The security responsibilities of compute providers: from acceptable use to end-use review
As compute becomes basic infrastructure, the companies that supply it must carry matching responsibility. Responsible compute services make the rules clear before activation, not after.
When high-performance compute becomes a service you can buy by the hour, one question can't be avoided: what is it being used for, and who is responsible?
The traditional view holds that infrastructure providers simply supply power and pipes and do not ask about use. AI compute is different. It can train models that benefit society, and it can also be used for fraud, deepfakes, cyberattacks and even controlled military applications. Regulators are paying closer attention to compute services as a result, and customers and partners are raising their expectations of providers.
Our view is that responsibility in compute must come first: before a customer is activated, not as an afterthought.
The first line: an acceptable use policy
An acceptable use policy is the most basic set of rules between a compute provider and its customers. It must state clearly which uses are prohibited.
An effective policy should cover at least:
- Uses that breach sanctions or export controls
- Child sexual abuse material, non-consensual intimate imagery and deceptive deepfakes of real people
- Cyberattacks, malware distribution and interference with others' systems
- Unauthorised resale or transfer of access
- Cryptocurrency mining, and packaging compute as an investment or yield product
Clear rules tell customers where the boundaries are; enforceable rules let a provider suspend service decisively when it finds a breach.
The second line: know your customer
Compute is not an ordinary commodity. The same GPUs carry entirely different risks in different hands. Customer verification is therefore essential:
- Verify company registration and major shareholders
- Screen customers and their major owners against restricted-party lists
- Apply enhanced due diligence for high-risk regions and industries
These steps lengthen onboarding, but they protect more than the provider. They protect law-abiding customers from sharing infrastructure with those who break the rules.
The third line: end-use review
For high-performance AI compute, knowing who the customer is is not enough. A provider also needs to know what the compute is for and where it will be used.
An end-use statement asks the customer to describe the purpose and location of use, and to confirm the compute won't support military or other prohibited uses. Where export controls apply, a provider must also review each case by country, chip model and service type, with counsel involved where necessary — and some requests may not be serviceable as a result.
Transparency is the best foundation for trust
Security responsibility does not mean burying rules deep in a contract. It means telling customers openly and plainly what we do and why.
That is why Qovane Group established its Trust Center, which sets out the Group's approach to export controls, sanctions screening, forced-labour review, data protection and anti-corruption, together with what customers provide before activation. We believe a compute provider willing to explain its rules clearly is one worth trusting for the long term.