From b134a6efd515dc8c03845271c39b7b81578e34d9 Mon Sep 17 00:00:00 2001 From: fpagny Date: Mon, 16 Jun 2025 17:46:45 +0200 Subject: [PATCH 01/18] feat(genapi): add shared responsibility model --- .../security-and-reliability.mdx | 134 ++++++++++++++++++ 1 file changed, 134 insertions(+) create mode 100644 pages/generative-apis/reference-content/security-and-reliability.mdx diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx new file mode 100644 index 0000000000..ab47b0d32e --- /dev/null +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -0,0 +1,134 @@ +--- +meta: + title: Security and Reliability in Generative APIs + description: Learn more about shared responsibility in security and reliability practices for Generative APIs +content: + h1: Security and Reliability in Generative APIs + paragraph: Learn more about shared responsibility in security and reliability practices for Generative APIs +tags: generative-apis ai-data shared responsibility security reliability +dates: + validation: 2025-06-16 +--- + +This page outlines key principles and best practices to help you ensure your applications' security and reliability when using Generative APIs. + +## Resilience + +Resilience ensures the continuity and availability of your applications and data, even in the face of disruptions or failures. In Generative APIs, you can promote resilience through the following pillars: availability, durability and performance. + +### Availability and durability + +Generative APIs SLAs are not yet provided, but will target the following SLOs once released: + +| Processing Type | Configuration Details | Availability | +| ------------ | ------------------- | ------ | +| Standard | Standard synchronous HTTP calls to Generative APIs providing the generated content directly in HTTP response. These calls include stream and non-stream requests. | 99.9% | +| Batch | Asynchronous processing of files sent to Generative APIs providing the generated content through files. | 99.9% | + +The detailed SLAs measurements and guarantees can be found on the [Service Level Agreement for Generative APIs](https://www.scaleway.com/en/database/sla/) page. + +As we do not store any data with Standard processing durability requirements do not apply. + +When processing data using Batch processing, your input data is stored only during processing time (24 hours): +- As input data storage is only temporary, no specific durability guarantee apply. +- Output data (processing results) durability depends on the target storage system used (by default: Object Storage Standard Class) + + +## Performance + +Standard processing (synchronous HTTP calls): +- Generative APIs runs models on mutualized infrastructure, and therefore ensures good performance in average utilization. We monitor and respond quickly to any drops in token generation throughput, but cannot guarantee strictly performance, especially during customer peak loads. As a consequence, [Rate Limits](https://www.scaleway.com/en/docs/generative-apis/reference-content/rate-limits/) apply, to ensure "fair use" of synchronous HTTP calls. Bigger requests volumes should be treated through Batch processing (Not yet available). +- Guaranteed performance can be provided using dedicated resources on Managed Inference product. + +Batch processing (asynchronous file processing): +- When using Batch processing, we handle scheduling of batch jobs to optimize both processing ressource allocation and processing time. Processing time is therefore only guaranteed to be lower than 24 hours and [Rate Limits](https://www.scaleway.com/en/docs/generative-apis/reference-content/rate-limits/) (larger than Standard processing) still apply. + +## Monitoring + +Monitoring is an essential pillar to ensure the security and reliability of your services. The practice provides real-time insights into the performance, security, and resource consumption of your Generative API usage. + +### Metrics and logs + +Generative APIs metrics and logs are stored inside [Cockpit](https://www.scaleway.com/en/docs/cockpit/). + +This includes: +- **Metrics**: Input and Output tokens and API requests . Metrics are refreshed every minute (some dashboards may aggregate data by the hour for accuracy reasons, but metrics can be queried at a finer rate using Cockpit Custom Dashboards) +- **Logs**: No logs are currently stored inside Cockpit. + +## Configuration and version management + +Configuration and version management are critical for maintaining reliability and performance across your services. + +### Configuration + +Currently, Generative APIs do not provide specific configuration properties stored within your account. All configuration parameters are the one you send through each API HTTP calls (such as `temperature`, `top_p` or `seed`) and you remain responsible for any change in outputs based on these parameters. + +Since Generative AI models are by definition non-deterministic, we cannot guarantee the same input will provide the same output over time (for example when used two different HTTP calls). If you want deterministic processing, we encourage you to use Managed Inference with a specific model and set all randomness parameters to deterministic level (for example using for instance `temperature`:`0` and a specific `seed` value). + +### Version management + +#### Supported models + +Any changes to supported models and associated guarantees are detailed in our [Model Lifecycle Policy](https://www.scaleway.com/en/docs/generative-apis/reference-content/model-lifecycle/). + +#### API versions + +Two types of API version updates may be performed: + +| Upgrade Type | Description| +| ------------ | ------------------- | +| Minor | These updates do not change the API current fields format and are backward compatible (no action is required on your side). New fields and feature can however be added. | +| Major | These updates change the API current fields or path. They may require action from your side. In this case, we will notify you with at least 3 month notice before deprecating significant feature that might break your application. | + +#### Third party