Shared responsibility

Prelaunch operating model. The hosted responsibilities below are acceptance targets, not a statement that TOVIO Cloud is generally available or that production operations evidence has passed.

Boundary	TOVIO responsibility	Customer responsibility
Protected objects	Preserve authenticated ciphertext, wrapped keys, policy metadata, integrity checks, and authorized delivery.	Define correct policies, enroll recipients and perform grants from a client that already holds the key, protect recipient and recovery keys, and revoke or rotate access promptly.
Identity	Verify configured issuers, enrolled-device proofs, session lifetime, replay resistance, and authorization.	Secure the identity provider, approve claim mappings, manage administrators, and offboard users.
Agents and CI	Enforce token scope, operation, lifetime, delegation, clearance, and provenance.	Choose tools and models, minimize disclosed content, secure runners, and review delegated authority.
Hosted infrastructure	Operate tenant isolation, durability, backups, metering, monitoring, incident response, and contracted availability.	Configure integrations, test recovery, maintain local copies, and select dedicated or BYO execution where required.

Cryptographic read control protects policy-encrypted content in stored and transported TOVIO objects. It does not make plaintext invisible after an entitled client, runner, user, or model intentionally receives it.