RACI

This page lists every activity in the Dedicated, BYOC (Bring Your Own Cloud), and BYOK8s (Bring Your Own Kubernetes) deployment models:

  • Dedicated: Akka owns and operates the cloud account and runs the platform within it. Dedicated is BYOC with the cloud-account layer re-owned by Akka, so most activities match BYOC, with the account, networking, and account-security rows owned by Akka.

  • BYOC: Akka’s automated operations run inside the Customer’s own cloud account.

  • BYOK8s: Akka runs inside a Kubernetes cluster that the Customer provides and operates. The Customer owns more of the stack than in the other models; for example, database backups and Kubernetes and database upgrades are Customer-owned.

The Applies to column names the models a row covers. All means the row is the same in every model. Where the assignment differs by model, the activity appears once for each variant.

The four RACI roles:

  • R (Responsible): the party that does the work.

  • A (Accountable): the party ultimately answerable for the outcome.

  • C (Consulted): the party whose input is sought before or during the work.

  • I (Informed): the party kept up to date on progress or results.

Each role cell uses one of the following values: C = Customer, A = Akka, ± = Akka and Customer, blank = not applicable.

Filter by deployment model, layer, or owner, or search across activity, description, and cadence. Owner is derived from the Responsible column: Customer, Akka, or shared.

Deployment
Layer
Owner

General

Sub-category Activity Applies to R A C I Description Cadence

Scope

Shared Responsibility

Dedicated

C

C

Anything not explicitly listed in this RACI is the Customer’s responsibility. This includes the customer application code, customer-side operational tooling, and any concern not explicitly assigned to Akka in the rows below. The Customer may request additional operational support from Akka via the standard support channel.

Scope

Shared Responsibility

BYOC and BYOK8s

C

C

Anything not explicitly listed in this RACI is the Customer’s responsibility. This includes the underlying cloud account, customer application code, customer-side operational tooling, and any concern not explicitly assigned to Akka in the rows below. The Customer may request additional operational support from Akka via the standard support channel.

Infrastructure

Sub-category Activity Applies to R A C I Description Cadence

Permissions

Service Accounts & Keys (Akka-managed)

Dedicated and BYOC

A

A

Akka creates and manages the service accounts, service account keys, and IAM bindings required for Platform operation within the Customer’s cloud account.

Cloud Account

Billing & Ownership

Dedicated

A

A

C

Akka owns and operates the dedicated cloud account and pays the associated bill. The customer’s cost is set by an agreed structure.

Cloud Account

Billing & Ownership

BYOC and BYOK8s

C

C

Customer owns and operates the account and pays the bill

Cloud Account

Provisioning

Dedicated

A

A

C

Akka provisions and owns the dedicated cloud account it operates in for hosting the Platform, and sets up the account infrastructure and access it needs to run the region.

Cloud Account

Provisioning

BYOC and BYOK8s

C

C

±

±

Customer sets up a dedicated cloud account for Akka to use for hosting the Platform. A dedicated account is recommended to simplify cost tracking and security boundaries; Akka advises against provisioning additional resources in it to prevent management conflicts, and anything the Customer adds outside this scope becomes the Customer’s responsibility.

Cloud Account

Quotas & Service Limits

Dedicated

A

A

C

Akka ensures sufficient quota based on usage for compute, storage, etc. in the cloud account it owns; the Customer is consulted on expected usage.

Cloud Account

Quotas & Service Limits

BYOC and BYOK8s

C

C

A

A

Customer ensures enough quota based on usage for compute, storage, etc in the cloud account

Cloud Account

Akka Permissions

Dedicated

A

A

C

Akka creates and maintains its own permissions within the Cloud Account it owns and operates, managing all IAM roles and bindings required for Platform operation.

Cloud Account

Dedicated Account for Akka

Dedicated

A

A

C

Akka provisions and operates a dedicated Cloud Account exclusively for the Platform. To prevent management conflicts, no additional resources are provisioned in this account.

Cloud Account

Execute akka-bootstrap

BYOC

C

C

A

A

Customer executes Terragrunt script to grant programmatic access to the Cloud Account.

Cloud Account

Terraform State Backend

BYOC

C

C

A

The Customer owns the Terraform state backend (cloud storage bucket, locking, encryption) used when running akka-bootstrap. Akka documents the requirements; the Customer runs and secures the backend.

