CoreWeave Security

Uncompromising AI cloud security. Engineered for what’s next.

Industry-leading cloud and software security

CoreWeave implements top-tier industry best practices and standards to prioritize security and privacy every step of the way.

Our platform earns trust with these robust practices.

Identity and access management

CoreWeave Identity and Access Management (IAM) provides fine-grained, automated control over user access across CoreWeave services, now enhanced with Automated User Provisioning (AUP).

‍Fine-grained. Define exactly who or what can perform specific actions on particular resources with precise, role-based policies.
‍‍
Federation-centric. With the introduction of Automated User Provisioning (AUP), CoreWeave now supports integration with existing enterprise Identity Providers (IdPs) through the SCIM protocol, along with OIDC and SAML. This enables customers to leverage their existing identity infrastructure to automatically federate users and groups into CoreWeave IAM for seamless workforce sign-on and workload identity federation.
‍‍
Extend your trust boundary. With CoreWeave IAM and AUP, you can use your existing identity and access management infrastructure natively to CoreWeave. Fully manage your users and groups with no changes to your operations in external IdPs such as Okta and Microsoft Entra, while automatically prescribing access to policy workflows on these principals with CoreWeave IAM.

Kubernetes and container security

CoreWeave Kubernetes Service (CKS) offers robust node isolation—where every node is single-tenant. This key feature empowers customers requiring maximum security for their workloads. CKS ensures that each customer cluster node operates within a securely isolated environment.

Storage encryption

CoreWeave Storage follows industry best practices with security. Encryption at rest, identity access management, authentication, and policies with role-based access strengthen data protection and security. Plus, CoreWeave AI Object Storage features encryption in transit.

Network access controls and encryption

Create virtual, accelerated networks to manage your cloud resources on CoreWeave—powered by NVIDIA BlueField-3 DPUs. Deploy VPC networking to ensure customer network traffic stays private.

Incident response and patching

We proactively monitor and patch common CVEs and communicate those remediations to clients. We partner with various intelligence verticals to prioritize patching as quickly as possible.

CoreWeave also contracts with industry-best pentesting companies to regularly check products and services for vulnerabilities.

Data center security

CoreWeave secures its data centers with a physical security program derived from industry professionals across Cloud Hyperscalers, three-letter agencies, law enforcement, and data center operators.

CoreWeave is committed to delivering physical security as a fundamental component of its platform and provides assurances tied to its Physical Security Baseline.

24/7/365 protection

All CoreWeave data centers are limited-access, fenced buildings with no visible signage. Around-the-clock security personnel prevent unauthorized access—keeping your data safe.

Air-tight entry processes and protocol

All data center access is controlled on a strict need-to-work basis with required business justification management approval.

Internal data and IP safeguarding

All CoreWeave employees are only granted access via biometric identification. Role-based access control (RBAC) manages access to sensitive data.

Protected hardware

We lock infrastructure hardware in secure cabinets.

Consistent surveillance

All CoreWeave data centers have cameras positioned at each access point that track access in real time.

No loose ends

All paper documents at any data center location are shredded on-site.

Security compliance

CoreWeave aligns its security and compliance programs to industry-standard SOC2 and ISO 27001 frameworks and requires our data center colocation providers to adhere to them throughout the lifecycle of their contract with CoreWeave.

Corporate cross-team engagement

Our internal Engineering, Security, Legal, Operations, and Compliance teams ensure these commitments are continuously met and maintained.

Personnel and access

Only authorized CoreWeave employees and personnel can touch CoreWeave infrastructure with strict as-needed and role-based access.

Our shared responsibility model

We build trust with clarity.

CoreWeave has developed a Shared Responsibility Model (SRM) to outline the responsibilities of both CoreWeave and customers from a security perspective.

The model below ensures clients understand their accountability while we fully manage, monitor, and control our own components.

Customer

‍Customer Layer
Customer Data Access Collection, Protection and Use; Legal, Acceptable Use, Privacy Policy Requirements‍
Application Layer
Application Performance; Reliability; Security and Management; Application Code‍
Access Layer
Identity and Access Management Policy Definitions; Environment Security; Network Policies and Firewalls‍
Data Layer
Data Classification; Data Protection; Encryption; Disaster Recovery Plans; Backups

CoreWeave

Platform Layer
Kubernetes Container Orchestration; API Services; Identity and Access Management Platform, Container Networking; Cloud Console; Virtual Private Cloud
Compute Layer
Operating System; Container Support; Hardware Drivers; Health Checking and Node Lifecycle; Endpoint Detection and Response
Network Layer
Internal and External Connectivity; Routing; Perimeter Monitoring; Firewalling
Physical Layer
Data Center Security; Power and Cooling; IT Inventory and Asset Management; Physical

Who trusts us

These customers trust CoreWeave for their business-critical AI workloads.