Which kind of security always is the responsibility of the cloud customer?

Physical security is almost always the responsibility of the cloud provider, as they own and operate the data centers.

Network security responsibilities are shared, with the provider securing the underlying network infrastructure and the customer securing their virtual networks and configurations.

Application security can be shared (PaaS, IaaS) or primarily the provider's responsibility (SaaS), depending on the service model.

Across all cloud service models (IaaS, PaaS, SaaS), the customer always retains ultimate responsibility for their data, including its sensitivity, encryption, access controls, and compliance. While cloud providers offer tools and services to help secure data, the customer decides what data is stored and how it is protected within the application.