Shared Responsibility Model – Reindeer

Reindeer and each customer share responsibility for securing the Reindeer platform. Reindeer secures the infrastructure, the application, and the data it processes on your behalf. You control how your organization configures and uses the platform, including who has access, which systems you connect, and what data you send. The table below shows how these responsibilities divide across each area.

Responsibility matrix

Area	Reindeer is responsible for	You are responsible for
Physical infrastructure and hosting	Hosting the platform with a cloud provider that secures its data centers, and securing Reindeer's own cloud configuration	None
Platform operations	Patching, monitoring, and maintaining the availability of the platform	None
Application security	Developing the platform securely, and finding and fixing vulnerabilities	None
Encryption	Encrypting data at rest and in transit	None
Identity and access	Providing single sign-on (SSO) and access controls	Configuring SSO, assigning user access, and removing access when people leave your organization
Your data	Processing and protecting your data as your agreement with Reindeer specifies	Deciding which data to send to Reindeer, classifying it, and setting retention requirements
Credentials for connected systems	Storing the credentials you provide securely	Granting each connection only the permissions it needs, and rotating credentials
Agent workflows	Providing controls for reviewing and approving agent actions	Defining workflows, requiring approvals where needed, and reviewing agent outputs
Incident response	Monitoring the platform and notifying you of security incidents that affect your data	Reporting suspected incidents on your side, such as a compromised user account, to Reindeer
Your devices and network	None	Securing the devices, networks, and internal systems your users work from
Virtual appliance (when deployed in your network)	Supplying the appliance software and its updates	Hosting the appliance, placing it in your network, and managing firewall rules
Compliance	Holding ISO 27001 certification, completing SOC 2 audits, and sharing the resulting reports	Confirming that your use of Reindeer meets your own regulatory obligations

Certifications

Reindeer is ISO 27001 certified and has completed a SOC 2 audit. We share the SOC 2 report and the ISO 27001 certificate after both parties sign a mutual NDA (MNDA). To request them, contact your Reindeer account team.