tools compatibility + +By following industry standards (such as targeting OpenAI API compatibility), we aim to provide compatibility with most AI ecosystem and tools by default. However, as ecosystem evolves quickly, we cannot guarantee strictly compatibility with third party tools, but provide extensive documentation: +- Current API supported features are available in our API Documentation +- Advanced errors and edge cases workaround in our [Troubleshooting section](https://www.scaleway.com/en/docs/generative-apis/troubleshooting/fixing-common-issues/). +- Integration with third party tools is available in [Integrating Scaleway Generative APIs with popular AI tools](https://www.scaleway.com/en/docs/generative-apis/reference-content/integrating-generative-apis-with-popular-tools/#openai-client-libraries) + +## Data protection + +Our Data protection measures are detailed in our [Privacy Policy](https://www.scaleway.com/en/docs/generative-apis/reference-content/data-privacy/). + +Overall: +- We do not store sensitive data (such as the content of your prompt), unless we need to, to provide the service (such as temporarily when using Batch processing). +- When data is stored, it is protected using state of the art method (such as encryption at rest). +- During transit, your data is encrypted by relying on HTTPS protocol. + +### Scaleway access + +In order to perform maintenance operations and guarantee the reliability of Generative APIs, or comply with local regulations, we need to access servers hosting Generative APIs service. + +Most of these accesses are automatic actions, in cases where Scaleway needs update configuration or upgrade software versions. + +Manual interventions might be required occasionally, and for troubleshooting reasons (such as specific customer requests generating errors or performing malicious activity), we may access temporarily complete HTTP requests content to identify root cause issue or any security vulnerability. All Scaleway accesses are authenticated and traced following industry security standards. + +## Identity and access management + +Identity and access management allows you to enable granular control over user permissions and to mitigate the risk of unauthorized access or data breaches. + +All accesses to Generative APIs are authenticated and authorized relying on [Scaleway IAM permissions sets](https://www.scaleway.com/en/docs/iam/reference-content/permission-sets/). + +You are responsible for attributing these permissions to the relevant users or applications and reviewing these accesses frequently. + +## Compliance + +Several regulations apply to us directly, whereas other apply to your usage. Even in this case, we help you ease your compliance process by providing you with the information you need from your Cloud Provider. + +### AI Act + +We (Scaleway) ensure our compliance with the AI Act within our scope of responsibilities. We also ensure that you have the information needed to comply with the requirements that apply to you. This means concretely: +- Gathering AI Model Providers information about their model (such as whether its training capacity is above 10²⁵ FLOPs, and falls into a specific category) and provide you with a link to these documents when they are made available by AI Model Providers. +- Providing you with links towards licensing required by the AI Model Providers. + +Scaleway has no access to, nor knowledge of, any inputs and outputs generated by the Models. By using our AI products, you agree and acknowledge that you are (i) responsible for this use including any content integrated into the Models, and (ii) required to use the AI products in compliance with our General Terms of services. + +As a client of our AI products, you are likely to be considered an AI System Provider or Deployer under the AI Act. As such, it is your responsibility to ensure you comply with requirements that apply to you. + +### Additional Local Regulation + +If you require additional information to comply with specific regulation, you can create a [support ticket](https://console.scaleway.com/support/tickets/create) or contact your account manager. + + + From 6bfca366320ca629f7d1543dc691ddab31efb575 Mon Sep 17 00:00:00 2001 From: fpagny Date: Mon, 16 Jun 2025 17:53:05 +0200 Subject: [PATCH 02/18] fix(genapi): typos in shared responsibility model --- .../reference-content/security-and-reliability.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index ab47b0d32e..927121c931 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -18,7 +18,7 @@ Resilience ensures the continuity and availability of your applications and data ### Availability and durability -Generative APIs SLAs are not yet provided, but will target the following SLOs once released: +Generative APIs SLAs target the following SLOs: | Processing Type | Configuration Details | Availability | | ------------ | ------------------- | ------ | @@ -37,7 +37,7 @@ When processing data using Batch processing, your input data is stored only duri ## Performance Standard processing (synchronous HTTP calls): -- Generative APIs runs models on mutualized infrastructure, and therefore ensures good performance in average utilization. We monitor and respond quickly to any drops in token generation throughput, but cannot guarantee strictly performance, especially during customer peak loads. As a consequence, [Rate Limits](https://www.scaleway.com/en/docs/generative-apis/reference-content/rate-limits/) apply, to ensure "fair use" of synchronous HTTP calls. Bigger requests volumes should be treated through Batch processing (Not yet available). +- Generative APIs runs models on mutualized infrastructure, and therefore ensures good performance in average utilization. We monitor and respond quickly to any drops in token generation throughput, but cannot guarantee strictly performance, especially during customer peak loads. As a consequence, [Rate Limits](https://www.scaleway.com/en/docs/generative-apis/reference-content/rate-limits/) apply, to ensure "fair use" of synchronous HTTP calls. Bigger requests volumes should be treated through Batch processing. - Guaranteed performance can be provided using dedicated resources on Managed Inference product. Batch processing (asynchronous file processing): From 1f6c0887d9be004f09d79487675ed31352762230 Mon Sep 17 00:00:00 2001 From: fpagny Date: Fri, 20 Jun 2025 10:59:19 +0200 Subject: [PATCH 03/18] Update pages/generative-apis/reference-content/security-and-reliability.mdx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Néda <87707325+nerda-codes@users.noreply.github.com> --- .../reference-content/security-and-reliability.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index 927121c931..82276af5db 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -30,7 +30,7 @@ The detailed SLAs measurements and guarantees can be found on the [Service Level As we do not store any data with Standard processing durability requirements do not apply. When processing data using Batch processing, your input data is stored only during processing time (24 hours): -- As input data storage is only temporary, no specific durability guarantee apply. +- As input data storage is only temporary, no specific durability guarantee applies. - Output data (processing results) durability depends on the target storage system used (by default: Object Storage Standard Class) From 8f725ae479c71c07a7a9c8810c82cdc4395b29cc Mon Sep 17 00:00:00 2001 From: fpagny Date: Fri, 20 Jun 2025 10:59:34 +0200 Subject: [PATCH 04/18] Update pages/generative-apis/reference-content/security-and-reliability.mdx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Néda <87707325+nerda-codes@users.noreply.github.com> --- .../reference-content/security-and-reliability.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index 82276af5db..f62b71b99f 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -31,7 +31,7 @@ As we do not store any data with Standard processing durability requirements do When processing data using Batch processing, your input data is stored only during processing time (24 hours): - As input data storage is only temporary, no specific durability guarantee applies. -- Output data (processing results) durability depends on the target storage system used (by default: Object Storage Standard Class) +- Output data (processing results) durability depends on the target storage system used. The storage system used by default is the [Object Storage Standard Class](/object-storage/concepts/#storage-class) ## Performance From c840b47177f61d694d387840ec6cec80f262f03c Mon Sep 17 00:00:00 2001 From: fpagny Date: Fri, 20 Jun 2025 11:00:08 +0200 Subject: [PATCH 05/18] Update pages/generative-apis/reference-content/security-and-reliability.mdx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Néda <87707325+nerda-codes@users.noreply.github.com> --- .../reference-content/security-and-reliability.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index f62b71b99f..de56a19198 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -25,7 +25,7 @@ Generative APIs SLAs target the following SLOs: | Standard | Standard synchronous HTTP calls to Generative APIs providing the generated content directly in HTTP response. These calls include stream and non-stream requests. | 99.9% | | Batch | Asynchronous processing of files sent to Generative APIs providing the generated content through files. | 99.9% | -The detailed SLAs measurements and guarantees can be found on the [Service Level Agreement for Generative APIs](https://www.scaleway.com/en/database/sla/) page. +The detailed SLA measurements and guarantees can be found on the [Service Level Agreement for Generative APIs](https://www.scaleway.com/en/database/sla/) page. As we do not store any data with Standard processing durability requirements do not apply. From 7ccf70372ae479adf3aa7107e7e75f5a6b59e29a Mon Sep 17 00:00:00 2001 From: fpagny Date: Fri, 20 Jun 2025 11:00:20 +0200 Subject: [PATCH 06/18] Update pages/generative-apis/reference-content/security-and-reliability.mdx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Néda <87707325+nerda-codes@users.noreply.github.com> --- .../reference-content/security-and-reliability.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index de56a19198..7d53d0eba5 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -27,7 +27,7 @@ Generative APIs SLAs target the following SLOs: The detailed SLA measurements and guarantees can be found on the [Service Level Agreement for Generative APIs](https://www.scaleway.com/en/database/sla/) page. -As we do not store any data with Standard processing durability requirements do not apply. +As we do not store any data with standard processing, durability requirements do not apply. When processing data using Batch processing, your input data is stored only during processing time (24 hours): - As input data storage is only temporary, no specific durability guarantee applies. From 78b906d7baae7ba8d5f7a38fd8a7e709f06daca5 Mon Sep 17 00:00:00 2001 From: fpagny Date: Fri, 20 Jun 2025 11:00:32 +0200 Subject: [PATCH 07/18] Update pages/generative-apis/reference-content/security-and-reliability.mdx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Néda <87707325+nerda-codes@users.noreply.github.com> --- .../reference-content/security-and-reliability.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index 7d53d0eba5..45e729b456 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -29,7 +29,7 @@ The detailed SLA measurements and guarantees can be found on the [Service Level As we do not store any data with standard processing, durability requirements do not apply. -When processing data using Batch processing, your input data is stored only during processing time (24 hours): +When processing data using batch processing, your input data is stored only during processing time (24 hours): - As input data storage is only temporary, no specific durability guarantee applies. - Output data (processing results) durability depends on the target storage system used. The storage system used by default is the [Object Storage Standard Class](/object-storage/concepts/#storage-class) From 50ef4c78635af299d908d3fb5d70b913731352e7 Mon Sep 17 00:00:00 2001 From: fpagny Date: Fri, 20 Jun 2025 11:00:47 +0200 Subject: [PATCH 08/18] Update pages/generative-apis/reference-content/security-and-reliability.mdx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Néda <87707325+nerda-codes@users.noreply.github.com> --- .../reference-content/security-and-reliability.