# Superclusters

## Security Overview

### Single-tenant by design

Lambda Superclusters are dedicated Single-tenant clusters with no shared components from the perimeter firewall down. Physical and logical isolation eliminates contention and inter-tenant risk.

### Assurance

- Completed:
  - SOC 2 Type II (Security & Availability criteria)

### Customer-controlled access

- Customer Controlled: Administrative control from day one
- Lambda access is revocable at any time: once revoked, all cluster access is governed by customer controls.

---

### Offering models & responsibility

We offer a baseline dedicated cluster with optional managed services. The matrix below clarifies who owns which controls.

| Layer / Control Area | Bare-metal / Physical-only Support(Self-managed) | Managed Superclusters(Co-managed) | Managed Kubernetes(Fully-managed) |
| --- | --- | --- | --- |
| Tenant isolation | Dedicated compute, network and storage hardware; no shared cluster component | Same | Same |
| Physical security | Dedicated cabinets. DC guard staff, CCTV, multi-factor checkpoints, optional secure cage or dedicated data hall | Same | Same |
| Network perimeter | Customer-managed firewall (default deny inbound) with VPN/peering options | Co-managed change workflows; Lambda proposes, customer approves | Integrated with k8s network policies |
| Management access | No standing Lambda logical access; you may grant time-boxed access as needed | Lambda retains tightly scoped access for operations, Lambda's access is revocable by the customer at any time | Lambda retains exclusive node management access, customer k8s access through SSO via OIDC/SAML with role-based access controls |
| OS & host hardening | Customer owns OS patching, users, keys, and logging | Joint: Lambda assists within coordinated maintenance windows; audit logs available | Lambda manages cluster and k8s control plane patching |
| Storage & keying | Networked storage encrypted at rest (AES-XTS 256-bit); customer controls access to data | Same; Lambda supports ops tasks with customer approval | Same |
| Monitoring & logging | Customer-provided tooling | Co-managed runbooks; logs and audit trails for Lambda actions | Integrated cluster logging and metrics |
| Support model | Break/fix hardware support via ticket system; no autonomous actions by Lambda. | Proactive operations per runbook with coordinated maintenance windows | Kubernetes and cluster lifecycle managed by Lambda |

---

### Physical security

#### FACILITY & ENCLOSURE
- Optional slab‑to‑slab hard‑walled room or dedicated secure cage (tight mesh, roof, optional below‑floor extension).
- Customer‑controlled badging and optional in‑cage cameras.
- Optional customer‑assigned security personnel to guard access to the isolated area.

#### CONTROLS & MONITORING
- 24×7×365 on‑site security presence and surveillance; perimeter fencing and gated access.
- Multi‑stage checkpoints with mantraps and multi‑factor access (badge + biometrics).
- Self‑closing, tamper‑resistant doors/gates; ingress/egress and aisle cameras with ≥90‑day retention.
- Physical access logging with ≥1‑year retention; access reviewed for maintenance and incidents.

### Data security

#### Logical security & platform hardening
- Encryption at rest: Persistent storage utilizes AES-XTS 256-bit encryption. A unique key is generated at build time for your cluster; data on a physically removed drive is irrecoverable without that key.
- In-transit: Storage traffic remains on your cluster’s local network.
- Media control: NIST 800-88 compliant data sanitization process at contract end, including physical destruction of obsolete or faulty storage media.

#### FIRMWARE & HOST BASELINE
- All nodes (compute, head, management) shipped with the latest validated BIOS and BMC firmware with secure BMC passwords.
- All nodes provisioned with a current Ubuntu LTS release. The customer receives root access on all nodes via the initial SSH authorized key.

#### NETWORK ARCHITECTURE
- In‑band Ethernet network (all compute/management nodes + persistent storage) with redundant DIA links; perimeter firewall initially configured with no Internet‑exposed ingress.
- InfiniBand fabric (spine‑leaf) for RDMA‑optimized GPU communication; secure IB keys configured to prevent nodes from altering IB fabric configuration.
- Management network for control plane systems, smart PDUs, device management interfaces, and BMC/DPUs; connectivity to in‑band via a dedicated management firewall.
- Out-of-band (OOB) network with its own firewall and a backup low-bandwidth Internet link for emergency device access; no general routing is allowed over the OOB.

#### ACCESS OPTIONS - CUSTOMER-CONTROLLED
- Client VPN on the perimeter firewall for secure remote access.
- Site‑to‑site IPsec VPN to your environment; optional IP allow lists on the outer tunnel.
- Private connectivity: AWS Direct Connect, Azure ExpressRoute, GCP Interconnect, OCI FastConnect terminated at your perimeter firewall.
- Direct jump node access (if preferred) via the Internet under your policies.

---

### Technical specifications cont./

#### Compliance and assurance
- SOC 2 Type II (Security & Availability): An independent assessment confirms that controls were suitably designed and operated effectively over the coverage period.
- Third‑party risk management: Lambda performs due diligence and continuous monitoring for all data centers in which we operate, reviewing providers’ SOC 2 reports for alignment with Lambda’s requirements.
- Trust Portal: Centralized access (under NDA as applicable) to attestations/certifications, privacy & security practices, product security measures (e.g., penetration testing executive summaries), and other security documentation.

### Customer controls & complementary responsibilities
To align with industry frameworks (e.g., SOC 2 CUECs/CSOCs), the following areas typically remain your responsibility unless otherwise scoped in a managed engagement:
- Identity & access management (SSO/IdP, user lifecycle, MFA policies) for your users.
- Network security policies (firewall rules, VPN credential hygiene, peering/IPsec secrets management).
- Logging/monitoring/SIEM integration and alerting for your workloads.

### Frequently asked assurances
- Data classification, application‑layer encryption, and key management policies.
- Approval for change control of maintenance windows and configuration updates.
- Can Lambda see our data? Lambda has no logical access to your cluster or its data unless you grant us access or opt to utilize our Managed Kubernetes service.
- What happens at contract end? All storage drives are sanitized in accordance with NIST 800-88 guidelines.
- How quickly can we cut off access? Immediately: revocation of Lambda access is supported and entirely under your control.