Data privacy in Yandex Cloud

Privacy and security of user data are top priorities in Yandex Cloud. As a company guided by the principles of openness and transparency, we take this matter very seriously so that our users can be sure their data is always safe.

Data protection

Even under the “shared responsibility” model, users maintain full control over their data.

Yandex Cloud is committed to ensuring the security and privacy of its users' data.

Learn more about the model of shared responsibility

Yandex Cloud security measures

Lawfulness and confidentiality

Personal data is only processed with the user’s consent, in the presence of an agreement with them, or for other legal reasons. Without the user’s permission, no personal information can be disclosed.

Data security

Yandex Cloud prevents unauthorized or accidental access, modification, deletion, blocking, or duplication of user data.

Privacy by design

Yandex Cloud follows “Privacy by Design” principles throughout the platform development lifecycle and in all business processes that involve the processing of personal data.

Transparency and accountability

To ensure the privacy of our users' information, we provide detailed and transparent reports of all data processing activities.

Limitation and minimization

The collection and processing of personal data are strictly limited to the pursuit of explicit and lawful objectives and are not carried out in an indiscriminate or otherwise excessive manner.

Ensuring data privacy

Privacy assurance procedures and policies are audited and certified.

Federal Law on Personal Data (No. 152-FZ)

General Data Protection Regulation (GDPR)

International Standard for Privacy Information Management

Security management tools

Identity and Access Management

Manage access to virtual machines and other cloud resources.

Audit Trails

A service for collecting and exporting audit logs about events in Yandex Cloud resources.

Key Management Service

Use keys to protect the secrets, personal data, and sensitive information you store in the cloud.

Lockbox

A service for creating and storing secrets in the Yandex Cloud infrastructure.

Questions and answers

Personal data of Russian citizens must be stored inside Russia. Cross-border data transfers are only possible with the owner’s consent and if the data had originally been added to a database hosted in Russia. The law also imposes requirements on how data is processed and the technical protection of the information system, including the part located in Russia.

The provider’s responsibility varies depending on the cloud service model used by the customer — Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS) — and the security mechanisms and policies available to the cloud provider.

For IaaS: The provider is responsible for the physical security and fault tolerance of the platform itself, network security, and the collection and analysis of security events from hypervisors and other infrastructure components.

For PaaS/SaaS: The provider ensures the security of PaaS/SaaS components. This includes VM protection, DB backups, and encryption of user data hosted in the cloud under Federal Law № 152-FZ.

Learn more about the provider's responsibility

The customer is responsible for managing access rights to resources and preventing unauthorized access to data. In both private infrastructure and cloud service models, companies are solely responsible for ensuring that data is labeled and properly classified to fulfill any regulatory compliance requirements.

The customer’s responsibility also varies depending on the cloud service model chosen: IaaS, PaaS, or SaaS. Companies that use the IaaS model should be responsible for the security of guest VMs, back up VMs, protect the virtual network, control access to resources, and secure cloud user accounts.

When using managed services (PaaS/SaaS), it is the responsibility of the customer to classify data, ensure access control, set up data protection, and manage their users and end devices.

While storing personal data in the cloud under Federal Law № 152-FZ, you continue to be the owner of the data and must fulfill all the duties as the data operator. This includes acquiring consent to process personal data, notifying Roskomnadzor about data processing, and modeling threats to your information systems.

You can do this yourself or with the help of one of Yandex Cloud’s trusted information security partners.

Learn more about customer actions

Do you have questions?

If you have any questions about the security of the cloud platform infrastructure, please contact us. Yandex Cloud experts will help you choose the best solution for your project.

Submit a request