Shared Responsibility
We operate a shared responsibility model with our customers. Broadly this means that the security and integrity of the Nucleus platform itself is our responsibility, and the accuracy and consistency of data held within it are the responsibility of the customer. The table below details how this breaks down for different areas of concern.
| Domain | Nucleus (Platform) Owns | Customer Owns |
|---|---|---|
| Platform | Securing the infrastructure, enforcing RBAC | — |
| Data validation | Validating submitted data against schema (type, format, required fields) | Ensuring the accuracy and correctness of the values submitted — schema-valid data can still be operationally wrong |
| Credential security | Providing key generation, rotation, and revocation tooling | Keeping credentials confidential, restricting use to authorised personnel/systems, rotating and revoking promptly on staff changes |
| Rate limiting & abuse prevention | Enforcing documented rate limits | Designing integrations that respect published limits and handle throttling gracefully |
| Audit & logging | Maintaining a full audit trail of all writes | Reviewing logs relevant to their own integration |
| Incident notification | Notifying customer promptly of any platform-side incident affecting their data | Notifying Bohr Team promptly of any suspected credential compromise or erroneous data pushed via their integration |
| Environment & testing | Providing a sandbox environment that mirrors production write behaviour | Validating integrations in sandbox before promoting to production |
| Versioning & change management | Following semantic versioning, giving deprecation notice ahead of breaking changes | Testing against new versions and migrating before deprecated versions are retired |