AWS · infrastructure
AWS protects the infrastructure running its cloud services. Its responsibility varies by service, as described in its shared responsibility model.
QUARKS / TRUST CENTER
Security to operate with confidence.
For AWS deployments, we combine infrastructure services with controls defined for each project, so your team understands how the operation is protected and who is responsible.
We select and configure AWS capabilities according to each project's data, systems and requirements. Scope, coverage and responsibilities are documented with the customer for review.
Identity and access
Give each person and application only the access needed to do their work.
Related AWS capabilities
IAM and IAM Identity Center support identities, roles and least-privilege permissions, MFA and temporary credentials.
What we agree on
We agree on roles, permitted actions, identity federation, MFA, onboarding and offboarding, and who reviews access.
Data and secrets
Protect information and credentials without scattering them across teams and applications.
Related AWS capabilities
KMS manages keys and encryption; TLS protects data in transit according to the service. Secrets Manager manages credentials and supports configured rotation for compatible secrets.
What we agree on
We define data classification, read/write permissions, key ownership and access, encryption settings, supported TLS versions and rotation policies.
Network and applications
Reduce system exposure and manage traffic reaching applications.
Related AWS capabilities
VPC structures the network; PrivateLink offers private connectivity where services support it. WAF filters web traffic and Shield provides DDoS protection according to the contracted tier.
What we agree on
We agree on routes, endpoints, connectivity, WAF rules and DDoS coverage. The Shield tier and any Advanced subscription are specified in the scope.
Audit and monitoring
Use meaningful signals to investigate activity, changes and operational issues.
Related AWS capabilities
CloudTrail records user and API activity for configured events. CloudWatch and Config are options for metrics, logs, alerts, and configuration inventory and assessment.
What we agree on
We define sources and events, retention, coverage, alert recipients and review and response owners. The events covered and response hours are documented in the scope.
Threats and exposure
Prioritize risk signals and review exposure before deciding what to address.
Related AWS capabilities
GuardDuty provides threat detection; Security Hub brings together and prioritizes findings; Inspector assesses vulnerabilities in supported resources. Macie discovers sensitive data in Amazon S3.
What we agree on
These capabilities are selected according to architecture, resources and contracted services. The scope documents the services enabled, their coverage and the prioritization and remediation criteria.
Backup and continuity
Prepare a verifiable recovery path for the agreed information and resources.
Related AWS capabilities
AWS Backup centralizes policies and backups for supported resources, with separation across accounts or Regions where applicable.
What we agree on
We agree on coverage, retention, access, restoration and testing. Availability and recovery objectives (RTO/RPO) are defined according to the project's specific assessment.
AI with Amazon Bedrock
Bring AI into a process with appropriate access, data-use and review boundaries.
Related AWS capabilities
Bedrock supports configured permissions and private networks where compatible. Guardrails offers content and sensitive-data filters and contextual grounding checks for supported uses.
What we agree on
We select the model, API, Region or inference profile, filters and human oversight. Validation of use cases and responses accompanies their use to reduce risk.
SHARED RESPONSIBILITY
Security is a shared effort.
Quarks · implementation
Quarks designs and configures the components, applications, integrations and controls included in the contract, and agrees on owners for operation and evolution.
Customer · operations and data
The customer assigns owners, authorizes access and data use, provides requirements and manages tasks and systems under its control. Obligations are documented for each project.
AI / DATA
AI and privacy: explicit decisions about data.
According to AWS, Amazon Bedrock model deployment accounts are operated by AWS. Model providers cannot access those accounts, their logs, or customer prompts and completions there. This description is specific to Bedrock, not other providers or products.
Data use for training and operational retention are separate decisions. Before selecting a model or API, we review its terms of use and data handling; any no-training commitment must match those documented terms.
Retention depends on the model, Region, API and configuration, including the abuse-detection exceptions described by AWS. Storage and review can occur under those exceptions. Invocation logs configured for a project have their own coverage and retention.
Residency and processing are agreed when choosing the Region, model and inference profile. Cross-Region profiles can process requests outside the source Region. We define permitted data, minimization, filters and human review according to the process.
REQUIREMENTS / DOCUMENTATION
An assessment grounded in your operation.
In finance, healthcare, pharma and cross-border operations, we identify access, separation of duties, classification, consent, retention, location and integration requirements with the customer. Controls are tied to the use case and identified obligations.
To evaluate a project, you can request the control scope and applicable documentation: architecture, data flows, responsibilities, configuration, and agreed backup and restoration criteria. Availability and detail are reviewed according to scope and confidentiality.
Reports and certifications available through AWS Artifact concern AWS and the services included in its scope. This documentation alone does not establish compliance for Quarks or for any implementation. Customer assessment also considers applications, configuration and operations.
FAQ
Before we talk.
Are all these controls active in my project?
Selection depends on architecture and the contracted scope. A review identifies services, configuration, coverage and owners for each control.
Can we review industry-specific requirements?
Yes. Share your operational requirements and restrictions so we can assess controls, applicable evidence and responsibilities with your team.
Where is AI data processed?
The Region and inference profile are defined when selecting the model. We review residency, cross-Region processing, retention and API terms before agreeing on its use.
How do I request security documentation?
Complete the contact form with the system or process you want to evaluate. The team will review the context to discuss control scope and applicable documentation.
Let's review your operational requirements.
Tell us which process you want to deploy, what data it uses and which requirements it needs to meet. Our team will review the context to discuss controls and responsibilities.
Request a security review