AI Studio users should be aware of how responsibilities are shared between AI Studio and the Yandex Cloud customer. Understanding these control zones makes you an adept user of cloud resources and helps ensure security when using ML models, agents, and AI tools.

Yandex Cloud control zoneYandex Cloud control zone

• Physical security: Protection of data centers, server hardware, and physical infrastructure.

• Platform infrastructure: Platform fault tolerance, network security, and protection of hypervisors and infrastructure components.

• AI Studio services and components: Security and availability of Model Gallery, Agent Atelier, MCP Hub, and the API.

• ML models and their use: Ensuring the availability, updates, and support of the models offered by the service.

• Data-at-rest encryption: Encrypting all user data by default using Yandex Cloud keys.

• Data-in-transit encryption: Support for TLS with cipher suites that ensure PCI DSS compliance for all APIs.

• Encryption key management: Yandex Key Management Service infrastructure with support for the AES-GCM authenticated encryption standard and 128-, 192-, or 256-bit keys.

• Secret management: Providing Yandex Lockbox for secure storage.

• Availability and integrity of customer data: Storage security, data replication, monitoring, and logging.

• Access management: Authentication mechanisms, Yandex Identity and Access Management infrastructure, and service roles (ai.playground.user, ai.languageModels.user, ai.assistants.editor, and more).

• Roles for AI Studio: Providing granular roles, such as auditor, viewer, editor, and admin, for agents, datasets, models, and MCP servers.

• Audit logs: Yandex Audit Trails for collecting platform-level events and exporting them to Yandex Object Storage or Yandex Cloud Logging.

• Network security: Yandex Smart Web Security for protection against L7 attacks and DDoS Protection.

• DDoS protection: DDoS Protection infrastructure and traffic filtering.

• Scanning for vulnerabilities: Providing a vulnerability scanner for container images.

• Tools for building agents and apps: Providing an API, SDK, Agent Atelier tools, and AI Studio UI.

• Model fine-tuning: Model fine-tuning infrastructure (Tuning API) and training environment.

• Components for integration with external systems: MCP Hub and Yandex Search API.

• Infrastructure monitoring: Monitoring the platform infrastructure and its components.

• Compliance and certification: Compliance with ISO 27001/27017/27018/27701/42001, 152-FZ (FSTEC Order No. 21, UZ-1).

• API protection: Platform API security, request rate limiting, and request authentication.

• Prompt and output security: Providing a response moderation component.

• Incident management: Detecting and responding to infrastructure incidents.

Yandex Cloud customer control zoneYandex Cloud customer control zone

• ML models and their use: Using ML models to solve user tasks.

• Data-at-rest encryption: Enabling encryption with customer Yandex Key Management Service keys for critical data and managing key rotation.

• Data-in-transit encryption: Using only secure connections and validating certificates.

• Encryption key management: Creating and rotating customer keys, and setting a rotation period aligned with the customer's information security policy.

• Secret management: Storing tokens, API keys, and secrets in Yandex Lockbox, keeping secrets out of code and metadata.

• Access management: Assigning roles under the principle of least privilege, managing user accounts, and regularly auditing access permissions.

• Customer data: Classifying data, controlling access, protecting confidential information, and ensuring regulatory compliance.

• Audit logs: Enabling Yandex Audit Trails at the organization level, analyzing logs in Yandex SIEM, and configuring security event monitoring.

• Network security: Configuring security groups, segmenting the network, and using bastion hosts.

• DDoS protection: Protecting critical services against DDoS attacks using proprietary solutions or Yandex Cloud tools, such as Yandex DDoS Protection.

• Virus protection: Deploying antivirus solutions on virtual machines and in applications in the customer's cloud.

• Scanning for vulnerabilities: Enabling a scan-on-push policy and periodically scanning images at least once a week in the production environment.

• Agent and application development: Developing an agent logic, configuring workflows, testing prompts, and integrating them into business processes.

• Model fine-tuning: Preparing datasets, selecting fine-tuning parameters, validating results, and securing training data.

• Integration with external systems: Setting up connections to enterprise systems, securing integrations, and managing external tools.

• Infrastructure monitoring: Application-level monitoring, agent activity logging, and resource usage analysis.

• Backup: Setting up backups for applications, user data, and agent configurations.

• Compliance and certification: Ensuring compliance with industry regulations, auditing data usage, and documenting processes.

• API protection: Securely storing API keys, monitoring quota usage, and validating input data.

• Prompt and output security: Filtering sensitive data in prompts, validating model responses, and preventing information leakage through agents.

• Incident management: Developing an application-level incident response plan and notifying users of suspicious activity.