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index 45e729b456..dc2c3a1425 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -41,7 +41,7 @@ Standard processing (synchronous HTTP calls): - Guaranteed performance can be provided using dedicated resources on Managed Inference product. Batch processing (asynchronous file processing): -- When using Batch processing, we handle scheduling of batch jobs to optimize both processing ressource allocation and processing time. Processing time is therefore only guaranteed to be lower than 24 hours and [Rate Limits](https://www.scaleway.com/en/docs/generative-apis/reference-content/rate-limits/) (larger than Standard processing) still apply. +- When using batch processing, we handle scheduling of batch jobs to optimize both processing resource allocation and processing time. Processing time is therefore only guaranteed to be lower than 24 hours and [rate limits](/generative-apis/reference-content/rate-limits/) (larger than Standard processing) still apply. ## Monitoring From 955c915ba275ff5341e49eacbc824db62914c7da Mon Sep 17 00:00:00 2001 From: fpagny Date: Fri, 20 Jun 2025 11:01:21 +0200 Subject: [PATCH 09/18] Update pages/generative-apis/reference-content/security-and-reliability.mdx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Néda <87707325+nerda-codes@users.noreply.github.com> --- .../reference-content/security-and-reliability.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index dc2c3a1425..c566d0286d 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -37,8 +37,8 @@ When processing data using batch processing, your input data is stored only duri ## Performance Standard processing (synchronous HTTP calls): -- Generative APIs runs models on mutualized infrastructure, and therefore ensures good performance in average utilization. We monitor and respond quickly to any drops in token generation throughput, but cannot guarantee strictly performance, especially during customer peak loads. As a consequence, [Rate Limits](https://www.scaleway.com/en/docs/generative-apis/reference-content/rate-limits/) apply, to ensure "fair use" of synchronous HTTP calls. Bigger requests volumes should be treated through Batch processing. -- Guaranteed performance can be provided using dedicated resources on Managed Inference product. +- Generative APIs run models on mutualized infrastructure, and therefore ensure good performance in average usage. We monitor and respond quickly to any drops in token generation throughput, but cannot strictly guarantee performance, especially during customer peak loads. As a consequence, [rate limits](/generative-apis/reference-content/rate-limits/) apply, to ensure fair use of synchronous HTTP calls. Bigger volumes of requests should be treated through batch processing. +- Guaranteed performance can be provided using dedicated resources on the [Managed Inference](/managed-inference/) product. Batch processing (asynchronous file processing): - When using batch processing, we handle scheduling of batch jobs to optimize both processing resource allocation and processing time. Processing time is therefore only guaranteed to be lower than 24 hours and [rate limits](/generative-apis/reference-content/rate-limits/) (larger than Standard processing) still apply. From 39dc2f553086c0eb4ef8af554c9e37c6bba431b5 Mon Sep 17 00:00:00 2001 From: fpagny Date: Fri, 20 Jun 2025 11:01:33 +0200 Subject: [PATCH 10/18] Update pages/generative-apis/reference-content/security-and-reliability.mdx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Néda <87707325+nerda-codes@users.noreply.github.com> --- .../reference-content/security-and-reliability.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index c566d0286d..24387dad06 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -49,7 +49,7 @@ Monitoring is an essential pillar to ensure the security and reliability of your ### Metrics and logs -Generative APIs metrics and logs are stored inside [Cockpit](https://www.scaleway.com/en/docs/cockpit/). +Generative APIs metrics and logs are stored inside [Cockpit](/cockpit/). This includes: - **Metrics**: Input and Output tokens and API requests . Metrics are refreshed every minute (some dashboards may aggregate data by the hour for accuracy reasons, but metrics can be queried at a finer rate using Cockpit Custom Dashboards) From 2f5cc259cec42f673b2a2ba8213ce3b2155798e9 Mon Sep 17 00:00:00 2001 From: fpagny Date: Fri, 20 Jun 2025 11:01:45 +0200 Subject: [PATCH 11/18] Update pages/generative-apis/reference-content/security-and-reliability.mdx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Néda <87707325+nerda-codes@users.noreply.github.com> --- .../reference-content/security-and-reliability.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index 24387dad06..c5703875a3 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -52,7 +52,7 @@ Monitoring is an essential pillar to ensure the security and reliability of your Generative APIs metrics and logs are stored inside [Cockpit](/cockpit/). This includes: -- **Metrics**: Input and Output tokens and API requests . Metrics are refreshed every minute (some dashboards may aggregate data by the hour for accuracy reasons, but metrics can be queried at a finer rate using Cockpit Custom Dashboards) +- **Metrics**: Input and output tokens and API requests. Metrics are refreshed every minute (some dashboards may aggregate data by the hour for accuracy reasons, but metrics can be queried at a finer rate using Cockpit custom dashboards) - **Logs**: No logs are currently stored inside Cockpit. ## Configuration and version management From 9e257c8b22349bacab882d9abd4e7e9d32aed936 Mon Sep 17 00:00:00 2001 From: fpagny Date: Fri, 20 Jun 2025 11:02:53 +0200 Subject: [PATCH 12/18] Update pages/generative-apis/reference-content/security-and-reliability.mdx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Néda <87707325+nerda-codes@users.noreply.github.com> --- .../reference-content/security-and-reliability.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index c5703875a3..0d1ed095c0 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -45,7 +45,7 @@ Batch processing (asynchronous file processing): ## Monitoring -Monitoring is an essential pillar to ensure the security and reliability of your services. The practice provides real-time insights into the performance, security, and resource consumption of your Generative API usage. +Monitoring is an essential pillar to ensure the security and reliability of your services. The practice provides real-time insights into the performance, security, and resource consumption of your usage of Generative APIs. ### Metrics and logs From f486e3e48aa9aafe4e88ce254bef728fbefcc7fb Mon Sep 17 00:00:00 2001 From: Rowena Jones <36301604+RoRoJ@users.noreply.github.com> Date: Fri, 20 Jun 2025 11:31:35 +0200 Subject: [PATCH 13/18] Apply suggestions from code review --- .../reference-content/security-and-reliability.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index 0d1ed095c0..4dc077e60a 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -18,7 +18,7 @@ Resilience ensures the continuity and availability of your applications and data ### Availability and durability -Generative APIs SLAs target the following SLOs: +Generative APIs Service Level Agreements (SLAs) target the following Service Level Objectives (SLOs): | Processing Type | Configuration Details | Availability | | ------------ | ------------------- | ------ | From 0d834a7fe108cb6bfcf7e4fa3077db67268eb290 Mon Sep 17 00:00:00 2001 From: Rowena Jones <36301604+RoRoJ@users.noreply.github.com> Date: Fri, 20 Jun 2025 11:36:05 +0200 Subject: [PATCH 14/18] Apply suggestions from code review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Néda <87707325+nerda-codes@users.noreply.github.com> --- .../security-and-reliability.mdx | 44 +++++++++---------- 1 file changed, 21 insertions(+), 23 deletions(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index 4dc077e60a..3df141f8b6 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -61,15 +61,15 @@ Configuration and version management are critical for maintaining reliability an ### Configuration -Currently, Generative APIs do not provide specific configuration properties stored within your account. All configuration parameters are the one you send through each API HTTP calls (such as `temperature`, `top_p` or `seed`) and you remain responsible for any change in outputs based on these parameters. +Currently, Generative APIs do not provide specific configuration properties stored within your account. All configuration parameters are the ones you send through each API HTTP call (such as `temperature`, `top_p` or `seed`) and you remain responsible for any change in outputs based on these parameters. -Since Generative AI models are by definition non-deterministic, we cannot guarantee the same input will provide the same output over time (for example when used two different HTTP calls). If you want deterministic processing, we encourage you to use Managed Inference with a specific model and set all randomness parameters to deterministic level (for example using for instance `temperature`:`0` and a specific `seed` value). +Since Generative AI models are by definition non-deterministic, we cannot guarantee the same input will provide the same output over time (for example when using two different HTTP calls). If you want deterministic processing, we encourage you to use [Managed Inference](/managed-inference) with a specific model and set all randomness parameters to deterministic levels (for example using for instance `temperature`:`0` and a specific `seed` value). ### Version management #### Supported models -Any changes to supported models and associated guarantees are detailed in our [Model Lifecycle Policy](https://www.scaleway.com/en/docs/generative-apis/reference-content/model-lifecycle/). +Any changes to supported models and associated guarantees are detailed in our [model lifecycle policy page](/generative-apis/reference-content/model-lifecycle/). #### API versions @@ -77,58 +77,56 @@ Two types of API version updates may be performed: | Upgrade Type | Description| | ------------ | ------------------- | -| Minor | These updates do not change the API current fields format and are backward compatible (no action is required on your side). New fields and feature can however be added. | -| Major | These updates change the API current fields or path. They may require action from your side. In this case, we will notify you with at least 3 month notice before deprecating significant feature that might break your application. | +| Minor | These updates do not change the API's current fields format and are backward compatible (no action is required on your side). New fields and features can however be added. | +| Major | These updates change the API's current fields or paths. They may require action from your side. In this case, we will notify you with at least 3 months' warning before deprecating significant features that might break your application. | #### Third party tools compatibility -By following industry standards (such as targeting OpenAI API compatibility), we aim to provide compatibility with most AI ecosystem and tools by default. However, as ecosystem evolves quickly, we cannot guarantee strictly compatibility with third party tools, but provide extensive documentation: +By following industry standards (such as targeting OpenAI API compatibility), we aim to provide compatibility with most AI ecosystems and tools by default. However, as ecosystems evolve quickly, we cannot guarantee compatibility with third party tools, but provide extensive documentation: - Current API supported features are available in our API Documentation -- Advanced errors and edge cases workaround in our [Troubleshooting section](https://www.scaleway.com/en/docs/generative-apis/troubleshooting/fixing-common-issues/). -- Integration with third party tools is