Good morning, All. This is a question about security. Imagine I have prefect cloud running and its sending tasks to a few agent I have set up on my local subnet. Is there any risks involved with the cloud server being hacked and sending malicious code to my agents? We have a lot of auditors check this kind of thing in our environment and I want to know how to address this with our security team.

In Prefect Cloud, we take security very seriously and we usually discuss topics like security and compliance as part of the sales process. Are you using Prefect Cloud already? To give a more concrete answer to your question: Prefect’s hybrid execution model keeps your code and data private - everything runs on your infrastructure and the agents have an outbound connection to Prefect Cloud. This means that your agents are actively polling Prefect Cloud and even if Cloud would be hacked, there is no communication from Cloud to your agent, since agents and Cloud communicate in this unidirectional way (always from your agent to Cloud, never in the opposite direction). If you need more detailed security and compliance information, you can send an email to sales@prefect.io.

Thanks, Anna. Yes, I have a personal cloud team which I set up on Monday. I'll reach out to them.

I just happened to stumble on this thread, (new to Prefect) and had jsut read a blog that Prefect was in process of getting SOC 2 compliance, wondering if there was progress on this front ?

Afaik we're still in the process of getting it. If you need more details on that, you can write an email to sales@prefect.io and you should get more accurate info this way.

Curious what the prefect cloud team said... because I think it would be possible to pass malicious code to the agent through the parameters, so, I think at least you'd want to sanitize that input. ( even though technically, the cloud isn't communicating TO the agent, effectively it is though, because the agent polls the cloud for stuff to do, and part of the data that's sent back are the parameter values )

Good question. Parameters are JSON serializable payloads and we have mechanisms in place that limit: • the payload size, • what this payload can be. I’m no security expert, but I know that Cloud has several mechanisms in place to prevent such scenarios, the first being Auth and RBAC allowing to restrict who can register flows to the API in the first place. If you have more security-related topics, you can send those to security@prefect.io and this way someone who knows more than me will get back to you to discuss any security concerns.