Introduction

This Shared Responsibility Model (this "Model") explains how security, operational, and compliance responsibilities are divided between EasyCloudify LLC ("EasyCloudify", "we", "us", or "our"), a cloud web platform company based in the United States, and you, our customer ("you", "your", or "Customer"), when you use our services (the "Services").

EasyCloudify operates under a Managed Platform as a Service (PaaS) model. We deliver a fully managed platform built on top of independently certified, third-party public cloud infrastructure. Responsibility for the overall environment is therefore shared across three layers: the underlying cloud infrastructure, the managed platform we operate, and the applications and data you run on it.

This Model is not exhaustive. EasyCloudify may update it at its discretion by posting a revised version on the EasyCloudify website and/or Services. All capitalized terms used herein have the same meanings as defined in the Terms of Service, and this Model should be read together with the Terms of Service, the Acceptable Use Policy, and any applicable Data Processing Agreement.

Our Service Model: Managed Platform as a Service

EasyCloudify is a platform provider, not a data-center operator. We do not own or operate the physical facilities, host hardware, or network backbone on which the Services run. Those are provided and maintained by certified third-party public cloud infrastructure providers (each, an "Underlying Cloud Provider").

On top of that infrastructure, EasyCloudify provides and manages a platform layer that includes provisioning, operating-system hardening and patching, deployment automation, managed firewall and Web Application Firewall (WAF) rules, security configuration, automated backups, monitoring, and operational oversight. Within this model:

The Underlying Cloud Provider is responsible for the security of the infrastructure.
EasyCloudify is responsible for the security and operation of the managed platform layer.
You are responsible for the security of what you build, deploy, store, and grant access to on the platform.

The Three Layers of Responsibility

Underlying Cloud Infrastructure (Provider-Managed). Physical datacenters and environmental controls, host servers, storage and networking hardware, and virtualization. These are owned, operated, and independently audited by the Underlying Cloud Provider.
The Managed Platform (EasyCloudify-Managed). The operating system, runtime, middleware, platform tooling, managed network and application security controls, backups, and monitoring that we configure and operate on your behalf.
Your Applications and Data (Customer-Managed). Your application code and its dependencies, your data and databases, your configuration and secrets, your end users, and your use of the Services in compliance with applicable law and our policies.

Responsibility Matrix

The following matrix summarizes the default allocation of responsibility under the Managed PaaS model. Where a row is marked "Shared", responsibility is split as described in the "Shared Responsibilities" section below. This matrix is provided for clarity and does not expand EasyCloudify's obligations or liability beyond those set out in the Terms of Service.

Component or Activity	Responsible Party
Physical datacenters, environmental controls, host hardware	Underlying Cloud Provider
Storage and network hardware, virtualization and hypervisor	Underlying Cloud Provider
Operating-system provisioning, hardening, and patching	EasyCloudify
Runtime, middleware, and managed platform services	EasyCloudify
Managed firewall, WAF, and network security rules	EasyCloudify
Automated VPS backups and snapshots (provisioning and scheduling)	EasyCloudify
Platform monitoring, alerting, and operational incident response	EasyCloudify
Deployment automation and platform-level configuration	EasyCloudify
Verifying backup restores and exporting business-critical data	Shared
Application-dependency and third-party package security updates	Shared
Your application code, logic, and its vulnerabilities	Customer
Your data, databases, and the content you store or transmit	Customer
Application-level configuration, API keys, and secrets	Customer
End-user and team accounts, credentials, and multi-factor authentication	Customer
Lawful use of the Services and all hosted content	Customer
Third-party, open-source, and marketplace applications you deploy	Customer

EasyCloudify's Responsibilities

As the managed platform provider, EasyCloudify is responsible for operating and maintaining the platform layer. This includes:

Provisioning and Platform Operation. Provisioning compute, storage, and networking resources from our Underlying Cloud Providers and configuring them into a managed platform.
Operating-System Hardening and Patching. Applying security hardening to base images and deploying operating-system, kernel, and platform-runtime patches on a managed schedule.
Managed Firewall and WAF. Configuring and maintaining platform-level firewall rules, DDoS mitigation, and WAF rulesets designed to reduce exposure to common web threats.
Security Rules and Access Management of the Platform. Managing the platform's own administrative access controls, segregation of duties, and security configuration.
Automated Backups. Provisioning and scheduling automated VPS backups and snapshots in accordance with the plan you select.
Monitoring and Operational Incident Response. Monitoring platform health and availability and responding to platform-level incidents affecting the Services.
Deployment Automation and Platform Configuration. Maintaining the deployment pipelines, tooling, and platform configuration that run your workloads.

These responsibilities relate to the managed platform layer only and are performed subject to the service levels, exclusions, and limitations set out in the Terms of Service.

