2026用户数据安全保护白皮书 ALIBABA CLOUD USER DATA SECURITY PROTECTION

ALIBABACLOUD

USERDATASECURITYPROTECTION

AlibabaCloud

⑥AlibabaCloud2026Allrightsreserved

WHITEPAPER

AlibabaCloud|AlibabaCloudUserDataProtectionWhitePaper

CONTENTS

1.ExecutiveSummary11.1CorePhilosophyofUserDataProtection11.2DataProtection:KeyMetricsataGlance2

2.SecurityArchitectureandGovernanceFramework3

2.1CloudSecurityCommunity3

2.2EightPillarsofCloudSecurity6

2.3Zero-TrustSecurityModel6

2.4KeyManagementService(KMS)7

2.5DataSecurityCenter(DSC)7

2.6ActionTrail7

3.DataSecurityCapabilitiesofStorageProducts93.1ObjectStorageService(OSS)93.2FileStorageNAS93.3ElasticBlockStorage(EBS)103.4Tablestore103.5CloudParallelFileStorage(CPFS)103.6CloudBackup(HBR)103.7CloudStorageGateway(CSG)113.8ComparisonofEncryptionCapabilitiesofStorageProducts11

3.9DataResidencyandCross-RegionTransmission12

ii

X-TWITTER

iii

AlibabaCloud

|

AlibabaCloudUserDataProtectionWhitePaper

X-TWITTER

4.

DataSecurityCapabilitiesofComputingProducts

16

4.1ConfidentialComputingTechnologySystem

16

4.2ECSSecurityArchitecture

17

4.3ACKContainerSecurity

17

4.4FunctionComputeSecurity

17

4.5DataResidencyandCross-RegionTransmission

17

5.

DataSecurityCapabilitiesofAnalyticsComputingProducts

21

5.1MaxCompute

21

5.2DataWorks

21

5.3RealtimeComputeforApacheFlink

22

5.4E-MapReduce(EMR)

22

5.5ComparisonofSecurityCapabilitiesofAnalyticsComputingProducts

23

5.6DataResidencyandCross-RegionTransmission

23

6.

DataSecurityCapabilitiesofDatabaseProducts

26

6.1TransparentDataEncryption(TDE)

26

6.2FullyEncryptedDatabase

27

6.3InsiderAccessRiskAssessmentforDatabaseProducts

27

6.4DataResidencyandCross-RegionTransmission

28

7.

DataSecurityCapabilitiesofAIProducts

31

7.1PlatformforAI(PAI)

31

7.2Qwen/ModelStudio

31

7.3DataResidencyGuarantee

32

7.4ComparisonofSecurityCapabilitiesofAIProducts

32

7.5DataResidencyandCross-RegionTransmission

32

8.ComplianceCertificationSystem36

8.1InternationalCertifications36

8.2RegionalandIndustryCertifications37

8.3DataSovereigntyandDataResidency37

iv

AlibabaCloud

|

AlibabaCloudUserDataProtectionWhitePaper

X-TWITTER

9.BestPractices:DataSecuritySolutionforEnterpriseAIHealthServicePlatform389.1BusinessScenariosandSecurityChallenges389.2OverallArchitectureDesign399.3NetworkandAccessSecurityDesign409.4ApplicationServiceLayerSecurityDesign409.5AICapabilityLayerSecurityDesign419.6DataStorageLayerSecurityDesign429.7BigDataAnalysisLayerSecurityDesign439.8IdentityandAccessManagementDesign449.9AuditingandComplianceDesign459.10SummaryofSecurityArchitecture47

10.FAQ

10.1AccessControlandPermissionManagement

10.2AuditLogIntegrityandImmutability

10.3EncryptionKeyManagement

10.4Multi-TenantIsolationandVirtualizationSecurity

10.5PhysicalSecurityandFirmwareProtection

10.6NetworkSecurityandIsolation

10.7ResourceConfigurationSecurity

10.8VersionLifecycleandUpgradeManagement

10.9SecurityCapabilities:ASummarybyThreatDomain

49

49

51

52

53

55

56

57

57

58

11.InternalAccessControlandPrivilegeManagement

11.1ClassificationandGovernanceofInternalAccessChannels11.2Service-specificInternalAccessProtection

