Shared responsibility: what the platform secures and what you do
Where a hosting platform stops securing and your application begins, the gaps teams assume are covered when they are not, and how that applies on Voroa.
What this covers
Security on a hosting platform is split, and the split is worth being explicit about because the gaps are where incidents happen. The platform is responsible for the machines, the network between them, the systems your code runs on and the way tenants are kept apart. You are responsible for everything inside your application: who can log in, what they are allowed to do once they have, whether your dependencies are current, and what you write to your logs. The most common mistake is assuming that because the platform encrypts data at rest, an application bug that returns another user’s records is somebody else’s problem.
A formal responsibility matrix for Voroa is not published today. The general split above is how platform hosting works.