A development team at a financial services firm deploys a customer-facing web application to a Platform-as-a-Service (PaaS) offering. During a security review, the team asks which security tasks remain their responsibility versus the cloud provider's. Under the shared responsibility model for PaaS, which task is the customer's responsibility?