Security
Security is the job.
We protect other people's software for a living, so our own posture has to hold up. This page covers how we handle your builds and data, how we think about dual-use, and where the limits are.
Our work
Defensive security, for the people who own the software.
Protecting software means understanding how it gets taken apart. That work is dual-use by nature: the same techniques that stop a paid product from being cracked could be misused to hide something harmful. We do that work only for teams who own what they are protecting, and the limits are spelled out below.
Secrets stay on our side
Protection keys, the transforms, and the tooling never leave our infrastructure. Nothing sensitive ships inside the software we hand back, so there is no secret in the shipped app to pull out.
Least-privilege everything
Protected artifacts move over short-lived, single-purpose links. The pipeline holds no standing storage credentials, and access to build inputs and outputs is scoped and time-bound.
Encrypted in transit and at rest
Build inputs, artifacts, and entitlement data are encrypted in transit and at rest. We keep the minimum needed to run the pipeline and issue traceable builds, and nothing more.
Every write is audited
Pipeline runs, artifact issuance, and staff actions are logged. Watermark provenance means a produced copy always reconciles to the entitlement it came from.
Who guards the guard
Built toward the frameworks.
We build toward recognized control frameworks and describe them plainly. Where we are not yet audited, we say so instead of implying a certification we do not hold.
status · pre-certification
Cerberus is not yet audited against SOC 2 or ISO 27001. The controls below are built to those frameworks and to the data rules that apply (GDPR, CCPA). Audit status will be published here as it changes.
- Access control
- Role-scoped staff access with strong authentication on every admin surface.
- Data minimization
- We process built artifacts and entitlement data. Your source code never needs to reach us.
- Retention
- Inputs and outputs live only as long as a build channel needs them, then age out.
- Isolation
- Every protection job runs in its own isolated environment. No job can observe another.
Responsible use
Who we work with, and who we turn away.
Software protection is dual-use technology. Obfuscation and anti-tamper keep legitimate software from being cracked, and the same techniques could be misused to hide malicious code.
Cerberus is offered to teams protecting software they own or are licensed to protect. It is not a tool for concealing malware, evading security products, or defeating someone else’s protections. We decline or withdraw access when use falls outside that intent.
- You must have the rights to the software you submit for protection.
- Protecting malware, spyware, or code meant to harm users is off the table.
- Watermarking and traceability are for your own leak attribution, not for surveilling end users.
Coordinated disclosure
Found a weakness in our platform or in a build it produced? Tell us first and give us a reasonable window to fix it. We will not pursue good-faith research that respects user privacy and avoids service disruption.
Report an issuehello@cps.sh