Make data protection part of everyday operations
Static data, transmission links and encryption keys need to be managed together. We plan encryption, access control and backup arrangements based on specific products and deployment scenarios, and clarify responsibility boundaries, configuration requirements and recovery mechanisms upon delivery. The specific encryption capabilities are subject to the technical documentation of the corresponding service.
Data at rest
Data-at-rest protection can use technologies such as AES-256, combining key management, access control and backup arrangements within the actual deployment scope.
Data in transit
Transport protection uses protocols such as TLS and IPsec as configured by service. The current specification of TLS 1.3 refers to RFC 9846; the protocol version, algorithm suite and certificate configuration are subject to the actual endpoint and technical documents.
Encryption keys
Keys and other secrets must be managed according to permissions, restricted access, and arranged for storage, rotation and recovery in accordance with service agreements. Customer-managed and service-managed keys should have clear control and responsibilities respectively.
Data request processing principles
When governments or other agencies make data requests, we review the identity of the requesting party, legal basis, jurisdiction, and scope of the request. To the extent permitted by applicable law, priority is given to requiring requesting parties to request information directly from customers and to limit disclosure to what is lawful and necessary. Request clarification or raise legal objections to requests that are insufficiently based, unclear in scope, or overly broad.
Our commitments:
- 1. Do not provide general backdoors or master keys for the purpose of circumventing normal authentication and access control. Government or law enforcement requests are subject to review on a case-by-case basis through applicable legal procedures.
- 2. Continuously improve information disclosure, access control and response processes, and promote transparent and traceable data processing.
- 3. Review identity, authority, legal basis and necessity for data requests; do not provide unrestricted access to customer data. When permitted by law and reasonably practicable, direct requests to customers and handle disputes in accordance with the contract and applicable procedures.
When we receive a law enforcement request:After receiving a valid request involving customer data, promptly notify the customer to the extent permitted by law and reasonably feasible, explaining the nature of the request and the content that can be disclosed. No relevant disclosure will be made without instructions from the client or valid legal basis; when disclosure is required by law, the scope will be limited to necessary information.
Transparency principlesWe value transparency in handling data requests and disclose appropriate aggregate information where the law permits, while protecting personal privacy, trade secrets and legally confidential investigations.
Clear standards. Lasting trust.
Cloudlung plans security governance, data protection and service responsibilities around the business location, data types and deployment scope. International standards and applicable regulations inform the technical and organisational measures selected for each use case. Product certifications, assessment scope and delivery responsibilities are defined by the relevant certificates, technical documentation and service contract.
Security standards and assessment frameworksThis section outlines major standards and assessment frameworks for cloud services, privacy and cryptographic applications. Projects select requirements according to their use case, system boundary and deployment region. Certification and authorisation scopes are defined by the corresponding certificates, official records and technical documentation.
Select standards for the actual use caseManagement systems, cloud security, personal data protection, cryptographic modules and sector-specific authorisations address different technical and organisational boundaries. Planning begins with the use case to define assessment objectives, implementation scope and delivery requirements.
Product and service standard reference
FIPS 140-3 · Cryptographic module validation
FIPS 140-3 is the current standard for the Cryptographic Module Validation Program (CMVP), jointly operated by NIST and the Canadian Centre for Cyber Security. It defines four security levels, with Level 4 the highest in this scheme. Validation covers a specific module, version and operating environment. FIPS 140-2 validations moved to the Historical List on 22 September 2026; existing-system use is governed by applicable policy.ITAR · Defence trade controls
The International Traffic in Arms Regulations (ITAR), in Title 22, Parts 120–130 of the US Code of Federal Regulations, are administered by the US Department of State’s Directorate of Defense Trade Controls. They regulate specified defence articles, technical data and services. ITAR is not a general cloud security certification, and using a particular technology does not establish compliance with every requirement.FedRAMP · Cloud Service Assessment and Authorization
FedRAMP provides a framework for assessing, authorising and continuously monitoring cloud services used by US federal agencies. Status applies to a particular service and authorisation boundary and must be checked against current official Marketplace records and supporting material.FIPS 199 addresses the security categorisation of information and information systems; NIST SP 800-53 provides a catalogue of security and privacy controls. FedRAMP status applies to a particular cloud service and authorisation boundary, with scope determined by the corresponding service record.
