> ## Documentation index
> Fetch the complete documentation index at: https://upstash.com/docs/llms.txt
> Ask it with GET https://upstash.com/docs/ask?q=<keywords or question>. Short keywords rank best.
> Use these to discover all available pages before exploring further.
> Feature requests: https://upstash.com/docs/common/help/feature-requests.md lists what users asked for and how to vote for a request or add one.
> Page rating: `GET https://upstash.com/docs/feedback?path=/docs/redis/help/shared-responsibility-model&helpful=true` (or `false`) records whether this page helped. An optional `comment` (URL-encoded, at most 500 characters) says what was missing or wrong. It is anonymous and needs no key. Comments hold no code, secrets or personal data.

# Shared Responsibility Model

The Shared Responsibility Model defines the security and operational responsibilities between Upstash and our customers when using Upstash Redis. This model ensures clarity in who is responsible for what aspects of security, compliance, and operations.

## Overview

Upstash Redis is a serverless database service that provides Redis® API compatibility with automatic scaling, high availability, and enterprise-grade security features. The shared responsibility model divides responsibilities into three main categories:

- **Upstash Responsibilities**: Infrastructure, platform, and service-level security
- **Customer Responsibilities**: Data, application, and access management
- **Shared Responsibilities**: Configuration, monitoring, and incident response

## Responsibility Matrix

| Category | Upstash | Customer | Shared |
|----------|---------|----------|--------|
| **Infrastructure Security** | ✅ Physical security, network infrastructure, DDoS protection, hardware maintenance | ❌ | ❌ |
| **Platform Security** | ✅ OS security, Redis updates, container security, infrastructure monitoring | ❌ | ❌ |
| **Service Availability** | ✅ 99.99% SLA (Prod Pack), multi-zone high availability (Prod Pack), multi-region replication, auto-scaling, disaster recovery | ❌ | ❌ |
| **Data Encryption** | ✅ TLS in transit, encryption at rest (Prod Pack), key management | ❌ | ❌ |
| **Compliance** | ✅ SOC 2 (Prod Pack), GDPR, HIPAA (Enterprise) | ❌ | ❌ |
| **Data Management** | ❌ | ✅ Data classification, retention policies, quality controls | ❌ |
| **Application Security** | ❌ | ✅ Secure development, input validation, authentication, client-side encryption | ❌ |
| **Access Control** | ❌ | ✅ Redis ACL, user permissions, credential management, MFA | ❌ |
| **Network Security** | ❌ | ✅ IP allowlist, network segmentation, client security | ❌ |
| **Security Configuration** | ❌ | ❌ | ✅ ACL setup, security policies |
| **Monitoring** | ✅ Infrastructure monitoring, incident response | ✅ Application monitoring, custom metrics | ✅ Performance monitoring, security monitoring |
| **Incident Response** | ✅ Infrastructure incidents, service restoration | ✅ Application incidents, data incidents | ✅ Incident coordination, root cause analysis |

## Key Responsibilities

<AccordionGroup>
  <Accordion title="Upstash Responsibilities">
    **Infrastructure & Platform:**
    - Physical security, network infrastructure, DDoS protection
    - OS security, Redis updates, container security
    - 99.99% uptime SLA (Prod Pack), multi-zone high availability for read regions (Prod Pack), multi-region replication, auto-scaling
    - TLS encryption, encryption at rest (Prod Pack), key management
    - SOC 2 (Prod Pack), GDPR, HIPAA (Enterprise)
    - 24/7 infrastructure monitoring and incident response
  </Accordion>

  <Accordion title="Customer Responsibilities">
    **Data & Application Security:**
    - Architecture: retries/backoff, idempotency, timeouts; region/topology choices
    - Data governance: classification, retention, integrity
    - App security: secure coding, input validation, authN/authZ
    - Access: Redis ACL (least privilege), credential hygiene and rotation
    - Network: IP allowlist and client hardening
    - Ops: monitoring/alerts, error handling, budgets/limits
  </Accordion>

  <Accordion title="Shared Responsibilities">
    **Configuration & Operations:**
    - ACL, IP allowlist, and Prod Pack configuration
    - Compliance requirements understanding and implementation
    - Performance monitoring setup and alerting
    - Incident coordination and root cause analysis
  </Accordion>
</AccordionGroup>