Cloud Account

Akka Permissions via akka-bootstrap

BYOC

C

C

A

A

The Customer creates and maintains our permissions into the Cloud Account. Akka has no permissions outside of these and cannot manage any resources or interact with anything in the Cloud Account beyond these. The Customer controls our access and has the ability to cut off access at any time.

Networking

Private Connectivity

Dedicated

A

A

C

Akka operates connectivity within its own VPC. Where the Customer integrates their own network (for example, a transit gateway), the parties coordinate on the integration.

Networking

Private Connectivity

BYOC

C

C

A

A

Customer reviews and chooses a private connectivity pattern from the supported AAO patterns. Akka reviews and validates feasibility.

Networking

Private Connectivity

BYOK8s

C

C

A

The Customer designs, implements, and operates private connectivity into and out of the cluster using whatever pattern fits their environment

Networking

Ingress/Egress Connectivity

Dedicated

A

A

C

AAO installs the load balancer and certificate issuer (Let’s Encrypt by default) for the region’s platform APIs and generated application hostnames. Where private connectivity is used, the load balancer uses an automatically generated IP so internal traffic does not traverse the public internet.

Networking

Ingress/Egress Connectivity Using Public Patterns

BYOC and BYOK8s

A

A

C

AAO installs a load balancer for the region and configures a certificate issuer (Let’s Encrypt by default). This certificate provider is used for platform APIs and generated application hostnames.

Networking

Ingress/Egress Connectivity Using Private Patterns with Auto-Generated IP Address

BYOC

A

A

A

C

AAO installs the region using the Customer’s chosen private connectivity option. A load balancer is provisioned for the region with an automatically generated IP address, ensuring internal communication without traversing the public internet.

Networking

Ingress/Egress Connectivity Using Private Patterns with Auto-Generated IP Address

BYOK8s

A

A

A

C

Akka provisions the load balancer for the region with an automatically generated IP address, ensuring internal communication without traversing the public internet.

Networking

IP Address Management / CIDR Range Allocation

Dedicated

A

A

C

Akka assigns an appropriately sized CIDR block for the account it owns where peering or hub and spoke is desired. The Customer is informed.

Networking

IP Address Management / CIDR Range Allocation

BYOC and BYOK8s

C

C

A

A

Customer assigns an appropriately sized CIDR block for cases where peering or hub and spoke is desired.

Networking

VPC Peering or Hub and Spoke Enablement (Not available on all cloud providers)

BYOC and BYOK8s

C

C

A

A

Customer sets up VPC peering or hub and spoke enablement.

Networking

IP Allowlist

Dedicated

A

A

C

Akka maintains the IP allowlist for the dedicated deployment, using the ranges the Customer provides.

Networking

IP Allowlist

BYOC

C

C

A

A

The Customer is responsible for setting up and maintaining the IP allowlist for NAT gateways and load balancer.

Networking

IP Allowlist

BYOK8s

C

C

A

A

The Customer is responsible for setting up and maintaining the IP allowlist for NAT gateways and load balancer. The Customer informs Akka of changes that may affect Akka runtime & operators connectivity.

Networking

DNS

Dedicated

A

A

C

Akka creates and maintains DNS records for platform machinery and apps in the cloud provider DNS zones for the installation in the account it owns. The Customer is informed.

Networking

DNS

BYOC

C

C

A

A

Customer creates and maintains DNS records for platform machinery and apps in the cloud provider DNS zones configured by Akka for the installation.

Networking

DNS

BYOK8s

C

C

A

A

Customer is responsible for setting up DNS zones, and record sets as per AAO spec

Networking

Connectivity Pattern Whitepaper

BYOC and BYOK8s

A

A

Akka publishes a whitepaper and implementation details for the private connectivity patterns available on each cloud provider, which the Customer reviews when selecting a connectivity pattern.

Maintenance

K8s / DB Upgrades

Dedicated and BYOC

A

A

C

The Kubernetes cluster and database are infrastructure Akka operates in the cloud account: Akka’s own account in Dedicated, your cloud account in BYOC. Akka aims to perform upgrades within the preferred maintenance window and notifies the Customer prior to any maintenance that causes downtime.

Maintenance

K8s / DB Upgrades

BYOK8s

C

C

A

A

The Kubernetes cluster and database are the Customer’s infrastructure in BYOK8s. The Customer schedules and runs Kubernetes and database upgrades. The Customer must consult Akka in advance so that Akka can certify the target versions against the Akka runtime & operators. Running an unverified version may break Platform functionality and is the Customer’s responsibility.