11.3TechnicalSafeguardsandPlatformControls

11.4AdministrativeandGovernanceSafeguards

11.5SecurityCapabilityEvolutionRoadmap

11.6SecurityConfigurationandTieringGuide

60

60

64

66

67

68

69

12.SummaryandStrategicRecommendations71

12.1ComprehensiveAssessment71

12.2RecommendedSecurityBestPractices72

AlibabaCloud

|

v

AlibabaCloudUserDataProtectionWhitePaper

Appendix:OverviewofAlibabaCloud'sGlobalComplianceCertifications73

A.1InternationalCertifications73

A.2Asia-PacificCertifications75

A.3EuropeanCertifications76

A.4MiddleEastandAfricaCertifications76

A.5AmericasCertifications77

A.6Industry-specificCertifications77

1

AlibabaCloud|AlibabaCloudUserDataProtectionWhitePaper

1.EXECUTIVESUMMARY

Asglobaldigitaltransformationaccelerates,datahasbecomeanenterprise'smostcriticalstrategicasset,makingdatasecurityastrategicimperativethatdirectlyimpactscorporatecompliance,businessreputation,andcompetitiveadvantage.

CompiledfromofficialAlibabaClouddocumentation,theSecurity

WhitePaper(2024Edition),theTrustCenter,andindependentthird-partyreports,thiswhitepaperdeliversasystematicanalysisof

AlibabaCloud'sdatasecuritycapabilitiesacrossfivecoreproduct

lines:storage,computing,analyticscomputing,databases,andAI.

Itevaluateskeysecuritydimensions—suchasencryptionatrest,

encryptionintransit,confidentialcomputing,accesscontrol,auditing,dataresidency,andcompliancecertifications—andbenchmarks

thesecapabilitiesagainstAWS,offeringanauthoritativereferenceandpracticalbestpracticesforenterprisedecision-makers,securityarchitects,andcomplianceofficers.

1.1COREPHILOSOPHYOFUSERDATAPROTECTION

TheAlibabaCloudSecurityWhitePaper(2024Edition)introduces

the"cloudsecuritycommunity"philosophy.Thisconceptevolvesthetraditionalsharedresponsibilitymodelintoaframeworkfordeep,

collaborativepartnershipbetweenAlibabaCloudandcustomers.

Guidedbythisphilosophy,AlibabaCloudhasestablishedthe"EightPillarsofCloudSecurity"governanceframework.Thisframework

encompasseseightkeydimensions:end-to-endproductsecurity,

red-blueteamadversarialtesting,datasovereigntyprotection,identityandaccessmanagement,elasticandscalablesecurity,rapidthreatresponse,highresilienceandavailability,andglobalcompliance

support.

X-TWITTER

2

AlibabaCloud

AlibabaCloudUserDataProtectionWhitePaper

|

1.2DATAPROTECTION:KEYMETRICSATAGLANCE

Details

Metric

Security&compliancecertifications

Over140certifications,coveringmajorglobalmarkets.

World'sfirstCSASTARGoldCertification

JointlyawardedbytheBritishStandards

Institution(BSI)andtheCloudSecurityAlliance(CSA).

Globaldatacenterregionsandzones

104zonesin32regionsworldwide.

Confidentialcomputingtechnologies

SupportforkeytechnologiesincludingIntel®

SGX,Intel®TDX,CSV,AlibabaCloudEnclave,andGPUTEE.

Fullyencrypteddatabasecoverage

Spansfivemajorproducts:ApsaraDBRDS

forMySQL,ApsaraDBRDSforPostgreSQL,

PolarDBforMySQL,PolarDBforPostgreSQL,and

PolarDB-X.

KMSintegration

Nativelyintegratedwithnearlyallstorageanddatabaseproducts.

Zero-trustarchitecturescope

FullyimplementedfrominternalO&Mtomicroservice-levelcommunication.

X-TWITTER

3

AlibabaCloud

|

AlibabaCloudUserDataProtectionWhitePaper

2.SECURITYARCHITECTUREANDGOVERNANCE

FRAMEWORK

2.1CLOUDSECURITYCOMMUNITY

IntheSecurityWhitePaper(2024Edition)releasedattheApsara

ConferenceinHangzhouinSeptember2024,AlibabaCloudpioneeredthe"CloudSecurityCommunity"philosophyinChina.Thecore

viewpoint:"Ifcustomersarenotsecure,thecloudplatformcannotachievetruesecurity."ThisphilosophyreflectsAlibabaCloud's

commitmenttotreatingthesecurityofcustomers'cloudassetsasitsownresponsibility.

