Cloud provider security · India
For a cloud provider, the breach that matters most is the one that crosses from one customer to another — through a shared service, a platform key or a support tool. This page gives you a tenant-isolation test catalogue to check yourself against, explains what each certificate and empanelment actually proves, and sets out the duties India places on cloud and hosting providers.
Reviewed 24 September 2026 · 10 sources cited
The short answer
Cloud-provider security rests on tenant isolation: no customer, and no compromise of one, should reach another through shared services, platform keys or support tooling. Indian providers also carry duties of their own — CERT-In requires cloud, VPS and data-centre providers to keep validated customer records for five years and logs for 180 days — and government and regulated buyers often require MeitY empanelment, which rests on an STQC audit.
Why cloud providers
A company that runs its own systems can be breached once. A cloud provider can be breached once and have every customer exposed. In 2021 researchers at Wiz found that a notebook feature switched on by default in Azure Cosmos DB exposed customers’ primary database keys — long-lived keys with full read, write and delete access — across thousands of customers. Nothing those customers did caused it.
The provider’s own keys are the crown jewels. The US Cyber Safety Review Board found in April 2024 that the Storm-0558 intrusion into Microsoft’s cloud email was preventable and the result of “a cascade of security failures”: a consumer signing key issued in 2016 was still active, manual rotation had stopped in 2021 and nothing alerted on the key’s age, and a previously unknown flaw let tokens forged with it open enterprise mailboxes — at 25 organisations, including US government officials.
Customers’ own failings still land on the provider’s doorstep. In 2024 attackers used credentials stolen by infostealer malware to log in to about 165 organisations’ Snowflake accounts that lacked multi-factor authentication; Mandiant traced some credentials back to 2020. The platform itself was not breached, but Snowflake still announced plans to require stronger controls such as multi-factor authentication. And when a hosted service itself falls, it may not come back: after ransomware struck its Hosted Exchange environment in December 2022, Rackspace retired the service.
India adds duties of its own. Under CERT-In’s April 2022 Directions, data centres, VPS providers, cloud service providers and VPN providers must keep validated records of every customer — names, addresses, contact numbers, IPs allotted, purpose and ownership — for five years, keep logs for 180 days in India, and report incidents within six hours. Government, PSU and many financial-sector buyers look for MeitY empanelment, which follows an STQC audit, and from May 2027 you are the Data Processor for your customers’ personal data under the DPDP Act.
Tenant-isolation test catalogue
Fourteen questions, each one a test we would run or a control we would ask to see. Tick only what you could prove today. Nothing you tick leaves this page.
Certificates and empanelment
Customers ask for different ones for different reasons. None of them, on its own, proves that one tenant cannot reach another.
| Attestation | What it covers | What it does not prove | Who tends to ask |
|---|---|---|---|
| ISO/IEC 27001 | A certified information security management system: risk assessment, controls and continual improvement, within a stated scope | That any particular control works, or that the scope covers the service a customer uses | Almost every enterprise buyer, in India and abroad |
| ISO/IEC 27017 | Guidance on security controls specific to cloud services, for providers and customers | Tenant isolation by itself; it is assessed alongside an ISO 27001 system | Buyers who want cloud-specific assurance |
| ISO/IEC 27018 | Protection of personal data by public-cloud providers acting as processors | Compliance with a specific law such as the DPDP Act or GDPR | Buyers who hand you personal data |
| SOC 2 Type II | An auditor’s report on how controls were designed and operated over a period, against the trust services criteria | Anything outside the report’s scope and period | US and global technology buyers |
| CSA STAR | Level 1: a published self-assessment against CSA’s Cloud Controls Matrix. Level 2: certification or third-party attestation | At Level 1, anything independently checked | Buyers comparing cloud providers’ control coverage |
| MeitY empanelment | Cloud service offerings that meet MeitY’s requirements and pass an STQC audit, for public-sector procurement | That services outside the empanelled offering meet the same bar | Government, PSUs, nationalised banks, and SEBI-regulated entities under SEBI’s cloud framework |
SemperWise is not an ISO certification body, a SOC 2 auditor, a CSA STAR auditor or STQC, and is not CERT-In empanelled. We test the controls these attestations describe — tenant isolation above all — prepare you for the audits, verify fixes and keep the evidence. We say so up front.
How isolation fails
Each from a public case, with what we would test.
What we test: Every feature that runs customer code or touches platform credentials, tested from inside a tenant.
What we test: Key scoping, rotation and alerting, and whether a token for one tenant or product is accepted by another.
What we test: Which protections your customers can enforce, which are on by default, and whether you would notice a login from an unusual place.
What we test: Patch timelines for the software you host for others, and a recovery plan per service, rehearsed.
Evidence
From the public cases above, Verizon’s third-party data and CERT-In’s Directions. Each is linked in the sources.
Verizon’s figures are global; the 23% refers to third-party organisations in its dataset that fully remediated missing or improper MFA on cloud accounts.