Maintenance

Infrastructure Change Coordination

BYOK8s

C

C

A

A

The Customer informs and coordinates with Akka before any change to the cluster, database, networking, or other infrastructure the Akka runtime & operators run on. Unannounced infrastructure changes can break the Akka Region and are the Customer’s responsibility.

Operations

Cost Controls

Dedicated

A

A

C

Akka pays the cloud bill in Dedicated and periodically reviews the cloud account subscription and monthly charges. Akka auto-provisions and maintains the cloud infrastructure and overhead required to run an Akka region. Automatic provisioning and de-provisioning of compute instances to accommodate utilization demand. Storage for the underlying persistence store scales automatically; its compute does not. Akka has various sizing options to keep costs in check but HA is the default. Akka provides cost and usage visibility to help the customer manage their spend.

Operations

Cost Controls

BYOC and BYOK8s

C

C

A

Customer periodically reviews their cloud account subscription and the monthly charges that are incurred. Akka auto-provisions and maintains the cloud infrastructure and overhead required to run an Akka region. Automatic provisioning and de-provisioning of compute instances to accommodate utilization demand. Storage for the underlying persistence store scales automatically; its compute does not. Akka has various sizing options to keep costs in check but HA is the default.

Operations

Scalability (Infrastructure)

BYOK8s

C

C

A

Customer is responsible for ensuring scalability for the Akka runtime & operators; includes compute capacity availability for node pools and database scalability

Cloud/Infrastructure Audit Logging

Infrastructure Security Audit Logs

Dedicated

A

A

C

Akka collects and retains the cloud infrastructure security audit logs for the dedicated account and investigates suspicious activity, sharing relevant findings with the Customer. Feeds into Akka’s SIEM / security monitoring.

Cloud/Infrastructure Audit Logging

Infrastructure Security Audit Logs

BYOC and BYOK8s

C

C

A

If any suspicious SIEM alerts are found, please notify Akka.

Cloud/Infrastructure Audit Logging

SIEM / Security Monitoring

Dedicated

A

A

C

Akka operates SIEM and security monitoring for the dedicated cloud account and notifies the Customer of relevant findings.

Cloud/Infrastructure Audit Logging

Cloud Security Posture

Dedicated

A

A

C

Akka owns cloud security posture management (security-service configuration and guardrails) for the dedicated account.

PKI

Customer Managed Database Encryption Keys

All

C

C

A

A

The Customer creates and maintains the key material for the CMEK and shares its identifier with Akka. Customer is responsible for ensuring access to the CMEK

PKI

Customer-Provided TLS Certificates

Dedicated

C

C

C

Where the Customer brings its own domain, the Customer provides TLS certificates or configures cert-manager, and Akka validates and deploys them. See https://doc.akka.io/operations/tls-certificates.html#_custom_server_certificates for details.

PKI

Customer-Provided TLS Certificates

BYOC and BYOK8s

C

C

C

Where Akka cannot automatically provision TLS certificates (e.g., private load balancers, or where the Customer brings its own domain), the Customer provides certificates or configures cert-manager. Akka validates and deploys. See https://doc.akka.io/operations/tls-certificates.html#_custom_server_certificates for details.

Backups and Recovery

Database Point-in-Time Recovery (PITR)

Dedicated and BYOC

A

A

C

Akka enables continuous point-in-time recovery for the database and notifies the Customer once configured.

8-day retention

Backups and Recovery

Database Point-in-Time Recovery (PITR)

BYOK8s

C

C

A

Customer is responsible for configuring continuous point-in-time recovery (PITR) for the database

At least 8 days retention

Backups and Recovery

Database Backups (Ad-Hoc)

BYOC and BYOK8s

C

C

A

The Customer notifies Akka after taking ad-hoc database backups (e.g., before high-risk changes, or snapshots taken for incident handling).

Backups and Recovery

Velero Used for K8s Resources

Dedicated and BYOC

A

A

Akka uses Velero to back up stateful Kubernetes resources so they can be restored.

