Cloud security basics

Cloud security in Pega Platform™ is based on established security models and leading practices that help protect applications, data, and users across distributed, cloud-native environments. These principles guide how security controls are designed, implemented, and enforced in Pega Cloud, and help architects make consistent, risk-aware security decisions.

Two foundational security concepts underpin Pega Cloud security:

• The confidentiality, integrity, and availability (CIA) triad
• The Zero Trust security model

Together, these concepts help you build security into both the platform and the applications deployed on it, rather than treated as an afterthought.

Confidentiality, integrity, and availability (CIA)

All Pega Cloud security controls align with the CIA triad, a widely adopted security framework that defines the core objectives of information security:

• Confidentiality: Prevent unauthorized access to data
• Integrity: Prevent unauthorized modification of data
• Availability: Ensure systems remain accessible to authorized users

Pega Platform has built-in features for authentication, authorization, encryption, and auditing to help achieve these objectives across applications and environments.

Zero Trust security model

Pega Cloud is designed in alignment with Zero Trust security principles, which remove implicit trust from the network and require continuous evaluation of access based on identity, context, and policy.

In a Zero Trust security model, every access decision is evaluated dynamically, based on the following principles:

• No user, system, or network is trusted by default.
• Every access request is authenticated and authorized.
• Least privilege access is enforced.
• Security controls are continuously monitored.

As an architect, you must design Pega applications assuming that every access request must be authenticated, authorized, and audited, regardless of where the request originates.

For more information, see Security foundations and Pega Cloud and Zero Trust Architecture.

Protecting data is a core aspect of cloud security and spans the entire lifecycle of data as it moves through, resides within, and is presented by applications. In Pega Cloud, data security is addressed through a layered approach that applies controls at multiple stages to help ensure confidentiality, integrity, and appropriate access.

From an architectural perspective, Pega Cloud considers data security across three primary states: data in transit, data at rest, and data at display. Each state introduces different risks and therefore requires distinct but complementary security controls at the platform and application levels.

Data in transit

Data in transit refers to data as it moves between users, applications, and integrated systems. Pega Cloud protects data in transit by using the following platform-level security controls:

• Pega Cloud uses TLS-based protection for supported browser and service-to-service connections. Application teams must also configure secure protocols and authentication for integrations.
• Integrations use Authentication Profiles and secure protocols such as OAuth.
• Pega Cloud manages certificate lifecycles. Avoid certificate pinning in applications, and rely on trusted certificate authorities instead.

Data at rest

Data at rest refers to data stored within databases and persistent storage. In Pega Cloud, data at rest is protected using the following platform-level security controls:

• Pega Cloud encrypts all data at rest using AES 256 encryption.
• Pega Platform supports encryption of specific properties and BLOB data.
• Clients can apply additional application-level encryption based on data classification needs.

Data at display

Data at display refers to how data is presented to users within applications. In Pega Cloud, data at display is protected using the following application-level and platform-enforced security controls:

• Access to data is controlled using role-based access control (RBAC) and attribute-based access control (ABAC).
• Display logic must never replace authorization rules.
• Mask or restrict sensitive data based on user privileges and context.

The Pega Security Checklist is a platform-provided framework that defines mandatory and recommended security tasks required to securely design, develop, and deploy Pega applications.

For applications deployed on Pega Cloud, the Security Checklist includes additional cloud-specific security considerations beyond standard on-premises requirements.

Key focus areas include:

• Encryption of application data, including BLOB and sensitive properties
• Secure authentication for users, connectors, and services
• Protection of APIs exposed by the Pega application
• Validation of Access Groups, Access Roles, and privileges using least privilege principles
• Manage certificates
  • Avoid certificate pinning because Pega Cloud certificates are managed dynamically.
  • Adopt Certificate Transparency (CT) practices where appropriate.
  • Configure connected systems to trust the required Amazon Trust Services certificate authorities that Pega Cloud uses.
• Secure file uploads. If the application accepts file uploads, apply the following controls: 
  • Scan uploaded files for malware.
  • Keep the malware definitions current.
  • Restrict the permitted file types.
  • Validate attachments before storing them.
  • Configure the XML/AllowDocTypes setting securely.

The Security Checklist is integrated into Pega Platform and tracks completion of security tasks throughout the application lifecycle. When Deployment Manager is used, incomplete checklist items can block production deployment, reinforcing security accountability.

Use the Security Checklist throughout development to help cloud-deployed Pega applications meet platform security standards and enterprise security requirements.

For more information, see the Security Checklist.

The following table summarizes how Pega Cloud and Client or application teams contribute to securing the cloud environment and the applications deployed within it.

Check your knowledge with the following interaction: