Physical Security

As the physical infrastructure for Sophos Central is maintained by Amazon, there is a separation of responsibilities. In brief, Amazon take responsibility for security of the cloud itself, and Sophos take responsibility for security in the cloud. The AWS Shared Responsibility Model details these responsibilities: https://aws.amazon.com/compliance/shared-responsibility-model/

For details on what steps Amazon takes to secure the infrastructure and services they offer, see their security whitepaper: https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Whitepaper.pdf