Backups and Recovery

Velero Used for K8s Resources

BYOK8s

±

±

Akka uses Velero to back up stateful Kubernetes resources so they can be restored. Customer sets up necessary IAM binding and object storage for Akka

Backups and Recovery

Backup Restore Testing

Dedicated

A

A

C

Akka performs periodic restore testing against backups; results are summarized on request.

Backups and Recovery

Backup Restore Testing

BYOC

A

A

C

Akka performs periodic restore testing against backups; results are summarized on request. The Disaster Recovery Exercise row covers joint exercises.

Backups and Recovery

Backup Restore Testing

BYOK8s

±

±

C

Akka performs periodic restore testing against backups; results are summarized on request. The Disaster Recovery Exercise row covers joint exercises.

Permissions

Service Accounts & Keys

BYOK8s

C

C

A

A

Customer creates and manages the service accounts, service account keys, and IAM bindings required for Platform operation within the cloud account.

Permissions

Infrastructure Access Control and IAM

Dedicated

A

A

C

Akka owns account-level IAM for the dedicated cloud account where the region is installed.

Permissions

Infrastructure Access Control and IAM

BYOC

C

C

A

C

Customer runs akka-bootstrap which sets up IAM for the cloud account where the region is installed

Permissions

Infrastructure Access Control and IAM

BYOK8s

C

C

A

C

Customer is responsible for maintaining strict access control to the cloud infrastructure

Akka runtime & operators

Sub-category Activity Applies to R A C I Description Cadence

Setup

Bootstrapping Platform

Dedicated and BYOC

A

A

C

A

The Customer reviews Akka’s default networking, compute, and persistence configuration, and recommends changes to improve app performance, optimize costs, or address other concerns.

Setup

Bootstrapping Platform

BYOK8s

A

A

C

A

Akka installs the platform machinery after infrastructure is setup by the customer

Setup

Federation via Teleport

Dedicated and BYOC

A

A

Akka installs the Teleport identity-aware proxy that is used for federation. The Federation Plane authenticates through workload identity and receives short-lived certificates, with no long-lived credentials.

Setup

Federation via Teleport

BYOK8s

C

C

A

A

The Customer installs and maintains the Teleport identity-aware proxy used for federation, including ongoing operational health and version upgrades. Akka provides a short-lived token and the installation command at setup time.

Setup

Akka Region Group

All

C

C

A

A

The Customer identifies region groups based on their use case and informs Akka.

Setup

Region Group Configuration

All

A

A

C

Akka configures region groups on the Federation Plane based on the Customer’s region groups configuration

Setup

Maintenance Window

Dedicated and BYOC

C

C

A

A

The Customer provides a preferred maintenance window. Akka aims to use it for operations that may cause downtime, including database minor updates (applied automatically by the cloud provider) and manual upgrades such as database major patches.

Setup

Maintenance Window

BYOK8s

C

C

A

A

The Customer provides a preferred maintenance window. Akka aims to use it for operations that may cause downtime.

Maintenance

Akka Runtime & Operators Patching / Vulnerability Management

Dedicated and BYOC

A

A

C

Akka patches and remediates vulnerabilities in the Akka runtime & operators and the infrastructure it operates in your cloud account: the JVM, container base image, operating system, and Akka runtime that ship with the customer’s deployed services. Vulnerability reports are available from Akka’s trust center.

Maintenance

Akka Runtime & Operators Patching / Vulnerability Management

BYOK8s

A

A

C

Akka patches and remediates vulnerabilities in the Akka runtime & operators components it ships in the customer’s deployed services: the JVM, the container base image, and the Akka runtime. The underlying Kubernetes cluster and node OS are the Customer’s infrastructure (see Kubernetes & database upgrades). Vulnerability reports are available from Akka’s trust center.

Maintenance

Releases

All

A

A

C

Akka schedules regular releases to installations, which can include the Runtime, Region machinery, and Federation Plane.

Operations

Scalability

Dedicated and BYOC

±

±

±

Scaling of compute instances and storage for the underlying persistence store. Akka monitors utilization and concurrency demand and auto-scales accordingly within Akka’s defined sizing standards. The Customer should notify Akka in advance if they expect rapid expansion or need pre-warming for performance testing or spiky loads.

Operations

Your Akka App Elasticity

Dedicated and BYOC

A

A

C

C

Akka dynamically adds and removes compute and persistence to accommodate real-time traffic against the Customer’s performance SLA targets.

