22. Security and Compliance#
Working on the Kempner AI Cluster is a shared responsibility. The cluster is part of Harvard’s FASRC environment, so your account, your data, and the jobs you run are all subject to university and FASRC policy. This page summarizes the practices and rules that keep the cluster secure and your research compliant. It points to the authoritative Harvard and FASRC pages for the details, which take precedence over anything summarized here.
See also
The overarching policies live in the FASRC Acceptable Use Policy and Harvard Research Data Management and Policy Compliance. For cluster-specific expectations, see Cluster Usage Policies.
22.1. Account and access security#
Your cluster account is tied to you personally, and you are accountable for everything done under it.
Warning
Never share your account or credentials with anyone, including labmates. Account sharing violates university policy: accounts found sharing credentials may be disabled or banned, access can be revoked, and further university action may follow. If someone needs access, they must request their own account. See Can I share my account?.
To keep your credentials safe:
Use a password manager. Harvard provides 1Password free to the community, and its use is encouraged.
Keep your two-factor (OpenAuth) device secure, and never share one-time codes. See the New User Checklist for setup.
Report a suspected account compromise immediately (see Reporting a concern below).
22.2. Data classification and what the cluster can host#
Harvard classifies data into five security levels. The level determines where the data may be stored and processed.
Level |
Meaning |
Examples |
|---|---|---|
L1 |
Public |
Published papers, open datasets |
L2 |
Low-risk confidential |
Most unpublished research data, non-sensitive code |
L3 |
Confidential and sensitive |
Many types of personal data, some regulated data |
L4 |
High risk |
Sensitive personal or regulated data |
L5 |
Extremely sensitive |
The most tightly controlled data |
See the Harvard Data Classification Table for the authoritative definitions.
Warning
The Kempner AI Cluster is rated for data up to Level 2 (L2) only. Do not place L3 or higher data on the cluster. Level 3 data must be handled in Harvard’s dedicated FASSE secure environment, which is rated for L3 only; Level 4 and above are not permitted on any FASRC system. For regulated (Level 4) data, use Harvard University Research Computing’s Regulated Data Services.
Warning
This means no PII, HIPAA/PHI, or other regulated high-risk data on the cluster, since Harvard classifies these Level 3 or higher (HIPAA/PHI and PII are Level 4). If you are unsure how your data is classified, confirm with your PI and Harvard security before uploading it.
22.3. Data ownership and handling#
Research data generated at Harvard is owned by the University; you are its steward, not its private owner. How you move and share it is governed by grant terms, data use agreements (DUAs), and your PI’s direction.
Warning
Do not move data out of a PI’s lab space, whether to another location on the cluster or to any external destination, without PI approval and confirmation that it complies with the relevant grant terms and data use agreements. Unauthorized copying or sharing of lab data can breach funding and legal obligations.
Note
Any required data use agreement must be in place before the data is stored on the cluster, and the PI is responsible for ensuring approved access stays compliant. For planning your data lifecycle, see Data Management Plan and Storage Options.
Note
Retention and deletion. Research records must be kept for the retention period Harvard and your sponsor require, generally at least seven years, and you may not independently delete or remove research data. Scratch storage is purged after 90 days, so it is not a retention solution; copy anything you must keep to persistent or archival storage. See the FASRC Research Data Retention and Deletion Policy and the Data Management Plan.
22.4. Responsible use of AI tools#
AI coding assistants and other generative AI tools are useful on the cluster, but their use must follow university guidance.
Note
Follow Harvard’s Generative AI Guidelines and the Provost’s guidance on using ChatGPT and other generative AI tools. In particular, do not paste confidential (L2 and above) data into public AI services.
Warning
Take extra care when running AI tools in automated or agentic mode, where the tool executes commands on its own. Before enabling autonomous execution:
Review the actions the agent proposes rather than approving them blindly.
Scope the agent to your own directories, and avoid destructive operations (for example, recursive deletes).
Ensure it cannot affect shared paths, other labs’ data, or cluster-wide resources.
An unsupervised agent can delete data or disrupt shared resources far faster than a person.
22.5. External data and network conduct#
Datasets you download or scrape from external providers come with terms of use, and the whole cluster shares a small pool of public IP addresses.
Warning
Respect the terms of service and rate limits of any external data source. Aggressive downloading or scraping that violates a provider’s terms can get the cluster’s shared public IP blocked, breaking access for every user, and may breach the provider’s agreement. When in doubt, throttle your requests and read the source’s terms first.
See the FASRC Acceptable Use Policy for the full expectations on network conduct.
22.6. Software licensing#
You may install software relevant to your research, provided you comply with the FASRC Acceptable Use Policy and the licensing terms of each package.
Note
FASRC does not purchase software for labs. Commercial or licensed software must be acquired by your lab, department, or school (for example, through HUIT software licensing), and must have a Linux-compatible license to run on the cluster. See Installing Software and FAS licensed software.
Respect the license of every dataset, model, and library you use, including non-commercial and attribution clauses. This is both a legal and a compliance requirement.
22.7. Compliance and grant obligations#
Your work is also bound by the requirements of whoever funds and governs it.
Funding agencies. Follow the data management, sharing, and access requirements of your grants (for example, NIH and NSF data policies). These often flow into your Data Management Plan.
Retention periods. Keep research data for the retention period your sponsor and Harvard require. Funding agencies set their own minimums, and Harvard’s longer retention period supersedes shorter federal minimums. See the Data Management Plan.
Data use agreements. Honor every DUA and contract that applies to data you use, as directed by your PI.
University policy. You are responsible for knowing and following applicable Harvard Information Security and Research Data Security policies.
Reporting a concern
If you suspect a security incident, a compromised account, or a policy violation, report it promptly. Contact FASRC at rchelp@rc.fas.harvard.edu and, for security incidents, Harvard’s Information Security office at ithelp@harvard.edu. Acting quickly limits the impact on you, your lab, and the wider cluster.