Skip to content
Cerberus

Platform

The whole stack, behind one product.

Protection is the core. Around it we run identity, transport, data, commerce, analytics, observability, support, content, and an AI-native operator layer. Every piece below is live for tenants now, with anything still rolling out marked as such.

the core

Protection & DRM

The core of what we do. A build goes in unprotected and comes out virtualized, sealed, and watermarked per copy.

  • A protection pipeline we design for your build, run server-side
  • The right existing tooling for the job, VMProtect and its peers included
  • Custom obfuscation and virtualization when off-the-shelf is not enough
  • Per-copy watermarking, so a leak traces back to one buyer
  • Anti-tamper, integrity checks, and soft device trust
.ci/release.ymlsynthetic sample
- name: protect
  uses: cerberus/protect@v1
  with:
    artifact: build/app-1.4.2.bin
    profile: stable          # per-channel protection profile
    watermark: per-download  # unique, traceable per copy
# returns a presigned URL to the sealed artifact

Identity

One account system across all of your products, and the auth every other service trusts.

  • Full identity provider: sessions, JWT, OAuth 2.1
  • Passkeys, 2FA, and device binding
  • Keypair identity for machine and end-to-end-encrypted flows
  • Staff roles and per-tenant scoping built in

Client transport

Encrypted, authenticated channels between your client and your backend.

  • Bidirectional tunnels with per-session grants
  • Keys live in a native layer, so no secret sits in the shipped app
  • Reconnect, heartbeat, and file delivery handled for you
  • The same hardened channel behind every tenant's shipped app

User data

Sync and storage for sensitive end-user data, including a zero-knowledge mode we cannot read.

  • Encrypted sync where the server only ever sees ciphertext
  • A key per member, rotated the moment someone is removed
  • An open, documented data format, so the data outlives any one vendor
  • Quotas and sharing without ever touching the plaintext

Commerce & licensing

Take money, issue licenses, and enforce entitlements across products and regions.

  • Multiple payment providers: cards, crypto, and regional methods
  • Orders, entitlements, and license keys as the source of truth
  • Coupons, referrals, creator codes, and a reseller network
  • Delivery by email and chat, with per-tenant branded receipts

Analytics & observability

First-party analytics and deep operational visibility, all in house.

  • Product analytics with no third-party trackers on your users
  • Logs, metrics, and traces tied together, so one request tells one story
  • Uptime, status pages, and alerting
  • Curated error and build feeds, not a raw firehose you have to babysit

Support & community

Where your users ask for help and talk to each other, run for you.

  • Web tickets with a staff queue and a grounded AI first response
  • A knowledge base that doubles as the AI's source
  • Chat bots per tenant: account lookups, license delivery, moderation
  • Forums, notifications, and web push

Content & localization

Copy, docs, and every locale, versioned like code and shipped to the edge.

  • Per-tenant content libraries: app strings, docs, legal, marketing
  • A machine-translation pipeline with human review, self-hosted
  • One source of truth in English, every locale held to it automatically
  • Docs written for your users and for the models that read them

AI-native operations

An assistant can operate the platform with exactly the permissions of the person behind it.

  • A remote MCP server so operators drive the platform through an assistant
  • Custom MCP servers scoped to your data and your permissions
  • AI chat for support and staff, grounded in your own knowledge
  • AI log monitoring and triage, rolling out to every tenant
mcp.config.jsonsynthetic sample
{
  "mcpServers": {
    "cerberus": {
      "url": "https://mcp.your-domain.com",
      "auth": "cpsk_…",              // scoped key, per operator
      "tools": ["orders", "users", "observability", "keys"]
    }
  }
}

Build & delivery

From commit to a sealed, signed, per-user artifact.

  • CI/CD wired to your git provider and build server
  • Protection runs as one build step, keys never leave the pipeline
  • Release channels, signed updates, and staged rollback
  • Multi-platform native builds when you ship desktop

Operator surface

One dashboard over the whole platform, for the people who run it.

  • Users, orders, entitlements, keys, and device sessions in one place
  • Roles and permissions enforced at every layer
  • An audit log for every write
  • The same surface whether you operate it or we do

One gate, every tenant

Every tenant gets the same platform.

One identity, one commerce engine, one operator console, shared by every tenant and separated by hard walls. Because the platform already exists, a new product comes onto it in weeks. The hard parts are already paid for.

See servicesTalk to us