Home › Rahti Service Description › Technical and Organizational Measures in the Rahti Service

Technical and Organizational Measures in the Rahti Service

Last updated: 20.10.2025

1 Purpose

The technical and organizational measures (TOMs) describe the agreement between the data controller and the data processor on how to process personal data as stated in article 28 of the General Data Protection Regulation (EU) 2016/679. The Data Protection Act (1050/2019) stipulates the obligations on how to protect special categories of personal data. On behalf of the partner organization, CSC – IT Center for Science Ltd. (“CSC“) processes personal data, where the partner organization acts as a data controller, to produce the services agreed in the service contract. The measures taken to protect this data by CSC when producing the Rahti service.

The data processor can unilaterally change the protective measures without notification when the changes retain or improve the general level of protection. Single protective actions can be replaced as long as it doesn’t affect the level of protection regarding personal data. CSC can make changes to this document when the protective measures are changed. Pertinent changes are reported to the data controller.

2 Protective Measures in the Rahti service

CSC – IT Center for Science Ltd. is committed to ensuring the protection of personal data processed within the Puhti supercomputer service. These TOMs are part of the contractual obligations between the controller and CSC, in compliance with the GDPR (EU) 2016/679 and Finnish Data Protection Act (1050/2018).

General Principles

  • Segregation of Duties:
    Administrative responsibilities are divided among network, data center, and system administrators to minimize risk.
  • User Terms of Use:
    Users must agree to CSC’s Terms of Use before accessing the service environment.
  • Shared Secret Management:
    Administration-level credentials are stored encrypted in password management software. Machine-to-machine tokens are stored as plain text on the needed servers. The tokens grant least required privilege of access though.
  • Layered Security Architecture:
    The API server has been designed to carefully work with authentication and authorization system. Users and administrators have segregated authority over the resources. When required, an endpoint may have extra firewall configuration to be accessible through CSC Network for the administrators.
  • Contractual Basis:
    All data processing operations are based on written agreements with the data controller.
  • Role-based Access Control:
    Access rights are allocated according to roles and follow the principle of least privilege. CSC maintains its staff’s access rights, ensuring they are limited to tasks that require access.
  • Access Management:
    Data controller retains control over its own staff’s access rights. All administrators who have access to Rahti’s core configuration have gone through background checks.
  • Training and Awareness:
    CSC personnel receive continuous data protection and security training. Training records are maintained internally.
  • Confidentiality Obligations:
    All personnel handling personal data are bound by confidentiality agreements and comply with applicable data protection laws (such as the Finnish Act 1050/2018).
  • Data Protection Officer:
    CSC has appointed a dedicated Data Protection Officer (DPO) to oversee data protection compliance.
  • Data Storage Location:
    All data is stored within the EU (Finland).

Measures to Ensure Confidentiality

  • Network Protection: 
    The web user interface only allows secure access via HTTPS. The API server communication only allows HTTPS traffic. Access towards the users’ deployment does not exist by default, and users may specifically enable their applications to accept relevant incoming traffic.
  • Data Encryption:
    All data transfers between users and systems (including web interfaces and terminal access) are encrypted. The login to the system is provided by HAKA and CSC Login and hence the passwords for user authentication to Rahti are stored encrypted in an external identity provider system outside of Rahti.
  • Multi-tenancy and Isolation:
    The platform supports multi-tenancy which means that the users’ workloads are created in an isolated environments called namespaces. Only the members of the namespaces can create, modify, and delete the resources. The running workloads and resources of a namespace is not visible in another namespace unless users specifically allow it.
  • Access Control:
    The users within the same CSC project can access the namespaces that they are a member of. Only the CSC project owner can add or remove members. Within a namespace in Rahti, a user may define or modify role-based access control mechanism for real users as well as service accounts to set a granular control over the resources.
  • Data Ownership:
    The containers, configmaps, secrets, and persistent volumes may contain the data for the users. The data will be visible only to the users and resources within the namespace. Administrators are able to access it on the underlying storage systems on user request. If the user wants to ensure administrators have no access to their data, they should implement encryption on their own. CSC does not return broken disks to the vendors. All disks that have had customer data go through a secure destruction process.
  • User-Generated Logs:
    The users’ workload may generate logs that will be stored on temporarily basis. The temporary logs will be cleaned automatically unless the users persist them. The users’ workload generates metrics such as CPU, Memory, and Network traffic. These metrics will be stored inside the platform for accountability and calculation of the billing units.

Measure to Ensure Integrity

  • Change deployments:
    All the changes are verified in test platforms, and deployed using automation tools to the production platform. Formal change management processes are followed when making changes in which the change impacts the availability of the platform and affect the everyday use for the users. All production changes are reviewed before they are deployed.
  • Vulnerability Management:
    The Services are being regularly scanned for vulnerabilities and other weaknesses. This means that CSC internal security team will scan the Services regularly in order to verify no unspecified network services or ports are available, and that no known vulnerabilities exist on the Services. Security patches are being applied regularly. This means that the software is kept up to date with regular updates on all systems needed for the Services. Critical security patches are applied as soon as possible. The administrator team checks the reliable source of news for recent vulnerabilities that may exist in the platform. The core components of the platform is being managed by the administrator team and patches are applied as soon as possible. The users are responsible for their contents and security of their applications. The administrator team may inform the users if an identified critical vulnerability is found for the applications that is commonly deployed by the users.

Measures to Ensure Availability and Resilience

  • Automatic Monitoring:
    CSC uses automated monitoring systems to detect and report service disruptions or anomalies to administrators. Rahti platform utilizes its own monitoring system as well as CSC-provided one configured by the administrators team.
  • Disaster Recovery & Backup:
    System configurations and data are version-controlled and replicated to ensure quick recovery in case of failure. The core data of the platform is also backed up on daily basis.
  • User Data Backup Policy:
    No backups are taken of user data stored in the persistent volumes and inside the containers. Users are responsible for maintaining their own backups of critical data stored in these locations.
  • Redundancy:
    Most of the core components of the service – including API, Ingress, Monitoring –  are redundant to ensure that a single component failure does not affect service availability. This also ensures that the majority of maintenance operations do not impact the users. Rahti relies heavily on cPouta infrastructure and cPouta covers Power, Network, and Storage redundancy in place.
  • User Account Synchronization:
    User accounts are automatically synchronized every 10 minutes with CSC’s central user management system to maintain operational resilience.

Measures for Testing, Evaluation, and Assessment

  • Audits & Compliance:
    The Rahti’s underlying infrastructure are located in data centres that have been granted ISO 27001 certificate for their information security management systems. CSC conducts regular internal and external audits, including ISO 27001 audits, to evaluate the effectiveness of security measures.
  • Incident Management:
    Security incidents are managed according to defined operational processes, including analysis, response, and post-incident reviews.