Security at cekeep

Security is part of how cekeep handles compliance evidence, not a claim that software alone makes an organization compliant.

Current safeguards

• Workspace-scoped authorization with Owner, Member, and Viewer roles
• Private object storage with time-limited file access
• Encryption in transit and hardened production cookies
• Verified-email account activation and rate-limited authentication flows
• Audit events for material workspace activity
• Managed PostgreSQL backups and health monitoring
• Signed Stripe webhook processing and asynchronous transactional email

Shared responsibility

Customers are responsible for assigning appropriate workspace roles, protecting credentials, reviewing member access, classifying uploaded information, and maintaining their own compliance program.

Report a vulnerability

Please send a clear description, reproduction steps, and potential impact to [email protected]. Do not access other users’ data, disrupt service, or publicly disclose an unresolved issue. We will acknowledge good-faith reports and coordinate remediation.