Operations

Your Akka App Elasticity

BYOK8s

A

A

C

C

Akka dynamically adds and removes compute and persistence to accommodate real-time traffic against the Customer’s performance SLA targets. This elasticity is contingent on the Customer ensuring sufficient cluster compute and database capacity headroom (see Scalability (Infrastructure)).

Operations

Akka Region Decommission

Dedicated and BYOC

A

A

C

C

When the Customer requests removal of a Region (e.g., end of contract, scope change, or topology adjustment), Akka follows the documented decommissioning runbook to gracefully remove the Region from the Federation Plane and clean up stale resources.

Operations

Akka Region Decommission

BYOK8s

±

±

C

C

When the Customer requests removal of a Region (e.g., end of contract, scope change, or topology adjustment), Akka follows the documented decommissioning runbook to gracefully remove the Region from the Federation Plane and clean up stale resources. Customer is responsible for deleting cloud infrastructure

Operations

Feature Requests

All

C

C

A

C

The Customer submits feature requests via the support channel. Akka triages, prioritizes, and communicates status.

Observability

Platform Logs Excluding SDK Logs

All

A

A

Akka monitors all Platform logs except for SDK logs.

30-day retention

Observability

Availability

All

A

A

Akka monitors and reports availability of the Akka Platform, with uptime reports available on request. Platform availability commitments are governed by the Akka Federation Plane SLA Policy. Availability of customer-deployed services running on the platform is the Customer’s responsibility; see the Services layer.

Observability

Akka Region Telemetry

All

A

A

C

Akka monitors metrics and logs and will notify the Customer as needed.

Observability

Akka Region Telemetry for the Customer

BYOC and BYOK8s

C

C

A

Customer can optionally choose to set up platform telemetry for the cluster and for the database instance as they own the account. Akka can be consulted for components that they can set up observability

Observability

Application Telemetry Export

All

C

C

A

The Customer configures export of application logs and metrics to its observability platform via Akka SDK integration patterns.

Backups and Recovery

Disaster Recovery Validation

Dedicated

A

A

C

Akka periodically validates disaster recovery for the platform it operates. Joint exercises with the Customer can be arranged as agreed.

As agreed

Backups and Recovery

Disaster Recovery Exercise

BYOC and BYOK8s

±

±

Akka and the Customer work together periodically to simulate a disaster and fully recover from it, ensuring the recovery meets or exceeds the Customer’s needs.

Annual or as agreed

Backups and Recovery

Cross-Region Replication Configuration

All

±

±

C

The Customer specifies replication mode (e.g., region-pinned, replicated) per service. Akka enables and operates the underlying replication.

Backups and Recovery

Multi-Region Failover Procedure

Dedicated

A

A

C

C

Akka operates the failover tooling and runbooks. The Customer is consulted before failover and informed of execution.

Backups and Recovery

Multi-Region Failover Procedure

BYOC

A

A

C

C

Akka provides tooling and runbooks for failover. The Customer is consulted before failover and informed of execution.

Backups and Recovery

Multi-Region Failover Procedure

BYOK8s

±

±

C

C

Akka and the Customer work together on failover: Akka provides the tooling and runbooks, and the Customer is consulted before failover and informed of execution.

Backups and Recovery

Recovery Time / Point Objectives

All

A

A

C

C

RTO/RPO targets are defined in the Customer’s agreement.

Developer Experience

SDLC Tooling Procedures

All

C

C

The Customer owns and operates the SDLC environment used to build services running on Akka, including IDE choices, source code repository, CI/CD pipelines, and developer programming environments. Akka ships developer tooling that the Customer integrates into the SDLC: IDE AI assistants, a local development environment, unit and integration testing utilities, and deployment configuration / deployment tooling.

Permissions

Access-Control Reports

Dedicated and BYOC

A

A

Akka provides access-control reports for the Customer’s installation on request. Database-level audit logging is also available where required.

On request

Permissions

Access-Control Reports

BYOK8s

A

A

Akka provides access-control reports covering Akka’s own privileged access to the Customer’s installation. The Customer manages their own IAM independently.

On request

Permissions

Just-in-Time Access for Customer Data

All

A

A

C

Where access to customer-confidential data is required (e.g., for incident handling), Akka requests authorization per the Access Control for Customer-Confidential Data policy. Audit logs of such access are available to the Customer on request.

Permissions

MFA on Akka Console & CLI

All

C

C

A

The Customer’s IDP enforces MFA for users accessing Akka console and CLI. Akka enforces MFA on its own internal access.