Your Responsibilities

You retain responsibility for everything you build, deploy, store, and control on the platform. This includes:

Application Code and Dependencies. The security, quality, licensing, and maintenance of your application code and all libraries, frameworks, containers, and third-party or open-source packages you deploy, including timely updates to address vulnerabilities in those components.
Your Data. The accuracy, legality, classification, and content of the data you store, process, or transmit, and ensuring you have the rights and lawful basis to do so.
Access and Credentials. Safeguarding your account credentials, API keys, tokens, and secrets; enforcing strong authentication and multi-factor authentication; and promptly revoking access that is no longer required.
User and Team Management. Managing the end users and team members to whom you grant access, and their actions within your account.
Application-Level Configuration. Configuring your applications, databases, environment variables, and security settings securely and correctly.
Lawful and Compliant Use. Using the Services in compliance with the Acceptable Use Policy, applicable laws, and any regulatory obligations that apply to your business, data, or industry.
Third-Party and Marketplace Applications. Evaluating, configuring, maintaining, and securing any third-party, open-source, or marketplace application you choose to deploy. Such applications are provided on an "as is" basis and are your responsibility to operate.
Data Protection Where You Are Controller. Determining the purposes and means of processing personal data you control, and meeting your own obligations as a data controller.

Shared Responsibilities

Some responsibilities are shared. In each case, EasyCloudify operates the platform capability, and you remain responsible for how you use it and for the parts that are specific to your workload:

Patching. We patch the operating system, runtime, and managed platform components. You are responsible for updating your application code and its dependencies.
Backups and Recovery. We provision and schedule automated VPS backups and snapshots. You are responsible for selecting an appropriate retention plan, periodically verifying that restores meet your needs, and exporting or independently retaining business-critical or regulated data. Platform backups are a convenience and are not a substitute for your own backup and disaster-recovery strategy for critical data.
Firewall and WAF. We manage platform-level firewall and WAF rulesets. You are responsible for application-level access controls, input validation, and secure coding. These controls reduce risk but do not guarantee that your applications are free from vulnerabilities or intrusion.
Security Monitoring. We monitor the platform. You are responsible for monitoring your own application behavior, logs, and user activity, and for reporting suspected issues to us promptly.
Compliance. Our platform controls are designed to support your compliance efforts. Meeting the specific legal and regulatory requirements that apply to your data and use case remains your responsibility.

Certifications and Compliance Inheritance

Infrastructure-level certifications and attestations (such as SOC 2, ISO 27001, PCI DSS, and similar frameworks) are held, maintained, and independently audited by our Underlying Cloud Providers, not by EasyCloudify.

No Independent Data-Center Certification. As a platform provider rather than a data-center operator, EasyCloudify does not claim data-center certifications in its own name.
Inheritance and Reliance. EasyCloudify inherits and relies on the certifications maintained by its Underlying Cloud Providers for the infrastructure layer, and applies its own operational controls at the platform layer (including hardening, access management, patching, backups, firewall and WAF rules, monitoring, and incident response).
Provider Documentation. Where available, infrastructure assurance documentation can be made available through the relevant Underlying Cloud Provider's official compliance resources, subject to that provider's disclosure requirements.

Nothing in our communications, marketing, or documentation should be interpreted as a representation that EasyCloudify independently holds a certification maintained by an Underlying Cloud Provider.

Backups and Data Retention

EasyCloudify provides automated VPS backups and snapshots as part of the managed platform, according to the plan you select. Backups are provided to support operational resilience. You remain responsible for confirming that your backup frequency and retention settings meet your requirements, for periodically validating restores, and for maintaining independent copies of any data that is critical to your business or subject to legal retention obligations. EasyCloudify is not responsible for data loss arising from your own actions, deletions, misconfigurations, or application defects.

Security, Firewall, and WAF

EasyCloudify configures and maintains managed firewall rules, DDoS mitigation, WAF rulesets, and platform security rules intended to reduce exposure to common threats. No security control can eliminate all risk. You are responsible for writing secure application code, validating inputs, managing your own secrets, and promptly applying updates to your application dependencies. EasyCloudify does not warrant that the Services or your applications will be uninterrupted, error-free, or immune from compromise.

Limitations of Responsibility

Except as expressly stated in this Model and subject to the limitations of liability in the Terms of Service, EasyCloudify is not responsible or liable for:

Customer Configuration and Code. Vulnerabilities, defects, outages, or losses arising from your application code, dependencies, configuration, or misuse of the Services.
Credential Compromise. Unauthorized access resulting from compromised, shared, or poorly managed Customer credentials, API keys, or secrets.
Third-Party and Marketplace Software. The security, availability, licensing, or fitness of any third-party, open-source, or marketplace application you choose to deploy.
Customer Data Actions. Data loss or corruption caused by your deletions, overwrites, migrations, or application behavior.
Underlying Infrastructure Events. Outages, defects, or events originating in the Underlying Cloud Provider's infrastructure that are outside EasyCloudify's reasonable control, including force majeure events.
Unsupported Modifications. Changes you make outside the supported platform interfaces, or your failure to apply updates or follow documented guidance.
Regulatory Determinations. Whether your particular use of the Services satisfies a specific law, standard, or regulatory framework applicable to your business.

Changes to This Model

EasyCloudify may revise this Model at any time by posting an updated version on its website and/or Services. Your continued use of the Services after a revised version is posted constitutes acceptance of the updated Model.

Contact

If you have questions about this Shared Responsibility Model, the division of responsibilities, or the operational security controls that apply to your account, please contact us at [email protected].

Shared Responsibility Model