> ## Documentation Index
> Fetch the complete documentation index at: https://www.algolia.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Shared responsibility

> Security is a shared responsibility between Algolia and its subscribers. Find out how the responsibility is divided.

export const Application = () => <Tooltip tip="An Algolia application is a self-contained environment with its own indices, configuration, and API keys. Applications don't share data or settings with each other.">
    application
  </Tooltip>;

As with any other cloud service, **security is a shared concern between Algolia and its subscribers**.
Algolia takes full responsibility for the security of its infrastructure.
You must follow [recommended practices](https://wikipedia.org/wiki/Cloud_computing_security) to keep your data and account safe.

## Algolia's security responsibilities

**Algolia secures its service.**
This includes securing the physical and virtual infrastructure, and staying compliant with security standards and certifications.
It also includes strong security practices, such as API keys with access control lists (ACL) and two-factor authentication.
Algolia also provides [SAML SSO](https://support.algolia.com/hc/en-us/articles/4406975258641-How-to-enable-Single-Sign-On-SSO-on-my-account) and [AES256 encryption](/doc/guides/security/algolia-vault) for users with the [Enterprise add-on](https://www.algolia.com/pricing/).

Algolia also makes sure its providers follow strong security rules.
All Algolia employees receive continuous security training.
Each new Algolia team member goes through mandatory security training.

Algolia secures the service.
**It's Algolia's job to secure everything it gives you**, including the [Algolia libraries](/doc/libraries).

## Your security responsibilities

Algolia handles defects in the service.
Algolia isn't responsible for the results of behavior or use that goes against [recommended practices](/doc/guides/security/security-best-practices).
Algolia also isn't responsible when you don't follow the docs for a given use case.
**You're responsible for how you use Algolia, and for the data you send.**

For example, Algolia provides [two-factor authentication](/doc/guides/security/security-best-practices#two-factor-authentication).
But it's your responsibility to activate it and make sure that your team members do too.
The same goes for your data.
Algolia offers features that let you keep sensitive data safe from unauthorized users.
You must use these features the right way.

## Control levels

For shared responsibility within a cloud service,
there are three levels of control:
inherited, shared, and user.
These help you understand what falls under Algolia's responsibility, and what's on you.

### Inherited controls

These are what you inherit from Algolia, and can't change.
For example, when you create a new Algolia <Application />,
Algolia provisions it on the platform.
For example, you can't deploy an Algolia application [on-premise](https://support.algolia.com/hc/en-us/articles/4406975236625-Can-I-run-Algolia-on-premises-on-my-own-servers-).
This makes **Algolia fully responsible for those controls**.

### Shared controls

These are what comes from Algolia, but you gain control over.
Shared controls have shared responsibility.
For example:

* Algolia provides and stores API keys and lets you generate new ones.
  Algolia is responsible for storing your keys securely and for properly encrypting the virtual ones.
  **You're responsible for how you store and use your keys on your end**.
* Algolia offers and maintains open source API clients and UI libraries. Use them to benefit from Algolia's security fixes and updates about potential risks.
  **You're responsible for upgrading to the latest versions of clients and libraries**.
  You're also responsible for securing the environment where you run them.
  It should support the features Algolia builds in, for example, by using [HTTPS](/doc/guides/security/security-best-practices#https-security-practices).
* Algolia trains its employees and builds security awareness internally.
  **You're responsible for training your teams**.

### User controls

These depend only on your use case and needs.
They're your full responsibility.
For example, you're responsible for how you name your indices.
You're also responsible for what data you send to Algolia and how you control access to it.
The same goes for which team members you invite to your app, and what access level you give them.

## See also

* [Security best practices](/doc/guides/security/security-best-practices)
* [What is Algolia's product compliance?](https://support.algolia.com/hc/en-us/articles/4406981951889-What-is-Algolia-s-product-compliance-)
* [Algolia security and compliance](https://www.algolia.com/distributed-secure/security-compliance/)