RACI

This page lists every activity in the BYOC (Bring Your Own Cloud) deployment model, where Akka’s automated operations run inside the Customer’s own cloud account.

The four RACI roles:

  • R (Responsible): the party that does the work.

  • A (Accountable): the party ultimately answerable for the outcome.

  • C (Consulted): the party whose input is sought before or during the work.

  • I (Informed): the party kept up to date on progress or results.

Each role cell uses one of the following values: C = Customer, A = Akka, ± = Akka and Customer, blank = not applicable.

Filter by layer or owner, or search across activity, description, and cadence. Owner is derived from the Responsible column: Customer, Akka, or shared.

Layer
Owner

General

Sub-category Activity R A C I Description Cadence

Scope

Shared Responsibility

C

C

Anything not explicitly listed in this RACI is the Customer’s responsibility. This includes the underlying cloud account, customer application code, customer-side operational tooling, and any concern not explicitly assigned to Akka in the rows below. The Customer may request additional operational support from Akka via the standard support channel.

Infrastructure

Sub-category Activity R A C I Description Cadence

Permissions

Service Accounts & Keys (Akka-managed)

A

A

Akka creates and manages the service accounts, service account keys, and IAM bindings required for Platform operation within the Customer’s cloud account.

Cloud Account

Billing & Ownership

C

C

Customer owns and operates the account and pays the bill

Cloud Account

Provisioning

C

C

±

±

Customer sets up a dedicated cloud account for Akka to use for hosting the Platform. A dedicated account is recommended to simplify cost tracking and security boundaries; Akka advises against provisioning additional resources in it to prevent management conflicts, and anything the Customer adds outside this scope becomes the Customer’s responsibility.

Cloud Account

Quotas & Service Limits

C

C

A

A

Customer ensures enough quota based on usage for compute, storage, etc in the cloud account

Cloud Account

Execute akka-bootstrap

C

C

A

A

Customer executes Terragrunt script to grant programmatic access to the Cloud Account.

Cloud Account

Terraform State Backend

C

C

A

The Customer owns the Terraform state backend (cloud storage bucket, locking, encryption) used when running akka-bootstrap. Akka documents the requirements; the Customer runs and secures the backend.

Cloud Account

Akka Permissions via akka-bootstrap

C

C

A

A

The Customer creates and maintains our permissions into the Cloud Account. Akka has no permissions outside of these and cannot manage any resources or interact with anything in the Cloud Account beyond these. The Customer controls our access and has the ability to cut off access at any time.

Networking

Private Connectivity

C

C

A

A

Customer reviews and chooses a private connectivity pattern from the supported AAO patterns. Akka reviews and validates feasibility.

Networking

Ingress/Egress Connectivity Using Public Patterns

A

A

C

AAO installs a load balancer for the region and configures a certificate issuer (Let’s Encrypt by default). This certificate provider is used for platform APIs and generated application hostnames.

Networking

Ingress/Egress Connectivity Using Private Patterns with Auto-Generated IP Address

A

A

A

C

AAO installs the region using the Customer’s chosen private connectivity option. A load balancer is provisioned for the region with an automatically generated IP address, ensuring internal communication without traversing the public internet.

Networking

IP Address Management / CIDR Range Allocation

C

C

A

A

Customer assigns an appropriately sized CIDR block for cases where peering or hub and spoke is desired.

Networking

VPC Peering or Hub and Spoke Enablement (Not available on all cloud providers)

C

C

A

A

Customer sets up VPC peering or hub and spoke enablement.

Networking

IP Allowlist

C

C

A

A

The Customer is responsible for setting up and maintaining the IP allowlist for NAT gateways and load balancer.

Networking

DNS

C

C

A

A

Customer creates and maintains DNS records for platform machinery and apps in the cloud provider DNS zones configured by Akka for the installation.

Networking

Connectivity Pattern Whitepaper

A

A

Akka publishes a whitepaper and implementation details for the private connectivity patterns available on each cloud provider, which the Customer reviews when selecting a connectivity pattern.

Maintenance

K8s / DB Upgrades

A

A

C

The Kubernetes cluster and database are infrastructure Akka operates inside your cloud account. Akka aims to perform upgrades within the preferred maintenance window and notifies the Customer prior to any maintenance that causes downtime.

Operations

Cost Controls

C

C

A

Customer periodically reviews their cloud account subscription and the monthly charges that are incurred. Akka auto-provisions and maintains the cloud infrastructure and overhead required to run an Akka region. Automatic provisioning and de-provisioning of compute instances to accommodate utilization demand. Storage for the underlying persistence store scales automatically; its compute does not. Akka has various sizing options to keep costs in check but HA is the default.

Cloud/Infrastructure Audit Logging

Infrastructure Security Audit Logs

C

C

A

If any suspicious SIEM alerts are found, please notify Akka.