Permissions

Privileged Access via Teleport

All

A

A

C

Akka uses Teleport for human access to platform infrastructure, with session recording and audit logging. Access requires explicit justification and approval per Akka’s Access Control Policy. Teleport audit logs are available to the Customer on request.

Compliance

GDPR Requirements / Data Management

All

C

C

Customer is responsible for how services handle PII and to ensure such handling is compliant with GDPR (or other applicable privacy regulations). Akka acts as neither controller nor processor of data handled by the Customer’s services.

Federation Plane

Sub-category Activity Applies to R A C I Description Cadence

Security

Akka IAM Integration

All

A

A

C

C

Akka Federation Plane integrates with the Customer’s identity provider to manage organizations, users, and team access controls. Application-level access scoping is handled separately via ACLs and tokens (see Services, Security, Service ACLs).

Security

IAM (CLI and Console)

All

C

C

The Customer provides enterprise identity, authentication, and authorization systems and policies.

Procedures

Disaster Recovery

All

A

A

C

C

Akka operates the Federation Plane and configures disaster recovery for it.

Procedures

Support and Communication Channels

All

±

±

At onboarding, Akka and the Customer agree on operational and engagement-level communication channels for routine collaboration (e.g., shared Slack channels, email distribution lists, regular review cadence). Formal support and incident channels are governed separately by the Customer Support Policy and the Incident Response row.

Procedures

Incident Response

All

A

A

C

Akka provides 24/7 incident response per the Customer Support Policy. The Customer opens incidents through the Customer Support Portal (support.akka.io), Akka Console (console.akka.io/support), or by email to [email protected]. Severity classifications, response time SLOs, escalation procedures, and incident communication protocols follow Akka’s Customer Support Policy and Incident Management Process. Other shared channels (e.g., Slack) may exist for ongoing engagements but are not a substitute for formal support cases.

Per Customer Support Policy

Procedures

Postmortem Delivery

All

A

A

Akka delivers post-incident reviews for Severity 1 and 2 incidents within an agreed cadence following resolution.

Procedures

Maintenance Notifications

All

A

A

C

Akka notifies the Customer in advance of planned maintenance windows that could affect availability, and via release notify emails for runtime/SDK releases. Maintenance windows should be set in advance by the Customer.

Per Customer Support Policy

Procedures

Operations Sync

All

A

A

C

C

Recurring operational review covering system health, maintenance, incidents, and roadmap items relevant to the Customer.

Procedures

Strategic Steering

All

A

A

C

C

Periodic alignment session covering usage, capacity, product direction, and Customer priorities.

Procedures

Executive Partnership Review

All

A

A

C

C

Executive-level partnership review covering relationship health, escalation status, and strategic items.

Procedures

Onboarding

All

±

±

C

Joint onboarding covering account setup, Region provisioning, connectivity validation, and acceptance criteria.

Procedures

Customer Portal Access & Training

Dedicated

±

A

C

C

The Customer is assigned access to the Portal. Akka assigns their Region and walks them through console and CLI usage, and ticketing flow.

Procedures

Customer Portal Access & Training

BYOC and BYOK8s

±

A

C

C

Customers sign up for Portal access, Akka assigns their Region and walks them through console and CLI usage, and ticketing flow.

Procedures

Customer User & Team Management

All

C

C

C

The Customer manages its own users, teams, and role assignments within the Akka console.

Procedures

Customer Offboarding & Data Return

All

±

±

At end of contract, Akka coordinates region decommission, return or destruction of customer data, and revocation of access per the Data Retention Policy.

Per agreement

Procedures

Issue Tracking

All

A

A

C

Akka tracks Customer-raised issues and remediation through to closure with status visibility to the Customer.

Compliance

Security Questionnaire Response

All

A

A

C

Akka responds to Customer CAIQ/SIG and bespoke security questionnaires drawing on the ISMS control library.

Compliance

Data Breach Notification

All

A

A

C

Akka notifies the Customer without undue delay where a breach of Akka-held customer data poses risk, including nature, scope, and remediation.

Compliance

Sanctions Screening

All

A

A

C

Customer organizations are screened against sanctions lists periodically. The Customer is informed if a screening result requires action.

Compliance

End-of-Life Notification

All

A

A

C

Akka provides advance notice of any planned product or feature EOL with sufficient lead time for migration planning.