available in [Integrating Scaleway Generative APIs with popular AI tools](https://www.scaleway.com/en/docs/generative-apis/reference-content/integrating-generative-apis-with-popular-tools/#openai-client-libraries) +- Advanced errors and edge cases workarounds in our [Troubleshooting section](/generative-apis/troubleshooting/fixing-common-issues/). +- Integration with third party tools is available in our [dedicated documentation page](/generative-apis/reference-content/integrating-generative-apis-with-popular-tools/#openai-client-libraries) ## Data protection -Our Data protection measures are detailed in our [Privacy Policy](https://www.scaleway.com/en/docs/generative-apis/reference-content/data-privacy/). +Our data protection measures are detailed in our [privacy policy page](/generative-apis/reference-content/data-privacy/). -Overall: -- We do not store sensitive data (such as the content of your prompt), unless we need to, to provide the service (such as temporarily when using Batch processing). -- When data is stored, it is protected using state of the art method (such as encryption at rest). -- During transit, your data is encrypted by relying on HTTPS protocol. +- Scaleway does not store sensitive data (such as the content of your prompt), unless we need it to provide the service (such as when using batch processing) +- When data is stored, it is protected using a state of the art method (such as encryption at rest) +- During transit, your data is encrypted by relying on the HTTPS protocol ### Scaleway access -In order to perform maintenance operations and guarantee the reliability of Generative APIs, or comply with local regulations, we need to access servers hosting Generative APIs service. +In order to perform maintenance operations and guarantee the reliability of Generative APIs, or comply with local regulations, we need to access servers hosting the Generative APIs service. -Most of these accesses are automatic actions, in cases where Scaleway needs update configuration or upgrade software versions. +Most of the time, they are automatic actions, when Scaleway needs to update configuration or upgrade software versions, for example. -Manual interventions might be required occasionally, and for troubleshooting reasons (such as specific customer requests generating errors or performing malicious activity), we may access temporarily complete HTTP requests content to identify root cause issue or any security vulnerability. All Scaleway accesses are authenticated and traced following industry security standards. +Manual interventions might be required occasionally, and for troubleshooting reasons (such as specific customer requests generating errors or performing malicious activity), we may temporarily complete the content of HTTP requests to identify a root cause issue or any security vulnerability. All Scaleway accesses are authenticated and traced following industry security standards. ## Identity and access management Identity and access management allows you to enable granular control over user permissions and to mitigate the risk of unauthorized access or data breaches. -All accesses to Generative APIs are authenticated and authorized relying on [Scaleway IAM permissions sets](https://www.scaleway.com/en/docs/iam/reference-content/permission-sets/). +All accesses to Generative APIs are authenticated and authorized relying on [Scaleway IAM permissions sets](/iam/reference-content/permission-sets/). You are responsible for attributing these permissions to the relevant users or applications and reviewing these accesses frequently. ## Compliance -Several regulations apply to us directly, whereas other apply to your usage. Even in this case, we help you ease your compliance process by providing you with the information you need from your Cloud Provider. - +Several regulations apply to us directly, whereas others apply to your usage. Even in this case, we help you ease your compliance process by providing you with the information you need from your cloud provider. ### AI Act We (Scaleway) ensure our compliance with the AI Act within our scope of responsibilities. We also ensure that you have the information needed to comply with the requirements that apply to you. This means concretely: -- Gathering AI Model Providers information about their model (such as whether its training capacity is above 10²⁵ FLOPs, and falls into a specific category) and provide you with a link to these documents when they are made available by AI Model Providers. +- Gathering AI Model Providers information about their models (such as whether their training capacity is above 10²⁵ FLOPs, and falls into a specific category) and provide you with a link to these documents when they are made available by AI Model Providers. - Providing you with links towards licensing required by the AI Model Providers. -Scaleway has no access to, nor knowledge of, any inputs and outputs generated by the Models. By using our AI products, you agree and acknowledge that you are (i) responsible for this use including any content integrated into the Models, and (ii) required to use the AI products in compliance with our General Terms of services. +Scaleway has no access to, nor knowledge of any inputs and outputs generated by the models. By using our AI products, you agree and acknowledge that you are (i) responsible for this use including any content integrated into the models, and (ii) required to use the AI products in compliance with our General Terms of services. As a client of our AI products, you are likely to be considered an AI System Provider or Deployer under the AI Act. As such, it is your responsibility to ensure you comply with requirements that apply to you. -### Additional Local Regulation +### Additional local regulation -If you require additional information to comply with specific regulation, you can create a [support ticket](https://console.scaleway.com/support/tickets/create) or contact your account manager. +If you require additional information to comply with specific regulations, you can create a [support ticket](https://console.scaleway.com/support/tickets/create) or