»"Ifcustomersarenotsecure,thecloudplatformcannotachievetruesecurity."—AlibabaCloudSecurityWhitePaper(2024Edition)

2.1.1DEFINITIONOFCUSTOMERDATA

Beforediscussingdataprotectionresponsibilities,itisnecessary

tofirstclarifythedefinitionandscopeofcustomerdata.Alibaba

Cloudusestermssuchas"membercontent,""userbusinessdata,"and"customerdata"indifferentscenarios.Theirmeaningsare

fundamentallyconsistent,uniformlyreferringtocontentthatcustomersrunon,interactwith,submitto,oruploadtoAlibabaCloudservices.

X-TWITTER

4

AlibabaCloud

|

AlibabaCloudUserDataProtectionWhitePaper

DataTypeDefinitionOwnershipandControlExamples

Membercontent,

customerdata

Contentthat

customersrun

on,interactwith,submitto,or

uploadtoAlibabaCloudservices

1.Customersare

responsiblefor

thedevelopment,

operation,maintenance,transmission,processing,storage,anduseofthe

contenttheyrunon,

interactwith,submitto,oruploadtoAlibabaCloudservices.

2.Customersretainallrightstheymayhavetoany

customerdata.AlibabaCloudwillnotaccessorusecustomerdataexcepttomaintainorprovide

AlibabaCloudservices,ortocomplywithapplicablelawsandregulations.

Businessrecordsindatabases,filesstoredinOSS,

dataonECSclouddisks,AImodel

trainingdatasets,etc.

2.1.2ALIBABACLOUDDATASECURITYCOMMITMENTS

Inthechapter"DataSecurityProtectionUpholdingDataSovereignty,"theAlibabaCloudSecurityWhitePaper(2024Edition)makesthe

followingcorecommitments:

CommitmentContent

Description

CommitmentDimension

Noaccess

Willnotaccess

customerdata

withoutauthorization

Canaccesscustomerdataonlyafterobtainingcustomerpermission;allaccessisloggedandaudited(seeChapter11).

Nouse

Willnotuse

customerdata

withoutauthorization

Willneverusecustomerdataformarketing,

advertising,oranyotherunauthorizedpurposes;ModelStudiocommitsto"neveruseyourdataformodeltraining."

Nomovement

Willnotmoveanyofthecustomer'sdatawithoutcustomerconsent

AlibabaCloudstoresandprocesseseach

customer'scontentonlyintheAlibabaCloud

regionsselectedbythecustomer.Ifacustomerchoosestostoredatacontentinmorethanoneregion,orcopiesormovescontentbetween

regions,thatisentirelythecustomer'schoice,andthecustomermustconsiderthelegal

requirementsapplicabletosuchoperations.

AlibabaCloudsafeguarding:technical

guarantees

Buildingamulti-

layerdataprotectionsystemthrough

technologiessuchastenantisolation,zero-trustarchitecture,

anddataencryption

Coveringtheentiredatalifecycle:Encryptionintransit(TLS),encryptionatrest(KMS,BYOK),

runtimeencryption(confidentialcomputingTEE).

Ecosystem

collaboration:compliancecertificationsupport

Continuously

obtainingglobalcertificationstohelpcustomersmeetcompliancerequirements

140+certificationsincludingISO27001,27017,27018,27701,SOC1/2/3,CSASTARGold,andGDPRcompliance.

X-TWITTER

5

AlibabaCloud

|

AlibabaCloudUserDataProtectionWhitePaper

2.1.3SHAREDRESPONSIBILITYMODEL

Inthechapter"DataSecurityProtectionUpholdingDataSovereignty,"theAlibabaCloudSecurityWhitePaper(2024Edition)makesthe

followingcorecommitments:

AlibabaCloud

Responsibilities

CustomerResponsibilities

ResponsibilityDimension

Networksecurity

Physicalandinfrastructuresecurity

Datacenterphysicalsecurity(securitypersonnel,access

control,monitoring);hardwaredevicesecurity;firmware

security(signatureverification);globalnetworkinfrastructure

VPCsecuritygroupconfiguration;

networkACLrules;choosingwhethertoenableVPCinternalnetwork

encryption;PrivateLinkconfiguration

None(fullymanagedbyAlibabaCloud)

