Trust
Security at Cerul
Architecture statement updated: July 25, 2026
Cerul separates the cloud control plane, Web presentation layer, and local runtime so each component receives only the authority it needs.
Identity and browser security
- Web sessions use Secure, HttpOnly, host-only cookies.
- Browser JavaScript cannot read session credentials.
- Administrative views fail closed and depend on server-issued scopes.
Data and execution boundaries
- Web pages do not connect directly to databases, object storage, payment systems, or model providers.
- Local assets stay in the local runtime unless you explicitly choose a cloud operation.
- The Clean Reset product exposes no public-Share route or upload flow.
Contracts and changes
Cloud and local integrations use versioned API contracts and generated clients. Contract changes are reviewed centrally so presentation code cannot silently expand its authority.
Report a vulnerability
Please send security reports to security@cerul.ai. Include reproduction steps and potential impact, and avoid accessing data that is not yours.
Questions? Contact support@cerul.ai.