{"id":10793,"date":"2026-09-22T17:10:14","date_gmt":"2026-09-22T21:10:14","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10793"},"modified":"2026-09-22T12:25:20","modified_gmt":"2026-09-22T16:25:20","slug":"coreweave-just-answered-the-question-every-security-review-asks","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/","title":{"rendered":"CoreWeave just answered the question every security review asks"},"content":{"rendered":"

There is a strange conversation that happens in nearly every enterprise AI security review, and it usually stalls the whole project. Auditors ask for a list of everyone who can decrypt sensitive data. On most cloud platforms, the cloud provider itself is on that list. CoreWeave<\/a> just removed itself from it.<\/p>\n

The AI cloud company introduced Remote Key Encryption this week, a service that encrypts customer data on its infrastructure using keys the customer generates and keeps in their own systems, whether that is HashiCorp Vault, another key management tool, or a hardware security module they already run. CoreWeave never imports those keys anywhere. The company ends up holding only ciphertext, meaning even its own staff cannot read the underlying data without the customer’s explicit involvement.<\/p>\n

That distinction matters more than it might sound. Model weights and training checkpoints carry the same regulatory weight as any other sensitive corporate data, and security teams have spent years building custody rules around infrastructure that predates AI workloads<\/a> entirely. Andy Manoske, who leads enterprise and security product at CoreWeave, put it plainly in a blog post written with colleague Paul Friedman: the fastest way through a security review is not inventing a new security model, but making sure the new layer speaks the same language as whatever the customer already built.<\/p>\n

The encryption runs client-side, inside the customer’s own compute boundary, and key rotation and revocation follow the customer’s existing schedule rather than a separate system CoreWeave<\/a> controls. Access to the physical nodes stays locked behind support controls that require explicit customer permission before any CoreWeave engineer can get near them.<\/p>\n

This fits a pattern the company has been building for a while. Its identity system already federates with Microsoft Entra and Okta rather than storing its own source of truth, and a separate tool called SUNK automatically provisions Slurm accounts for researchers the moment they show up in a company directory, cutting out what used to be manual setup work for every new cluster user.<\/p>\n

Remote Key Encryption enters limited availability later this year, with IBM<\/a> as a launch partner, protecting data on CoreWeave’s object storage first before likely expanding further.<\/p>\n","protected":false},"excerpt":{"rendered":"

There is a strange conversation that happens in nearly every enterprise AI security review, and it usually stalls the whole project. Auditors ask for a list of everyone who can decrypt sensitive data. On most cloud platforms, the cloud provider itself is on that list. CoreWeave just removed itself from it. The AI cloud company […]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[6029,8189,8186,8188,8187],"class_list":["post-10793","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-ai-cloud-security","tag-ai-infrastructure-security","tag-coreweave-encryption","tag-enterprise-data-sovereignty","tag-remote-key-encryption"],"acf":[],"yoast_head":"\nCoreWeave just answered the question every security review asks - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CoreWeave just answered the question every security review asks - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"There is a strange conversation that happens in nearly every enterprise AI security review, and it usually stalls the whole project. Auditors ask for a list of everyone who can decrypt sensitive data. On most cloud platforms, the cloud provider itself is on that list. CoreWeave just removed itself from it. The AI cloud company […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-22T21:10:14+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-22T16:25:20+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/\",\"name\":\"CoreWeave just answered the question every security review asks - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-09-22T21:10:14+00:00\",\"dateModified\":\"2026-09-22T16:25:20+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CoreWeave just answered the question every security review asks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CoreWeave just answered the question every security review asks - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/","og_locale":"en_US","og_type":"article","og_title":"CoreWeave just answered the question every security review asks - Web Hosting News","og_description":"There is a strange conversation that happens in nearly every enterprise AI security review, and it usually stalls the whole project. Auditors ask for a list of everyone who can decrypt sensitive data. On most cloud platforms, the cloud provider itself is on that list. CoreWeave just removed itself from it. The AI cloud company […]","og_url":"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/","og_site_name":"Web Hosting News","article_published_time":"2026-09-22T21:10:14+00:00","article_modified_time":"2026-09-22T16:25:20+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/","url":"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/","name":"CoreWeave just answered the question every security review asks - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-09-22T21:10:14+00:00","dateModified":"2026-09-22T16:25:20+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/coreweave-just-answered-the-question-every-security-review-asks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"CoreWeave just answered the question every security review asks"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":89,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10793","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10793"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10793\/revisions"}],"predecessor-version":[{"id":10794,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10793\/revisions\/10794"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10793"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10793"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10793"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}