Virtualizationandplatformsecurity

Hypervisorsecurity(hardenedKVM/QEMU);HostOSsecurity;CIPUsecurity;tenantisolation

None(fullymanagedbyAlibabaCloud)

Cloudservicesecurity

Servicesecurity(API

authorization,vulnerabilitypatching);availabilityand

securityofsecurityservices(KMS,DSC,ActionTrail)

Correctlyconfiguringandusing

services;enablingsecurityfeatures(suchasturningonencryption,

configuringsecuritygroups)

Basicnetworkisolation(VPC);basicDDoSprotection;internalnetworkencryption

Identity

andaccessmanagement

ProvidingRAM,SSO,

MFA;ensuringcomplete

authenticationmechanismswithoutbypasses

ConfiguringRAMpoliciesand

permissions;managinguser

accountsandpasswords;enablingMFA;managingAccessKeylifecycles

Datasecurity

Providingencryptiontools(KMS,TDE,SSE);providingdatasecurityservices(DSC);ensuringcorrectencryptionimplementation

Selectingandconfiguringencryptionschemes(SSE-KMS,BYOK,

fullyencrypteddatabase);data

classificationandgrading;backupstrategies;lifecyclemanagement

Applicationsecurity

ProvidingsecurityproductssuchasWAF,CloudFirewall;SDK

security

Applicationcodesecurity;Web

applicationprotectionconfiguration;APIsecurity;dependencycomponentsecurity

Auditandcompliance

Providingaudittools(ActionTrail,SLS);platformcompliance

certifications(suchasISOandSOC)

Enablingandconfiguringauditlogs;loganalysisandretention;businesscomplianceassessmentand

certification

Itshouldbenotedthatthetableabovepresentsasimplified

responsibilityframework.Theactualresponsibilityboundariesvarybyservicetypeandconfiguration.Forexample,inIaaS(suchasECS),customerscontroltheGuestOSandapplicationlayer.InPaaS(suchasApsaraDBRDS),AlibabaCloudhandlessecurityandpatching;

customershandledatabaseaccountpermissionsandbusinessdatasecurity.Inmanagedservices(suchasFunctionCompute),AlibabaCloudassumesmoreruntimeresponsibility;customersfocuson

functioncodeanddata.

X-TWITTER

6

AlibabaCloud

|

AlibabaCloudUserDataProtectionWhitePaper

Overall,underthe"CloudSecurityCommunity"philosophy,AlibabaCloudiscommittedtoprovidingthemostcomprehensivesecurityinfrastructureandtoolspossible,whileguidingcustomerstouse

thesetoolscorrectlythroughsecuritywhitepapers,documentation,andbestpractices,ultimatelyachievingahighlysecurecloud

environmentbuiltcollaborativelybytheplatformandcustomers.

2.2EIGHTPILLARSOFCLOUDSECURITY

TheAlibabaCloudSecurityWhitePaper(2024Edition)proposes

the"EightPillarsofCloudSecurity"asthecoresecuritygovernanceframework,aimingtohelpcustomersachievehighersecurityatalowercost:

No.PillarNameCoreDescription

1

Full-lifecycleproductsecurity

SecuritycontrolsembeddedintheR&Dprocess(securitybydesign)

2

Red-blueteamadversarialtesting

APT-levelpenetrationtesting,improvehardendefensethroughoffense

3

Datasovereigntyprotection

Stricttenantisolationtoensurecustomerdatasovereignty

4

Identityandaccessmanagement

Fine-grainedpermissioncontrolcoveringhumanandprogramidentities

5

Elasticandscalablesecurity

Securityprotectioncapabilitiesscaleelasticallywithbusiness

6

Rapidthreatresponse

Integratedsecurityoperations

forrapiddetection,response,andrecovery

7

Attack-resistanthighavailability

Multi-dimensionalisolation

mechanismsforbusinesscontinuity

8

Globalcompliancesupport

140+securitycompliancecertifications

2.3ZERO-TRUSTSECURITYMODEL

ThecoreofAlibabaCloud'szero-trustsystemisbuiltonthree

foundations:end-to-endtrustedidentitypropagation,multi-layereddefense-in-depth,andcontinuousmonitoring.Incloud-native

zero-trustimplementation,itfollowssixprinciples:end-to-end

authentication,transaction-levelre-authentication,least-privilegeaccess,AI-basedcontinuousmonitoring,location-agnosticunified

securitypolicies,andidentityandaccessmanagementasthecore.