PKI

Customer Managed Database Encryption Keys

C

C

A

A

The Customer creates and maintains the key material for the CMEK and shares its identifier with Akka. Customer is responsible for ensuring access to the CMEK

PKI

Customer-Provided TLS Certificates

C

C

C

Where Akka cannot automatically provision TLS certificates (e.g., private load balancers, or where the Customer brings its own domain), the Customer provides certificates or configures cert-manager. Akka validates and deploys. See https://doc.akka.io/operations/tls-certificates.html#_custom_server_certificates for details.

Backups and Recovery

Database Point-in-Time Recovery (PITR)

A

A

C

Akka enables continuous point-in-time recovery for the database and notifies the Customer once configured.

8-day retention

Backups and Recovery

Database Backups (Ad-Hoc)

C

C

A

The Customer notifies Akka after taking ad-hoc database backups (e.g., before high-risk changes, or snapshots taken for incident handling).

Backups and Recovery

Velero Used for K8s Resources

A

A

Akka uses Velero to back up stateful Kubernetes resources so they can be restored.

Backups and Recovery

Backup Restore Testing

A

A

C

Akka performs periodic restore testing against backups; results are summarized on request. The Disaster Recovery Exercise row covers joint exercises.

Permissions

Infrastructure Access Control and IAM

C

C

A

C

Customer runs akka-bootstrap which sets up IAM for the cloud account where the region is installed

Akka runtime & operators

Sub-category Activity R A C I Description Cadence

Setup

Bootstrapping Platform

A

A

C

A

The Customer reviews Akka’s default networking, compute, and persistence configuration, and recommends changes to improve app performance, optimize costs, or address other concerns.

Setup

Federation via Teleport

A

A

Akka installs the Teleport identity-aware proxy that is used for federation.

Setup

Akka Region Group

C

C

A

A

The Customer identifies region groups based on their use case and informs Akka.

Setup

Region Group Configuration

A

A

C

Akka configures region groups on the Federation Plane based on the Customer’s region groups configuration

Setup

Maintenance Window

C

C

A

A

The Customer provides a preferred maintenance window. Akka aims to use it for operations that may cause downtime, including database minor updates (applied automatically by the cloud provider) and manual upgrades such as database major patches.

Maintenance

Akka Runtime & Operators Patching / Vulnerability Management

A

A

C

Akka patches and remediates vulnerabilities in the Akka runtime & operators and the infrastructure it operates in your cloud account: the JVM, container base image, operating system, and Akka runtime that ship with the customer’s deployed services. Vulnerability reports are available from Akka’s trust center.

Maintenance

Releases

A

A

C

Akka schedules regular releases to installations, which can include the Runtime, Region machinery, and Federation Plane.

Operations

Scalability

±

±

±

Scaling of compute instances and storage for the underlying persistence store. Akka monitors utilization and concurrency demand and auto-scales accordingly within Akka’s defined sizing standards. The Customer should notify Akka in advance if they expect rapid expansion or need pre-warming for performance testing or spiky loads.

Operations

Your Akka App Elasticity

A

A

C

C

Akka dynamically adds and removes compute and persistence to accommodate real-time traffic against the Customer’s performance SLA targets.

Operations

Akka Region Decommission

A

A

C

C

When the Customer requests removal of a Region (e.g., end of contract, scope change, or topology adjustment), Akka follows the documented decommissioning runbook to gracefully remove the Region from the Federation Plane and clean up stale resources.

Operations

Feature Requests

C

C

A

C

The Customer submits feature requests via the support channel. Akka triages, prioritizes, and communicates status.

Observability

Platform Logs Excluding SDK Logs

A

A

Akka monitors all Platform logs except for SDK logs.

30-day retention

Observability

Availability

A

A

Akka monitors and reports availability of the Akka Platform, with uptime reports available on request. Platform availability commitments are governed by the Akka Federation Plane SLA Policy. Availability of customer-deployed services running on the platform is the Customer’s responsibility; see the Services layer.

Observability

Akka Region Telemetry

A

A

C

Akka monitors metrics and logs and will notify the Customer as needed.

Observability

Akka Region Telemetry for the Customer

C

C

A

Customer can optionally choose to set up platform telemetry for the cluster and for the database instance as they own the account. Akka can be consulted for components that they can set up observability

Observability

Application Telemetry Export

C

C

A

The Customer configures export of application logs and metrics to its observability platform via Akka SDK integration patterns.

Backups and Recovery

Disaster Recovery Exercise

±

±

Akka and the Customer work together periodically to simulate a disaster and fully recover from it, ensuring the recovery meets or exceeds the Customer’s needs.