Due diligence
Have the answers — and the evidence — ready before the review starts.
Government buyers and SEBI-regulated entities under SEBI’s cloud framework need both, for the specific offering and location they use.
CERT-In requires logs in India; many sector rules and contracts go further for data and backups.
A diagram is a claim; a recent test of the boundary is evidence.
Support access is the route across every tenant boundary.
Indian financial regulators’ outsourcing rules expect audit and inspection rights over service providers and their sub-contractors.
Under the DPDP Rules, your customer as Data Fiduciary must bind you by contract and ensure logs are retained.
Your customers have their own six-hour CERT-In clock, and from 2027 a DPDP one; they need you to be faster.
Next step
A 30-minute call with a practitioner who tests multi-tenant platforms. No charge, and no obligation.
Where SemperWise fits
Services are people doing the work; SemperWise One is the platform that keeps the evidence current between engagements. Shared hypervisors and control planes are tested only with your written authorisation, from tenants you own.
“Can one tenant reach another?”
Cross-tenant testing from test accounts you own — object-level authorisation, token scoping, customer-code features and shared services.
API security testing“Our platform and management network.”
Cloud and infrastructure review of identity, keys, isolation and the management plane, against how your platform is actually built.
Cloud security assessment“Our consoles and customer portals.”
Authenticated testing of the console, billing and support portals customers use to manage their tenants.
Web application testing“Could someone get to the control plane?”
A red-team exercise with agreed objectives — reaching platform keys or another test tenant — to test detection as well as prevention.
Red team assessment“What is exposed across our ranges?”
Continuous discovery of internet-facing management interfaces and services across your address space.
Attack surface management“Evidence for ISO, SOC 2 and customers.”
In SemperWise One, controls mapped across ISO 27001 and SOC 2, with dated evidence, test results and a public trust page for customers.
Unified control model“Customer questionnaires, every week.”
An answer library tied to evidence that expires, so answers stay true between audits.
Questionnaire automationQuestions
What buyers in this sector ask us before they commit to anything.
Under its April 2022 Directions, data centres, VPS providers, cloud service providers and VPN providers must register and keep, for five years, validated customer names, the period of hire, IPs allotted, the email, IP and timestamp used at registration, the purpose of hiring, validated addresses and contact numbers, and the ownership pattern of the customer. Like every organisation, they must also keep logs for 180 days in India and report listed incidents within six hours.
MeitY empanels specific cloud service offerings that meet its requirements, followed by an audit by STQC. Empanelment is an important criterion for procurement by government agencies, PSUs, nationalised banks and financial institutions, and SEBI’s cloud framework requires regulated entities to use MeitY-empanelled providers. It applies to the empanelled offerings and locations, not automatically to everything a provider sells.
ISO/IEC 27017 gives guidance on security controls specific to cloud services, for both providers and customers. ISO/IEC 27018 covers protecting personal data in public clouds acting as data processors. Both are normally assessed alongside an ISO/IEC 27001 management system, and neither by itself proves compliance with a specific law such as the DPDP Act. See our ISO 27001 page.
At Level 1, a provider publishes a self-assessment against the Cloud Security Alliance’s Cloud Controls Matrix, usually through its questionnaire. At Level 2, the provider earns a certification or third-party attestation. Level 1 is useful for transparency; Level 2 is what carries independent assurance. Buyers comparing providers often start with the Level 1 questionnaire and ask for Level 2, ISO 27001 or SOC 2 evidence once the shortlist is made.
From test tenants you own, with written authorisation that states what is in scope. We try to reach one test tenant’s data from another through APIs, tokens, customer-code features and shared services, and review the management plane and key handling. We do not touch real customers’ tenants, and shared hypervisors or control planes are only tested actively where you have authorised it in writing.
For your customers’ personal data, yes — from about 13 May 2027, your customers are Data Fiduciaries and you process data on their behalf under contract. The DPDP Rules expect them to bind you to reasonable security safeguards and to ensure logs are retained for at least a year. Expect those terms in your contracts, and be ready to evidence them.
They should be able to, within a published policy that says what is allowed, what is not — typically anything aimed at the shared platform or other tenants — and how to report what they find. A clear policy brings researchers and customers to you with findings instead of to the press.
No. SemperWise is not CERT-In empanelled, not STQC, and not an ISO certification body, SOC 2 auditor or CSA STAR auditor. We test the controls those audits look at — tenant isolation above all — prepare you for them, verify fixes and keep the evidence. The formal audits go to the accredited party you appoint directly.
Checked by our research desk on 24 September 2026. Regulations and figures move; where a number here matters to a decision, follow it to the source.
Next step
A 30-minute call, no charge. You leave knowing which isolation boundaries to test first, how to do it without touching other tenants or the shared control plane, and which evidence your enterprise and regulated customers will ask for — with a written scope and fixed price if testing makes sense.
