API uptime, regional redundancy | Workload redundancy, health checks, auto-scaling |

For the full breakdown, see [Shared responsibility model](/docs/platform/security/shared-responsibility).

## Start here

Work through the [Security hardening checklist](/docs/platform/security/hardening-checklist) on a new project. It covers the credentials, security groups, and instance settings worth fixing before you put real traffic on the project.

## Concepts

<DocsSectionLinks section="security" />

## How-to

<DocsSectionLinks section="security/how-to" />

## Related builds

<RelatedBuilds service="security" />

## Reference and operations

When a token or an application credential stops authenticating, start with [Auth token diagnostics](/docs/operations/troubleshooting/auth-token-diagnostics). [Access and credentials](/docs/platform/access) covers how to rotate keys and scope application credentials.

[Network](/docs/network) documents security groups, [Compute](/docs/compute) covers SSH keys and instance access, and [Object storage](/docs/object) covers bucket policies and encryption options.