> ## Documentation Index > Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt > Use this file to discover all available pages before exploring further. # Introduction to CoreWeave Security > Introduction to CoreWeave's security approach across data protection, network isolation, and access management CoreWeave uses product-specific controls to protect data, isolate network traffic, and manage identity for large-scale AI workloads. On supported Nodes, Data Processing Units (DPUs) provide a hardware-separated execution environment for infrastructure services. The following sections describe how CoreWeave implements security across data protection, network isolation, and access management. ## Core security pillars CoreWeave's approach centers on three integrated pillars: * Data security * Network security and isolation * Identity and access management (IAM) ### Data security Data security protects sensitive assets, including proprietary models, regulated data, and confidential business logic. Encryption capabilities and customer responsibilities differ by storage product. CoreWeave AI Object Storage encrypts data at rest and lets customers [manage their own encryption keys](/products/storage/object-storage/buckets/server-side-encryption/about-sse-c). On supported Nodes, CoreWeave uses NVIDIA BlueField DPUs to separate infrastructure processing from the host system. Software on the DPU can offload operations such as firewalling and encryption. ### Network security and isolation CoreWeave combines hardware and software controls to enforce security and workload separation. CoreWeave's GPU-accelerated cloud supports multiple tenants with resource-intensive workloads. In this environment, network segmentation and virtual private cloud (VPC) architectures provide tenant isolation. Data Processing Units (DPUs) on [supported Nodes](/products/networking/nimbus) enhance hardware-level isolation. The DPU runs its own software independently from the host operating system and can offload routing and firewall tasks. CKS clusters that use Cilium provide eBPF-based [network policy enforcement](/products/networking/cilium-network-policy-cks-patterns). You can deploy [Tetragon](/security/tutorials/ebpf-observability) for additional observability. Hubble requires a per-cluster configuration change from CoreWeave Support. The platform uses Ethernet Virtual Private Network (EVPN) overlays with VXLAN encapsulation and Type 5 routes to provide Layer 3 multi-tenancy without relying on hypervisors. This enables each tenant or namespace to operate in a dedicated, isolated network segment (VRF/VNI). ### Identity and access management (IAM) Identity and access management (IAM) governs platform access for users, services, and workloads using principles of least privilege and role-based access control (RBAC). CoreWeave IAM Access Policies manage access to platform resources. CoreWeave AI Object Storage also provides [organization access policies](/products/storage/object-storage/auth-access/organization-policies/about), [workload identity federation](/products/storage/object-storage/auth-access/workload-identity-federation/about), and [audit logging](/products/storage/object-storage/auth-access/audit-logging). CoreWeave AI Object Storage supports [workload identity federation](/products/storage/object-storage/auth-access/workload-identity-federation/about) with OpenID Connect (OIDC) and Security Assertion Markup Language (SAML). Workloads can exchange external identity tokens for temporary Object Storage credentials instead of storing long-lived access keys. For storage access, organization access policies are written in JSON and apply to every request. Bucket policies can further refine access. Object Storage evaluates these policy types in a defined order, with exceptions for specific actions. ## Summary of security features The following table summarizes key security features of the CoreWeave platform. | Component | Description | | ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Data Processing Units (DPUs) | On supported Nodes, NVIDIA BlueField DPUs provide a hardware-separated environment that runs infrastructure software independently from the host operating system. | | EVPN VXLAN | Ethernet Virtual Private Network (EVPN) is used for efficient and scalable Layer 2 and Layer 3 VPN services. VXLAN (Virtual Extensible LAN) is used to encapsulate network traffic and create a virtualized network overlay. | | Type 5 Routes in EVPN | Enable inter-tenant routing and traffic forwarding between isolated network segments. | | Isolated networks for sensitive workloads | Networks are physically and virtually isolated to keep sensitive workloads secure and inaccessible to unauthorized systems. | Together, data security, network isolation, and IAM form the foundation of CoreWeave's security model. For more information, see [CoreWeave Security](https://www.coreweave.com/security).