Atthemicroserviceslevel,AlibabaCloudimplementszero-trust

securityincloud-nativemicroserviceenvironmentsthroughAlibabaCloudServiceMesh(ASM),afullymanagedIstio-compatibleservice

X-TWITTER

7

AlibabaCloud

AlibabaCloudUserDataProtectionWhitePaper

|

meshprovidingcentralizedmanagementforKubernetesclustersacrosshybridcloudandmulti-cloudenvironments.

2.4KEYMANAGEMENTSERVICE(KMS)

KMSisAlibabaCloud'sone-stopkeymanagementanddata

encryptionserviceplatform,adoptingenvelopeencryption:KMS

generatesaDataKeyandreturnsitinbothplaintextandciphertextforms.TheplaintextDataKeyisonlyusedinmemoryandisneverwrittentopersistentstorage.TheDataKeyencryptstheactualdata,whileKMSencryptsanddecryptstheDataKeyitself.

KeyTypeCreatorControllerCost

ServiceKey

Automatically

createdbyAlibabaCloudservices

Service-managed

Free

DefaultCMK

User-created

User-controlledviaKMSconsole

Free

Software-

ProtectedKey

User-created

User-controlledviaKMSconsole

Paid

Hardware-

ProtectedKey(HSM)

User-created

User-controlledviaKMSconsole

Paid

BYOKsupport:BothCMKandhardware-protectedkeyssupportimportingcustomkeymaterial.WhenusingBYOK,keymaterialisentirelycontrolledbytheuser.

2.5DATASECURITYCENTER(DSC)

DSCisAlibabaCloud'scloud-nativeplatformfordatasecurity.Itiscomprisedofsixcoremodules:dataclassificationandgrading(automaticdiscoveryofsensitivedatawithbuilt-intemplatessuchasGB/T35273),securitybaselinechecks(basedonGB/T37988-2019with40+checkitems),dataaudit(900+built-inauditrules),securityposture(behavioralandtrafficanomalydetection),datagovernance(~200maskingalgorithms,column-levelencryption,digitalwatermarking),andcompliancereporting(16reporttypes).

2.6ACTIONTRAIL

ActionTrailisAlibabaCloud'sauditserviceusedtomonitorand

recordalloperationsperformedonAlibabaCloudaccountresources,supportingsecurityanalysis,resourcechangetracking,and

complianceauditing.Operationsaretrackedandrecordedwithin10minutes,retainedfor90daysbydefault,anddeliverabletoSLSforreal-timeanalysisorOSSforlong-termarchiving.ActionTrailInsights

X-TWITTER

8

AlibabaCloud|AlibabaCloudUserDataProtectionWhitePaper

analyzesdeviationsofcriticaloperationsfromhistoricalpatterns,detectingabnormalAPIcalls,errorpatterns,andanomalousIPrequests.

KMS:KeyManagementServiceCloudProducts/Applications

UserKeyMaterialBYOK

(AES-256-GCM/SM4-CBC

ImporkeyMateriadAPI

ApDication/SDKGeneratelatakeyAPI

CiphertextEDK

O⁵S/NAS/EBSRDS/PolarDB

ManCompute/Fnk

KeyRotation/AliasMgmt/VersionControl

ActionTralAcionAudit—-LosalkeyoperationsCreatekey/GenerateDotakey/Enoypt/Decrypt/lmportkeyMaterial

Figure2-1KMSenvelopeencryptionandkeyhierarchyarchitecture

9

AlibabaCloud

AlibabaCloudUserDataProtectionWhitePaper

|

3.DATASECURITY

CAPABILITIESOF

STORAGEPRODUCTS

AlibabaCloud'sstorageproductlinecoverssevenmajorproducts:

ObjectStorageService(OSS),FileStorageNAS,ElasticBlockStorage(EBS),Tablestore,CloudParallelFileStorage(CPFS),CloudBackup

(HBR),andCloudStorageGateway(CSG).Allstorageproducts

integratewithKMS,supportingserver-sideencryptionandcoveringend-to-endsecurityfromencryptionatresttoencryptionintransit.

