Security
Shared responsibility
Understand which security responsibilities belong to Easel and which remain with your team.
Security on Easel is shared between Easel and the customer.
Easel secures the platform and provides deployment, traffic, access, and observability controls. Customers secure their application logic, identities, data, dependencies, and external integrations.
Easel responsibilities
Easel is responsible for:
- Operating the deployment platform
- Protecting the edge and control plane
- Isolating customer workloads
- Encrypting supported platform traffic
- Applying platform protections
- Enforcing configured firewall rules
- Protecting stored configuration according to platform controls
- Maintaining platform software
- Recording supported security events
- Responding to platform security incidents
Customer responsibilities
Customers are responsible for:
- Application authentication
- Authorization and data isolation
- Input validation
- Secure session handling
- Dependency selection and updates
- Secret scope and rotation
- Database security
- External service permissions
- Application security headers
- Firewall-rule correctness
- Reviewing security events
- Legal and privacy obligations for application data
Shared areas
| Area | Easel | Customer |
|---|---|---|
| Secrets | Secure storage and access controls | Choose, scope, and rotate values |
| Firewall | Execute rules reliably | Design and test rules |
| Deployments | Isolate and publish artifacts | Review source and dependencies |
| Logs | Collect and protect supported events | Avoid logging secrets and monitor events |
| Domains | Provide routing and TLS controls | Control DNS and domain ownership |
| Incident response | Respond to platform incidents | Respond to application and account incidents |
Application vulnerabilities
The firewall can reduce exposure but cannot correct insecure application logic.
Examples include:
- Broken authorization
- Injection flaws in application code
- Insecure direct object references
- Weak password-reset flows
- Cross-tenant data access
- Unsafe file uploads
- Vulnerable dependencies
Use secure development practices and application testing in addition to platform controls.
Compliance
Using a hosting platform does not automatically make an application compliant.
Customers remain responsible for:
- Data classification
- Configuration
- Access policies
- Retention
- User consent
- Vendor management
- Required audits
- Application-specific controls