contact your account manager. From 51eb952b1e849437f77730527216436747262d71 Mon Sep 17 00:00:00 2001 From: Rowena Jones <36301604+RoRoJ@users.noreply.github.com> Date: Fri, 20 Jun 2025 11:51:11 +0200 Subject: [PATCH 15/18] Apply suggestions from code review --- .../security-and-reliability.mdx | 35 ++++++++++--------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index 3df141f8b6..f1260f705a 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -7,6 +7,7 @@ content: paragraph: Learn more about shared responsibility in security and reliability practices for Generative APIs tags: generative-apis ai-data shared responsibility security reliability dates: + creation: 2025-06-16 validation: 2025-06-16 --- @@ -14,7 +15,7 @@ This page outlines key principles and best practices to help you ensure your app ## Resilience -Resilience ensures the continuity and availability of your applications and data, even in the face of disruptions or failures. In Generative APIs, you can promote resilience through the following pillars: availability, durability and performance. +Resilience ensures the continuity and availability of your applications and data, even in the face of disruptions or failures. In Generative APIs, you can promote resilience through three pillars: **availability**, **durability** and **performance**. ### Availability and durability @@ -45,11 +46,11 @@ Batch processing (asynchronous file processing): ## Monitoring -Monitoring is an essential pillar to ensure the security and reliability of your services. The practice provides real-time insights into the performance, security, and resource consumption of your usage of Generative APIs. +Monitoring is an essential pillar to ensure the security and reliability of your services. It provides real-time insights into the performance, security, and resource consumption of your Generative APIs usage. ### Metrics and logs -Generative APIs metrics and logs are stored inside [Cockpit](/cockpit/). +Generative APIs metrics and logs are stored inside [Scaleway Cockpit](/cockpit/). This includes: - **Metrics**: Input and output tokens and API requests. Metrics are refreshed every minute (some dashboards may aggregate data by the hour for accuracy reasons, but metrics can be queried at a finer rate using Cockpit custom dashboards) @@ -80,47 +81,47 @@ Two types of API version updates may be performed: | Minor | These updates do not change the API's current fields format and are backward compatible (no action is required on your side). New fields and features can however be added. | | Major | These updates change the API's current fields or paths. They may require action from your side. In this case, we will notify you with at least 3 months' warning before deprecating significant features that might break your application. | -#### Third party tools compatibility +#### Compatibility with third party tools -By following industry standards (such as targeting OpenAI API compatibility), we aim to provide compatibility with most AI ecosystems and tools by default. However, as ecosystems evolve quickly, we cannot guarantee compatibility with third party tools, but provide extensive documentation: -- Current API supported features are available in our API Documentation -- Advanced errors and edge cases workarounds in our [Troubleshooting section](/generative-apis/troubleshooting/fixing-common-issues/). -- Integration with third party tools is available in our [dedicated documentation page](/generative-apis/reference-content/integrating-generative-apis-with-popular-tools/#openai-client-libraries) +By following industry standards (such as targeting OpenAI API compatibility), we aim to provide compatibility with most AI ecosystems and tools by default. However, as ecosystems evolve quickly, we cannot always guarantee compatibility with third party tools. We do provide extensive documentation: +- Current API supported features are available in our [API Documentation](/generative-apis/api-cli/) +- Advanced errors and edge case workarounds are provided in our [Troubleshooting section](/generative-apis/troubleshooting/fixing-common-issues/). +- Information about integration with third party tools is available in our [dedicated documentation page](/generative-apis/reference-content/integrating-generative-apis-with-popular-tools/#openai-client-libraries) ## Data protection -Our data protection measures are detailed in our [privacy policy page](/generative-apis/reference-content/data-privacy/). +Our data protection measures are detailed on our [privacy policy page](/generative-apis/reference-content/data-privacy/). - Scaleway does not store sensitive data (such as the content of your prompt), unless we need it to provide the service (such as when using batch processing) - When data is stored, it is protected using a state of the art method (such as encryption at rest) -- During transit, your data is encrypted by relying on the HTTPS protocol +- During transit, your data is encrypted via the HTTPS protocol ### Scaleway access In order to perform maintenance operations and guarantee the reliability of Generative APIs, or comply with local regulations, we need to access servers hosting the Generative APIs service. -Most of the time, they are automatic actions, when Scaleway needs to update configuration or upgrade software versions, for example. +Most of the time, any actions Scaleway carries out are automatic, e.g. updating configuration or upgrading software versions. -Manual interventions might be required occasionally, and for troubleshooting reasons (such as specific customer requests generating errors or performing malicious activity), we may temporarily complete the content of HTTP requests to identify a root cause issue or any security vulnerability. All Scaleway accesses are authenticated and traced following industry security standards. +Manual interventions might be required occasionally for troubleshooting reasons (such as specific customer requests generating errors or carrying out malicious activity). We may temporarily complete the content of HTTP requests to identify a