3.1OBJECTSTORAGESERVICE(OSS)

OSSsupportstwoserver-sideencryptionmethods:SSE-KMS(usingCMKmanagedbyKMS,supportingAES-256andSM4algorithms)

andSSE-OSS(fullymanagedbyOSS,AES-256,SM4).SSE-KMS

adoptstheenvelopeencryptionmechanism,meaningdatadoesnotneedtobesentoverthenetworktotheKMSserverforencryption

anddecryption.Additionally,OSSsupportscomprehensiveclient-sideencryption(CSE),offeringbothKMS-managedmasterkeysanduser-managedkeys.

TheWORM(WriteOnceReadMany)complianceretentionpolicyofOSShasbeenauditedbyCohassetAssociates,meetingcompliancerequirementssuchasSECRule17a-4(f),FINRA4511,andCFTC1.31.ItistheonlycloudserviceinChinatopassthiscertification.OSS

adoptsregion-baseddeployment,covering29regionsglobally,andsupportsCross-RegionReplication(CRR),whichmustbeactivelyconfiguredbytheuser.

3.2FILESTORAGENAS

NASsupportsAES-256envelopeencryption,providingtwooptions:NAS-managedkeys(freeofcharge)anduser-managedCMKs,andsupportsBYOKforimportingcustomkeys.NASachievesnetworkisolationandaccesscontrolthroughVPCandpermissiongroup

X-TWITTER

10

AlibabaCloud

|

AlibabaCloudUserDataProtectionWhitePaper

mechanisms,andsupportsTLSlinkencryptioncoveringNFSand

SMBprotocols.Notethattheencryptionfeaturecanonlybeenabledwhencreatingthefilesystemandcannotbedisabled.

3.3ELASTICBLOCKSTORAGE(EBS)

EBSadoptsatwo-tierkeyarchitecture(DataKey[DK]+KMSKey

[CMK]),usingtheAES-256encryptionalgorithm(withSM4providedinsomescenarios).Itsupportsservicekeysandcustomermasterkeys(BYOK).Account-leveldefaultencryptioncanbeconfiguredtoenforceencryptionforallnewlycreatedclouddisksinthatregion.EBSisdeeplyintegratedwithconfidentialcomputinginstances,

enablingend-to-enddataprotectionwith"encryptionatrest(EBS)+runtimeencryption(TEE)."

3.4TABLESTORE

TablestoresupportsbothKMSkeyencryptionandBYOKencryption,adoptingafour-tieraccesscontrolmechanism(RAMpolicy,Controlpolicy,networkACL,andinstancepolicy).Itsupportszone-redundantstorage(multi-zoneredundancywithRTOandRPOequalto0)andV4signaturealgorithmauthentication.Thedataencryptionfeaturecanonlybeenabledwhencreatingthedatatable.

3.5CLOUDPARALLELFILESTORAGE(CPFS)

CPFSadoptsAES-256envelopeencryption,managingkeysthroughKMS,andsupportsbothmanagedkeysanduser-managedkeys

(BYOK).Encryptionintransitimplementsend-to-endTLStunnelsbasedonStunnel,withaperformanceoverheadofapproximately10%.CPFSforLingjunsupportsdeploymentin13regionsgloballyandissuitableforhigh-performanceAItrainingandinference

scenarios.

3.6CLOUDBACKUP(HBR)

CloudBackupsupportsthebackupandrecoveryofvariousdata

sources,includingVMwarevirtualmachines,databases,andfilesinon-premisesIDCs,aswellasECSinstances,databases,OSS,and

NASonAlibabaCloud.CloudBackupperformsAES-256encryptionatthesource.Theencrypteddataistransmittedtothecloudbackupvaultvia

HTTPSlinks.Buildinguponsource-sideencryption,itadds

thesecurityandconsistencyguaranteesoftheSSL/TLSprotocol

,ensuringnoplaintextexposurethroughouttheprocess.BackupdataisstoredinthebackupvaultencryptedwithAES-256bydefault,

whilealsosupportinguserstouseAlibabaCloudKMSandchoose

X-TWITTER

11

AlibabaCloud

|

AlibabaCloudUs