separating the provider-independent security concept for now