Shared Responsibility Model

§ 01Overview

Keeping services secure and continuously available is a shared effort: Ruk-Com covers one part and you cover another. This document sets out clearly which areas Ruk-Com looks after and which areas you are responsible for, so both sides start from the same understanding.

The scope differs by service type (Web Hosting, WordPress Hosting, VPS Hosting, PaaS and IaaS). In general, the more of the system you manage yourself, the more of its security you are responsible for.

§ 021. What Ruk-Com looks after

• Data centre and physical security — the facility, power, backup power, cooling, fire suppression and physical access control to the servers.
• Servers and network — the hardware, storage, network equipment and the virtualization layer.
• System availability — keeping the service online in line with the SLA.
• Tenant isolation — keeping each customer’s data separate so it cannot be accessed across accounts.
• System patching — updating and fixing vulnerabilities in the operating system and software that Ruk-Com manages (Managed packages only).
• Monitoring and attack prevention — overall platform security and baseline attack protection (advanced DDoS protection is available as an add-on).
• Platform-level backups — taken on the schedule defined for each package; they do not replace the backups you should keep yourself.
• Data deletion or return at the end of service — carried out securely according to our policy and timelines.

§ 032. What you are responsible for

• Security of the websites and applications you install — keeping your code, CMS, plugins and themes updated and secure, including vulnerabilities introduced by what you install.
• Password and access management — using strong passwords, granting appropriate team permissions and keeping credentials confidential.
• Your own backups — backing up your data regularly rather than relying on platform-level backups alone.
• Lawful, accurate content — your content and usage must be legal and must not infringe the rights of others.
• PDPA compliance — if you store other people’s personal data (for example your own customers’ data), you are the “data controller” and are responsible for complying with the law yourself.
• Resource usage — monitoring storage, bandwidth and resources so they stay within your package, and upgrading when needed.

§ 043. What both sides handle together

• Security alerts — whichever side notices something unusual must notify the other immediately through the agreed channel.
• Security settings that span both sides — for example SSL installation and firewall configuration.

§ 05Responsibility summary table

§ 06Responsibility by layer, per service type

R = Ruk-Com responsibility, C = Customer responsibility