CoreWeave Security

Uncompromising AI cloud security. Engineered for what’s next.

Industry-leading cloud and software security

CoreWeave implements top-tier industry best practices and standards to prioritize security and privacy every step of the way.

Our platform earns customer trust

Identity and access management

CoreWeave Identity and Access Management (IAM) provides fine-grained, automated control over user access across CoreWeave services, now enhanced with Automated User Provisioning (AUP).

‍Fine-grained. Define exactly who or what can perform specific actions on particular resources with precise, role-based policies.
‍‍
Federation-centric. With Automated User Provisioning (AUP), CoreWeave supports integration with existing enterprise Identity Providers (IdPs) through the SCIM protocol, along with OIDC and SAML. This enables customers to use their existing identity infrastructure to automatically federate users and groups into CoreWeave IAM for workforce sign-on and workload identity federation.
‍‍
Extend your trust boundary. With CoreWeave IAM and AUP, you can use your existing identity and access management infrastructure natively on CoreWeave. Fully manage your users and groups with no changes to your operations in external IdPs such as Okta and Microsoft Entra, while automatically prescribing access to policy workflows on these principals with CoreWeave IAM.

Kubernetes and container security

CoreWeave Kubernetes Service (CKS) offers node isolation, where every node is single-tenant. This key feature empowers customers requiring maximum security for their workloads. CKS ensures that each customer cluster node operates within a securely isolated environment.

Storage encryption

CoreWeave Storage follows industry best practices with security. Encryption at rest, identity access management, authentication, and policies with role-based access strengthen data protection. CoreWeave AI Object Storage also features encryption in transit, and supports server-side encryption with customer-provided keys.

Network access controls and encryption

Create virtual, accelerated networks to manage your cloud resources on CoreWeave, powered by NVIDIA BlueField-3 DPUs. Deploy VPC networking to ensure customer network traffic stays private.

Incident response and patching

We proactively monitor and patch common CVEs and communicate those remediations to clients. We partner with various intelligence verticals to prioritize patching as quickly as possible.

CoreWeave also contracts with industry-best pentesting companies to regularly check products and services for vulnerabilities.

Move your workload, not the keys

Every cloud migration has doubled as a key migration: new provider, new key management, and a new custodian to trust. With Remote Key Encryption, your keys stay in the vault you already operate. Your key is never transmitted to or stored by CoreWeave, and your data lands as ciphertext we cannot read without deriving a key from your source.

Map your migration

Read the migration architecture

Your keys never make the trip

Remote Key Encryption (RKE) keeps your keys in the key source you already run. The authority to unlock your data stays on your side of the move.

Expand your trusted compute boundary

RKE empowers you to expand your existing “trusted compute boundary” from a hyperscaler, a third party vault, or a hardware security module to CoreWeave. We can never access your data unless you specifically grant it.

Revocation is a setting, not a negotiation

Set a time-to-live on key derivation. Revoke access in your key source and the next re-derivation fails, so cutting access is an action you control: it takes place inside your own infrastructure.

Server-side encryption with customer-provided keys is available on CoreWeave AI Object Storage today. Remote Key Encryption reaches Limited Availability in Q4 2026.

Security

Data center security

CoreWeave secures its data centers with a physical security program derived from industry professionals across cloud hyperscalers, three-letter agencies, law enforcement, and data center operators.

CoreWeave is committed to delivering physical security as a fundamental component of its platform and provides assurances tied to its Physical Security Baseline.

24/7/365 protection

All CoreWeave data centers are limited-access, fenced buildings with no visible signage. Around-the-clock security personnel prevent unauthorized access, keeping your data safe.

Air-tight entry processes and protocol

All data center access is controlled on a strict need-to-work basis with required business justification management approval.

Internal data and IP safeguarding

All CoreWeave employees are only granted access via biometric identification. Role-based access control (RBAC) manages access to sensitive data.

Protected hardware

We lock infrastructure hardware in secure cabinets.

Consistent surveillance

All CoreWeave data centers have cameras positioned at each access point that track access in real time.

No loose ends

All paper documents at any data center location are shredded on-site.

Security compliance

CoreWeave aligns its security and compliance programs to industry-standard SOC2 and ISO 27001 frameworks and requires our data center colocation providers to adhere to them throughout the lifecycle of their contract with CoreWeave.

Corporate cross-team engagement

Our internal Engineering, Security, Legal, Operations, and Compliance teams ensure these commitments are continuously met and maintained.

Personnel and access

Only authorized CoreWeave employees and personnel can touch CoreWeave infrastructure with strict as-needed and role-based access.

Our shared responsibility model

We build trust with clarity.

CoreWeave has developed a Shared Responsibility Model (SRM) to outline the responsibilities of both CoreWeave and customers from a security perspective.

The model below ensures clients understand their accountability while we fully manage, monitor, and control our own components.

Customer

‍Customer Layer
Customer Data Access Collection, Protection and Use; Legal, Acceptable Use, Privacy Policy Requirements‍
Application Layer
Application Performance; Reliability; Security and Management; Application Code‍
Access Layer
Identity and Access Management Policy Definitions; Environment Security; Network Policies and Firewalls‍
Data Layer
Data Classification; Data Protection; Encryption; Disaster Recovery Plans; Backups

CoreWeave

Platform Layer
Kubernetes Container Orchestration; API Services; Identity and Access Management Platform, Container Networking; Cloud Console; Virtual Private Cloud
Compute Layer
Operating System; Container Support; Hardware Drivers; Health Checking and Node Lifecycle; Endpoint Detection and Response
Network Layer
Internal and External Connectivity; Routing; Perimeter Monitoring; Firewalling
Physical Layer
Data Center Security; Power and Cooling; IT Inventory and Asset Management; Physical