root cause issue or any security vulnerability. All Scaleway access is authenticated and traced following industry security standards. ## Identity and access management Identity and access management allows you to enable granular control over user permissions and to mitigate the risk of unauthorized access or data breaches. -All accesses to Generative APIs are authenticated and authorized relying on [Scaleway IAM permissions sets](/iam/reference-content/permission-sets/). +All access to Generative APIs is authenticated and authorized, relying on [Scaleway IAM permissions sets](/iam/reference-content/permission-sets/). -You are responsible for attributing these permissions to the relevant users or applications and reviewing these accesses frequently. +You are responsible for attributing these permissions to the relevant users or applications, and for reviewing these accesses frequently. ## Compliance -Several regulations apply to us directly, whereas others apply to your usage. Even in this case, we help you ease your compliance process by providing you with the information you need from your cloud provider. +Several regulations apply to us (Scaleway) directly, whereas others apply to your usage. Even in this case, we help you ease your compliance process by providing you with the information you need from your cloud provider. ### AI Act We (Scaleway) ensure our compliance with the AI Act within our scope of responsibilities. We also ensure that you have the information needed to comply with the requirements that apply to you. This means concretely: -- Gathering AI Model Providers information about their models (such as whether their training capacity is above 10²⁵ FLOPs, and falls into a specific category) and provide you with a link to these documents when they are made available by AI Model Providers. +- Gathering information from AI Model Providers about their models (such as whether their training capacity is above 10²⁵ FLOPs, and falls into a specific category), and providing you with a link to these documents when they are made available. - Providing you with links towards licensing required by the AI Model Providers. -Scaleway has no access to, nor knowledge of any inputs and outputs generated by the models. By using our AI products, you agree and acknowledge that you are (i) responsible for this use including any content integrated into the models, and (ii) required to use the AI products in compliance with our General Terms of services. +Scaleway has no access to, nor knowledge of any inputs and outputs generated by the models. By using our AI products, you agree and acknowledge that you are (a) responsible for this use, including any content integrated into the models, and (b) required to use the AI products in compliance with our General Terms of Services. As a client of our AI products, you are likely to be considered an AI System Provider or Deployer under the AI Act. As such, it is your responsibility to ensure you comply with requirements that apply to you. From 7489d6f2d9cebda2fbde0abb01ff1b822681e5d4 Mon Sep 17 00:00:00 2001 From: Rowena Jones <36301604+RoRoJ@users.noreply.github.com> Date: Fri, 20 Jun 2025 14:36:25 +0200 Subject: [PATCH 16/18] Update pages/generative-apis/reference-content/security-and-reliability.mdx --- .../reference-content/security-and-reliability.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index f1260f705a..c2a9965049 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -117,7 +117,7 @@ You are responsible for attributing these permissions to the relevant users or a Several regulations apply to us (Scaleway) directly, whereas others apply to your usage. Even in this case, we help you ease your compliance process by providing you with the information you need from your cloud provider. ### AI Act -We (Scaleway) ensure our compliance with the AI Act within our scope of responsibilities. We also ensure that you have the information needed to comply with the requirements that apply to you. This means concretely: +We (Scaleway) ensure our compliance with the [AI Act](https://artificialintelligenceact.eu/) within our scope of responsibilities. We also ensure that you have the information needed to comply with the requirements that apply to you. This means concretely: - Gathering information from AI Model Providers about their models (such as whether their training capacity is above 10²⁵ FLOPs, and falls into a specific category), and providing you with a link to these documents when they are made available. - Providing you with links towards licensing required by the AI Model Providers. From 1351726a7aaaadad7b45709588180f972ce1ca33 Mon Sep 17 00:00:00 2001 From: Rowena Date: Fri, 20 Jun 2025 14:43:40 +0200 Subject: [PATCH 17/18] fix(ai): add to menu --- menu/navigation.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/menu/navigation.json b/menu/navigation.json index 09f1fc3d44..376eb5dc8b 100644 --- a/menu/navigation.json +++ b/menu/navigation.json @@ -844,6 +844,10 @@ "label": "Data privacy", "slug": "data-privacy" }, + { + "label": "Security and Reliability in Generative APIs", + "slug": "security-and-reliability" + }, { "label": "Adding AI to VS Code using Continue", "slug": "adding-ai-to-vscode-using-continue" From a905fa76e6865f4e5f623ac63a6232ced49da70f Mon Sep 17 00:00:00 2001 From: Rowena Date: Fri, 20 Jun 2025 14:46:31 +0200 Subject: [PATCH 18/18] fix(ai): fix posted date --- .../reference-content/security-and-reliability.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/generative-apis/reference-content/security-and-reliability.mdx b/pages/generative-apis/reference-content/security-and-reliability.mdx index c2a9965049..8e2c78488e 100644 --- a/pages/generative-apis/reference-content/security-and-reliability.mdx +++ b/pages/generative-apis/reference-content/security-and-reliability.mdx @@ -7,7 +7,7 @@ content: paragraph: Learn more about shared responsibility in security and reliability practices for Generative APIs tags: generative-apis ai-data shared responsibility security reliability dates: - creation: 2025-06-16 + posted: 2025-06-16 validation: 2025-06-16 ---