Compliance

Encryption in Transit and at Rest

All

A

A

Akka encrypts customer data in transit (TLS) and at rest using cloud provider encryption services. Default keys are Akka-managed.

Compliance

Cryptographic Key Management

All

C

C

A

Lifecycle, rotation, and access control of cryptographic materials follow the Akka Key Management and Cryptography Policy. Cloud-native KMS handles lifecycle for Akka-managed materials. Customer-managed keys (CMEK, BYO certificates) are managed by the Customer per the same policy.

Per Key Management and Cryptography Policy

Compliance

Vulnerability Scanning

All

A

A

C

Akka performs continuous vulnerability scanning of platform components and dependencies; findings are tracked to remediation per the Vulnerability Management Policy. Customers are notified of critical and high severity security patches via security advisory emails and the trust center. Disclosure occurs no later than the date the patch is made available, with coordinated advance notice to affected customers where applicable.

Compliance

Personnel Security & Background Checks

All

A

A

C

Akka performs background checks on personnel with access to customer environments and provides security awareness training, per the Personnel Security Policy.

Annual access certification

Compliance

SOC 2 Type II

All

A

A

Akka maintains SOC 2 Type II for the Akka Platform. Report available under NDA via trust.akka.io. SOC 3 is also available as a publicly-shareable companion.

Annual report; trust.akka.io kept current

Compliance

Data Residency

All

A

A

Customer data is stored within the cloud region(s) configured for the customer’s installation. Multi-region installations replicate within customer-selected regions only. Each customer’s data is isolated in dedicated database resources; no shared data plane across customers.

Compliance

Multi-Tenant Data Security

All

A

A

Akka is responsible for securing all customer data located within the Federation Plane.

Compliance

Customer Data Security

All

C

C

The Customer is responsible for securing Federation Plane tokens and access to projects.

Compliance

GDPR Requirements / Data Management

All

±

±

The Federation Plane doesn’t handle any customer data; it processes only minimal PII consisting of customer user and administrator identities, which is handled in accordance with Akka’s GDPR-compliant privacy policy.

Compliance

Subprocessor List

All

A

A

Current subprocessor list maintained at trust.akka.io.

trust.akka.io kept current

Compliance

Penetration Testing

All

A

A

Annual third-party penetration testing conducted as part of SOC 2 audit cycle. Executive summary available under NDA via trust.akka.io.

Annual

Compliance

Customer Audit Log Delivery

All

A

A

Akka maintains audit logs of control-plane actions (e.g., authentication, project and service lifecycle, IAM and token changes). Logs delivered on request. Recurring delivery cadences can also be arranged.

Services

Sub-category Activity Applies to R A C I Description Cadence

Maintenance

Application Code & Dependency Patching / Vulnerability Management

All

C

C

The Customer reviews their application code and any libraries or dependencies they introduce for security issues and vulnerabilities. The JVM, container base image, OS, and Akka runtime packaged into the deployed service are patched by Akka (see Akka runtime & operators / Maintenance / Infrastructure patch / Vulnerability management).

Maintenance

Service Configuration (incl. Secrets)

All

C

C

The Customer configures services to enable their functionality, including secrets for accessing other services.

Maintenance

Integrations Setup (Broker, Object Storage)

All

C

C

Where services depend on integrations such as brokers or object storage, the Customer configures these for the Akka Project before service deployment.

Maintenance

Deployments

All

C

C

The Customer owns and manages the lifecycle of Akka SDK apps.

Maintenance

Source Code Management

All

C

C

Source code management for Akka Service implementations is the Customer’s responsibility.

Maintenance

Scaling Limits

All

C

C

The Customer controls service instance counts within configured limits.

Monitoring

Logs from Services Built with Akka SDK

All

C

C

Metrics and logs are sent to the Customer’s logging platform. Akka filters out logs at the source so they are not sent to Akka’s internal observability stack.

Monitoring

SDK Logs

All

C

C

The Customer monitors application logs.

Security

Security Logs

All

C

C

The Customer can configure dashboards over cloud security logs and stream them to a GSOC or observability tool.

Security

Service ACLs

All

C

C

The Customer configures Service ACLs to protect access to non-public service endpoints.

Permissions

Application IAM

All

C

C

Akka SDK supports access scoping through JWTs and JWKS.