Annual or as agreed

Backups and Recovery

Cross-Region Replication Configuration

±

±

C

The Customer specifies replication mode (e.g., region-pinned, replicated) per service. Akka enables and operates the underlying replication.

Backups and Recovery

Multi-Region Failover Procedure

A

A

C

C

Akka provides tooling and runbooks for failover. The Customer is consulted before failover and informed of execution.

Backups and Recovery

Recovery Time / Point Objectives

A

A

C

C

RTO/RPO targets are defined in the Customer’s agreement.

Developer Experience

SDLC Tooling Procedures

C

C

The Customer owns and operates the SDLC environment used to build services running on Akka, including IDE choices, source code repository, CI/CD pipelines, and developer programming environments. Akka ships developer tooling that the Customer integrates into the SDLC: IDE AI assistants, a local development environment, unit and integration testing utilities, and deployment configuration / deployment tooling.

Permissions

Access-Control Reports

A

A

Akka provides access-control reports for the Customer’s installation. Database-level audit logging is also available where required.

On request

Permissions

Just-in-Time Access for Customer Data

A

A

C

Where access to customer-confidential data is required (e.g., for incident handling), Akka requests authorization per the Access Control for Customer-Confidential Data policy. Audit logs of such access are available to the Customer on request.

Permissions

MFA on Akka Console & CLI

C

C

A

The Customer’s IDP enforces MFA for users accessing Akka console and CLI. Akka enforces MFA on its own internal access.

Permissions

Privileged Access via Teleport

A

A

C

Akka uses Teleport for human access to platform infrastructure, with session recording and audit logging. Access requires explicit justification and approval per Akka’s Access Control Policy. Teleport audit logs are available to the Customer on request.

Compliance

GDPR Requirements / Data Management

C

C

Customer is responsible for how services handle PII and to ensure such handling is compliant with GDPR (or other applicable privacy regulations). Akka acts as neither controller nor processor of data handled by the Customer’s services.

Federation Plane

Sub-category Activity R A C I Description Cadence

Security

Akka IAM Integration

A

A

C

C

Akka Federation Plane integrates with the Customer’s identity provider to manage organizations, users, and team access controls. Application-level access scoping is handled separately via ACLs and tokens (see Services, Security, Service ACLs).

Security

IAM (CLI and Console)

C

C

The Customer provides enterprise identity, authentication, and authorization systems and policies.

Procedures

Disaster Recovery

A

A

C

C

Akka maintains uptime for the Federation Plane and configures disaster recovery for it.

Procedures

Support and Communication Channels

±

±

At onboarding, Akka and the Customer agree on operational and engagement-level communication channels for routine collaboration (e.g., shared Slack channels, email distribution lists, regular review cadence). Formal support and incident channels are governed separately by the Customer Support Policy and the Incident Response row.

Procedures

Incident Response

A

A

C

Akka provides 24/7 incident response per the Customer Support Policy. The Customer opens incidents through the Customer Support Portal (support.akka.io), Akka Console (console.akka.io/support), or by email to [email protected]. Severity classifications, response time SLOs, escalation procedures, and incident communication protocols follow Akka’s Customer Support Policy and Incident Management Process. Other shared channels (e.g., Slack) may exist for ongoing engagements but are not a substitute for formal support cases.

Per Customer Support Policy

Procedures

Postmortem Delivery

A

A

Akka delivers post-incident reviews for Severity 1 and 2 incidents within an agreed cadence following resolution.

Procedures

Maintenance Notifications

A

A

C

Akka notifies the Customer in advance of planned maintenance windows that could affect availability, and via release notify emails for runtime/SDK releases. Maintenance windows should be set in advance by the Customer.

Per Customer Support Policy

Procedures

Operations Sync

A

A

C

C

Recurring operational review covering system health, maintenance, incidents, and roadmap items relevant to the Customer.

Procedures

Strategic Steering

A

A

C

C

Periodic alignment session covering usage, capacity, product direction, and Customer priorities.

Procedures

Executive Partnership Review

A

A

C

C

Executive-level partnership review covering relationship health, escalation status, and strategic items.

Procedures

BYOC Onboarding

±

±

C

Joint onboarding covering account setup, Region provisioning, connectivity validation, and acceptance criteria.

Procedures

Customer Portal Access & Training

±

A

C

C

Customers sign up for Portal access, Akka assigns their Region and walks them through console and CLI usage, and ticketing flow.

Procedures

Customer User & Team Management

C

C

C

The Customer manages its own users, teams, and role assignments within the Akka console.

Procedures

Customer Offboarding & Data Return

±

±

At end of contract, Akka coordinates region decommission, return or destruction of customer data, and revocation of access per the Data Retention Policy.

Per agreement

Procedures

Issue Tracking

A

A

C

Akka tracks Customer-raised issues and remediation through to closure with status visibility to the Customer.

