# Manage Security on Confluent Cloud Confluent Cloud provides comprehensive security features to protect your data and resources. This section covers the key areas of managing security on Confluent Cloud, including authentication, access control, data encryption, and activity monitoring. Confluent Cloud also offers the [Advanced Security add-on](advanced-security.md#advanced-security-add-on), an organization-level security package for advanced identity, encryption, and access-control capabilities across your Confluent Cloud footprint. The add-on includes features such as [System for Cross-domain Identity Management](authenticate/user-identities/user-idps/sso/scim.md#scim-user-provisioning) (SCIM), self-managed encryption keys (BYOK), and higher limits for select security resources. For details about included capabilities, limits, and billing, see [Advanced Security add-on for Confluent Cloud](advanced-security.md#advanced-security-add-on). #### NOTE The Advanced Security add-on is a Limited Availability feature in Confluent Cloud. For more information, see [Advanced Security add-on for Confluent Cloud](advanced-security.md#advanced-security-add-on). ## Manage authentication Authentication ensures that only authorized users and applications can access your Confluent Cloud resources. This includes managing user accounts, service accounts, API keys, and integrating with identity providers for Single Sign-On (SSO), OAuth/OIDC, and mTLS. Some advanced identity capabilities, including SCIM, are available with the [Advanced Security add-on](advanced-security.md#advanced-security-add-on). See [Manage Authentication on Confluent Cloud](authenticate/overview.md#authenticate-overview). ## Control access to Confluent Cloud resources Use authorization mechanisms, such as Role-Based Access Control (RBAC) and Access Control Lists (ACLs), to control access to Confluent Cloud resources. This ensures only authorized entities can access specific resources and perform certain actions. The [Advanced Security add-on](advanced-security.md#advanced-security-add-on) also provides higher limits for select RBAC and identity resources. See [Control Access to Confluent Cloud Resources](access-control/overview.md#control-access-overview). ## Encrypt and protect data Data encryption protects your data at rest and data in motion (or data in transit), to help ensure that your data is protected. Confluent Cloud supports various encryption methods, including self-managed encryption keys (BYOK) for your Dedicated Kafka clusters and client-side field-level encryption (CSFLE) to protect your most sensitive data. Self-managed encryption keys (BYOK) are available through the [Advanced Security add-on](advanced-security.md#advanced-security-add-on) for new organizations. See [Encrypt and Protect Data on Confluent Cloud](encrypt/overview.md#encrypt-and-protect-data-overview). ## Monitor activity Monitoring activity involves tracking and auditing access and actions performed on your Confluent Cloud resources. This helps you detect and respond to potential security incidents and ensure compliance with security policies. See [Audit Log Concepts on Confluent Cloud](../monitoring/audit-logging/cloud-audit-log-concepts.md#cloud-audit-logs). ## Related content * [Building Trust With Confluent Cloud (Whitepaper)](https://confluent.safebase.us/?itemUid=cc00237c-1b4b-4d84-b9c0-218b3d4488e1) * [Confluent Cloud Security and Compliance Shared Responsibility Model (Whitepaper)](https://confluent.safebase.us/?itemUid=de3b7f64-7f11-4ddf-aa79-e5e740f6ef0f) * [Confluent Cloud Data Residency and Resilience (Whitepaper)](https://confluent.safebase.us/?itemUid=d51a74e5-4626-4204-9511-547cb053f6cc) * [Confluent Vulnerability Management (Whitepaper)](https://confluent.safebase.us/?itemUid=ec32301f-c8d0-4226-bdc2-57e6bc3e8b6a) * [Confluent Cloud Security (Confluent Developer course)](https://developer.confluent.io/courses/cloud-security/)