> For the complete documentation index, see [llms.txt](https://docs.coherent.global/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coherent.global/support/shared-responsibility-model.md).

# Shared responsibility model

Security and compliance in a multi-tenant SaaS environment require a clear understanding of responsibilities between Coherent and its customers. The Shared responsibility model defines security and operational roles to ensure an efficient and secure Identity and Access Management (IAM) ecosystem. Coherent provides a secure platform; customers are responsible for configuring and managing security within their own environments.

{% hint style="info" %}
For the Spark application, "customer environment" refers the tenant(s) provisioned for your usage.
{% endhint %}

| Responsibility area                | Coherent                                              | Customer                                                 |
| ---------------------------------- | ----------------------------------------------------- | -------------------------------------------------------- |
| Infrastructure and cloud security  | ✅ Responsible                                         |                                                          |
| Platform encryption                | ✅ Responsible                                         |                                                          |
| Privileged Access Management (PAM) | ✅ Responsible for platform                            | ✅ Responsible for tenant                                 |
| Logging and monitoring             | ✅ Responsible for platform logging and monitoring     | ✅ Responsible for tenant monitoring and log review       |
| Incident response                  | <p>✅ Responsible<br>for platform-level incidents</p>  | <p>✅ Responsible<br>for customer tenant incidents</p>    |
| Compliance                         | <p>✅ Responsible<br>for platform-level compliance</p> | <p>✅ Responsible<br>for customer-specific compliance</p> |

## Security and access controls

| Coherent responsibilities                                                                                                                                                                                                                                                                    | Customer responsibilities                                                                                                                                                                             |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <ul><li>Secure hosting and platform availability.</li><li>Patch management and vulnerability remediation.</li><li>Encryption, tenant isolation, and network security.</li><li>Centralized logging and monitoring.</li><li>Platform-level IAM governance and JIT privileged access.</li></ul> | <ul><li>Authentication and MFA configuration.</li><li>User and role management.</li><li>Identity federation and integration security.</li><li>Tenant monitoring and compliance obligations.</li></ul> |

## Incident response and compliance

| Coherent responsibilities                                                                                                                                                                                                                                                                                | Customer responsibilities                                                                                                                                                                                                                                                                                                                                                 |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p>Platform level:</p><ul><li>Investigates and responds to platform security incidents.</li><li>Manages incidents involving privileged platform access.</li><li>Remediate vulnerabilities affecting the SaaS infrastructure.</li><li>Maintains compliance controls applicable to the platform.</li></ul> | <p>Customer environment:</p><ul><li>Respond to user access misuse or configuration-related incidents.</li><li>Review and manage privileged access within their tenant.</li><li>Ensure tenant configurations meet their legal, regulatory, and organizational requirements.</li><li>Maintain compliance obligations specific to their industry and jurisdiction.</li></ul> |