Dedicated Cloud instances on AWS have used the W&B-managed cloud-native key for encryption since before August 2024.On Google Cloud and Azure, Dedicated Cloud instances that W&B created in August 2024 or later use the W&B-managed cloud-native key to encrypt the W&B-managed database and object storage. Instances that W&B provisioned before August 2024 use the default cloud provider managed key.
Data encryption in Dedicated Cloud
Learn how W&B encrypts data in Dedicated Cloud using cloud-native keys and the customer-managed encryption key policy.
This page describes how W&B encrypts the W&B-managed database and object storage in Dedicated Cloud, and explains W&B’s policy on customer-managed encryption keys. This page is intended for security and compliance teams evaluating Dedicated Cloud for use with sensitive AI workloads.
W&B uses a W&B-managed cloud-native key to encrypt the W&B-managed database and object storage in every Dedicated Cloud instance, using the customer-managed encryption key (CMEK) capability in each cloud. In this case, W&B acts as a customer of the cloud provider while providing the W&B platform as a service to you. Using a W&B-managed key means that W&B controls the keys that encrypt the data in each cloud, reinforcing its commitment to provide a secure platform to its customers.
W&B uses a unique key to encrypt the data in each customer instance, providing another layer of isolation between Dedicated Cloud tenants. The capability is available on AWS, Azure, and Google Cloud.
W&B doesn’t generally allow customers to bring their own cloud-native key to encrypt the W&B-managed database and object storage in their Dedicated Cloud instance. Multiple teams in an organization often have access to its cloud infrastructure, and some teams might not know that W&B is a critical component in the organization’s technology stack. They might remove the cloud-native key or revoke W&B’s access to it, which could corrupt all data in the organization’s W&B instance and leave it in an unrecoverable state.
If your organization needs to use its own cloud-native key to encrypt the W&B-managed database and object storage as a condition for adopting Dedicated Cloud, W&B can review the request on an exception basis. If approved, use of your cloud-native key for encryption conforms to the shared responsibility model of W&B Dedicated Cloud.