## Customer environment security

URL: https://docs.atlan.com/product/connections/self-deployed-runtime/best-practices/customer-environment-security

> Customer environment security best practices for deploying and operating Self-Deployed Runtime

This document outlines customer environment security best practices and minimum security baselines for deploying and operating Self-Deployed Runtime in your environment.

## Security assessment process

Before deployment, customers must complete a security assessment that includes:

- **Network architecture review**: Validate network security controls and configurations
- **Credential management validation**: Verify secret management practices and policies

This assessment ensures your environment meets the minimum security baselines required for secure deployment.

## Infrastructure security

Your infrastructure must meet these minimum security baselines:

- **Container runtime security**: Kubernetes 1.24+ or Docker 20.10+ with security features enabled
- **Network segmentation**: Self-Deployed Runtime isolated from production systems 
- **Endpoint protection**: Anti-malware and endpoint detection solutions deployed
- **Vulnerability management**: Regular patching and vulnerability scanning implemented

## Network security controls

Self-Deployed Runtime uses outbound-only communication and never accepts inbound connections. Your network must implement these controls:

- **Outbound-only communication**: Self-Deployed Runtime never accepts inbound connections
- **TLS 1.2 minimum**: All external communication uses TLS 1.2 or higher
- **Firewall requirements**: Customer firewall rules for Self-Deployed Runtime communication

### Required network configuration

```yaml
firewall_rules:
 outbound_allowed:
 - destination: "<your-tenant>.atlan.com"
 port: 443
 protocol: HTTPS
 - destination: "<your-tenant>-temporal.atlan.com" 
 port: 443
 protocol: gRPC/TLS

 inbound_blocked:
 - all_traffic: DENY # No inbound connections to agent
```

For detailed configuration steps, see [Configure network security](https://docs.atlan.com/llms/platform/self-deployed-runtime/configure-network-security/llms.txt).

## Identity and access management

Apply the principle of least privilege with these requirements:

- **Principle of least privilege**: Self-Deployed Runtime credentials limited to required data sources only
- **Regular credential rotation**: Scheduled rotation of Self-Deployed Runtime access credentials
- **Audit logging**: Complete audit trail for Self-Deployed Runtime-related activities

## Ongoing security requirements

Maintain security with these ongoing requirements:

- **Vulnerability management**: Prompt application of security patches
- **Incident response coordination**: Participation in security incident response 

## Need help

If you need help, contact [**security@atlan.com**](mailto:security@atlan.com) for assistance.

---