Shared Responsibility Model
Managed platforms fail at the seams. This page states plainly which side of each seam we are on, so nothing is assumed by either of us.
- We secure and operate the platform: hosts, network, runtimes, encryption, backups, patching.
- You secure what you build: application code, access decisions, data you choose to store, agent permissions.
- A few areas are genuinely shared — configuration, scaling limits, and incident response.
The split
| Area | Darwa | You |
|---|---|---|
| Physical and host security | Everything | — |
| Network isolation | Tenant isolation, private networking, edge protection | Deciding what to expose publicly |
| Runtime and OS patching | Base images, language runtimes, brokers, database engines | Your dependencies and lockfile |
| Encryption | In transit and at rest, key management, certificate rotation | Not disabling TLS in your own client |
| Backups | Taking them, storing them, restoring on request | Choosing retention, and verifying a restore matters to you |
| Availability | Platform uptime, failover, capacity | Health checks, graceful shutdown, retry logic in your code |
| Application security | Scanning, secret detection, advisories | Code, authentication, authorisation, input validation |
| Data content | Storing and processing it as instructed | What you collect, its lawful basis, and its accuracy |
| Access management | Roles, approvals, audit trail, SSO | Who you invite and which role you give them |
| Agent permissions | Scoped credentials, denial by default, call logging | Which tools an agent may use and on what data |
| Cost | Estimates, alerts, idle detection | Scaling ceilings and acting on the alerts |
Configuration is shared
We supply safe defaults — databases private, TLS required, secrets never in build output, preview environments excluded from indexing. If you change a default, the consequence of that change is yours. Every change is recorded with who made it and when.
Scaling limits are shared
We scale within the bounds you set. If your ceiling is too low for a traffic spike, requests queue; if it is very high, the bill follows. We warn before applying a scaling change and show the projected cost, but the bounds are your decision.
Incident response is shared
We detect and remediate platform incidents and tell you what happened. You are responsible for notifying your own users and regulators where your data is involved. We will provide the technical facts you need to do that, within the timelines in the DPA.
What we deliberately cannot do
- Read a secret value back to you or to an agent. Set and rotate, never retrieve.
- Recover data you deleted after the purge window has passed.
- Restore a database from a backup you disabled.
- Undo a destructive query. Point-in-time recovery is the remedy, which is why it is on by default.
Contact
Darwa Technologies FZ-LLC, Dubai Internet City, Dubai, United Arab Emirates. Written notice may be sent to legal@darwa.com. Security reports go to security@darwa.com. Privacy requests go to privacy@darwa.com.