Compliance

Security Questionnaire Response

A

A

C

Akka responds to Customer CAIQ/SIG and bespoke security questionnaires drawing on the ISMS control library.

Compliance

Data Breach Notification

A

A

C

Akka notifies the Customer without undue delay where a breach of Akka-held customer data poses risk, including nature, scope, and remediation.

Compliance

Sanctions Screening

A

A

C

Customer organizations are screened against sanctions lists periodically. The Customer is informed if a screening result requires action.

Compliance

End-of-Life Notification

A

A

C

Akka provides advance notice of any planned product or feature EOL with sufficient lead time for migration planning.

Compliance

Encryption in Transit and at Rest

A

A

Akka encrypts customer data in transit (TLS) and at rest using cloud provider encryption services. Default keys are Akka-managed.

Compliance

Cryptographic Key Management

C

C

A

Lifecycle, rotation, and access control of cryptographic materials follow the Akka Key Management and Cryptography Policy. Cloud-native KMS handles lifecycle for Akka-managed materials. Customer-managed keys (CMEK, BYO certificates) are managed by the Customer per the same policy.

Per Key Management and Cryptography Policy

Compliance

Vulnerability Scanning

A

A

C

Akka performs continuous vulnerability scanning of platform components and dependencies; findings are tracked to remediation per the Vulnerability Management Policy. Customers are notified of critical and high severity security patches via security advisory emails and the trust center. Disclosure occurs no later than the date the patch is made available, with coordinated advance notice to affected customers where applicable.

Compliance

Personnel Security & Background Checks

A

A

C

Akka performs background checks on personnel with access to customer environments and provides security awareness training, per the Personnel Security Policy.

Annual access certification

Compliance

SOC 2 Type II

A

A

Akka maintains SOC 2 Type II for the Akka Platform. Report available under NDA via trust.akka.io. SOC 3 is also available as a publicly-shareable companion.

Annual report; trust.akka.io kept current

Compliance

Data Residency

A

A

Customer data is stored within the cloud region(s) configured for the customer’s installation. Multi-region installations replicate within customer-selected regions only. Each customer’s data is isolated in dedicated database resources; no shared data plane across customers.

Compliance

Multi-Tenant Data Security

A

A

Akka is responsible for securing all customer data located within the Federation Plane.

Compliance

Customer Data Security

C

C

The Customer is responsible for securing Federation Plane tokens and access to projects.

Compliance

GDPR Requirements / Data Management

±

±

The Federation Plane doesn’t handle any customer data; it processes only minimal PII consisting of customer user and administrator identities, which is handled in accordance with Akka’s GDPR-compliant privacy policy.

Compliance

Subprocessor List

A

A

Current subprocessor list maintained at trust.akka.io.

trust.akka.io kept current

Compliance

Penetration Testing

A

A

Annual third-party penetration testing conducted as part of SOC 2 audit cycle. Executive summary available under NDA via trust.akka.io.

Annual

Compliance

Customer Audit Log Delivery

A

A

Akka maintains audit logs of control-plane actions (e.g., authentication, project and service lifecycle, IAM and token changes). Logs delivered on request. Recurring delivery cadences can also be arranged.

Services

Sub-category Activity R A C I Description Cadence

Maintenance

Application Code & Dependency Patching / Vulnerability Management

C

C

The Customer reviews their application code and any libraries or dependencies they introduce for security issues and vulnerabilities. The JVM, container base image, OS, and Akka runtime packaged into the deployed service are patched by Akka (see Akka runtime & operators / Maintenance / Infrastructure patch / Vulnerability management).

Maintenance

Service Configuration (incl. Secrets)

C

C

The Customer configures services to enable their functionality, including secrets for accessing other services.

Maintenance

Integrations Setup (Broker, Object Storage)

C

C

Where services depend on integrations such as brokers or object storage, the Customer configures these for the Akka Project before service deployment.

Maintenance

Deployments

C

C

The Customer owns and manages the lifecycle of Akka SDK apps.

Maintenance

Source Code Management

C

C

Source code management for Akka Service implementations is the Customer’s responsibility.

Maintenance

Scaling Limits

C

C

The Customer controls service instance counts within configured limits.

Monitoring

Logs from Services Built with Akka SDK

C

C

Metrics and logs are sent to the Customer’s logging platform. Akka filters out logs at the source so they are not sent to Akka’s internal observability stack.

Monitoring

SDK Logs

C

C

The Customer monitors application logs.

Security

Security Logs

C

C

The Customer can configure dashboards over cloud security logs and stream them to a GSOC or observability tool.

Security

Service ACLs

C

C

The Customer configures Service ACLs to protect access to non-public service endpoints.

Permissions

Application IAM

C

C

Akka SDK supports access scoping through JWTs and JWKS.