DoD · Mission-specific cloud security requirements
US Department of Defense cloud requirements distinguish impact levels according to data sensitivity and mission needs. Levels such as IL2 and IL5 apply to particular missions and data scenarios. Relevant projects assess the service boundary, applicable authorisation and mission owner requirements.GB/T 39786-2021 · Information system password application
This current national standard sets cryptographic application requirements by information system security level, covering physical and environmental security, networks and communications, devices and computing, applications and data, alongside management requirements. It informs system design, implementation and cryptographic application assessment.Commercial cryptographic products and network protocols
For the current version related to network and gateway, refer to: GM/T 0022-2023 "IPSec VPN Technical Specifications". The following technical fields and verified alternative versions are listed below. The applicable requirements are subject to the announcement of the State Cryptozoology Administration, specific products and evaluation scope:
GM/T 0023-2023 · IPSec VPN Gateway Product SpecificationsGM/T 0024-2023 · SSL VPN technical specifications
GM/T 0025-2023 · SSL VPN Gateway Product Specifications
GM/T 0026-2023 · Security Authentication Gateway Product Specifications
Smart password key: evaluated according to applicable product specifications and GM/T 0016-2023 password application interface requirements.
GM/T 0028-2024 · Security requirements for cryptographic modules
Signature verification server: Verify applicable specifications and testing materials according to specific product boundaries.
Server cryptographic machine: Verify product model, valid certification and actual operating environment.
Electronic signature: Distinguish between cryptographic technology, application interface and legal effect. The interface refers to GM/T 0131-2023.
Authorization and access control: Design and verify by identity, role, least privilege and auditing requirements.
GM/T 0033-2023 · Timestamp interface specification
Certificate authentication system: Verified according to applicable SM2 algorithm, digital certificate format and protocol requirements.
Radio frequency identification system: Select applicable password requirements based on tags, reading and writing devices and application environments.
Contactless Card Access: Combining Media, Key Management and System Integration Scope Assessment.
Certificate certification system testing: Verify applicable testing specifications and test reports.
Certificate authentication key management: Verify key life cycle management and detection scope.
Password detection and interoperability
The following editions were updated under State Cryptography Administration Announcement No. 50 and took effect on 1 July 2025, supporting security testing and interoperability assessment for the relevant products:
GM/T 0039-2024·Security testing requirements for cryptographic modulesGM/T 0040-2024 · RFID tag module password detection specification
GM/T 0041-2024 · Smart IC card password detection specifications
Ternary peer-to-peer password security protocol: Check the applicable test specifications and reporting scope according to the specific protocol.
GM/T 0043-2024 · Digital Certificate Interoperability Detection Specification
Current standards references
Standards editions updated on 18 October 2026.
Information security management, cloud security and privacy protection each have a distinct focus. Relevant organisational and technical controls connect standards with practical use cases.
ISO/IEC 27001:2022, including Amd 1:2024 · Information security management
A framework for managing information security through risk assessment, clear responsibilities and continual improvement.
Official reference ↗ISO/IEC 27017:2026 · Cloud security controls
Cloud-specific controls and guidance for the security responsibilities of customers and providers.
Official reference ↗ISO/IEC 27018:2025 · Personal data protection in public clouds
Privacy protection guidance for public cloud services acting as personal data processors.
Official reference ↗ISO/IEC 27701:2025 · Privacy information management
A privacy information management system addressing governance, accountability and continual improvement.
Official reference ↗TLS 1.3 · RFC 9846
TLS 1.3 provides protocol-level protection for data in transit. Actual security also depends on certificate configuration, cipher suites and endpoint deployment.
Official reference ↗FIPS 203 / 204 / 205 · Post-quantum cryptography standards
ML-KEM, ML-DSA and SLH-DSA address key encapsulation and digital signatures, providing a standards basis for long-term cryptographic migration and technology selection.
Official reference ↗GB/T 22239-2019 · Baseline for classified cybersecurity protection
Classified cybersecurity protection is organised around individual information systems, combining classification, filing, remediation and assessment with safeguards appropriate to the system’s level.
Official reference ↗Uptime Tier IV · Data centre fault tolerance reference
Tier IV is the highest of Uptime’s four tiers and emphasises fault tolerance. Design documents, constructed facilities and operational certifications each have a defined scope; an individual facility’s tier is determined by its corresponding certificate.
Official reference ↗