The Trust Center sets the posture. This page sets the implementation: AuthN flow, encryption substrates, plane separation, scope-enforcement primitives, audit-ledger integrity, and the vendor-questionnaire pipeline. If you're filling in a SIG or CAIQ on our behalf, you should be able to answer most rows from this page alone.
Authentication
The free-scan flow uses a single-use, signed verification link tied to the eTLD+1 of the requester's email — no scan enters the queue until the user clicks the link. Paid customers authenticate via password (argon2id) or verification link, with optional TOTP/WebAuthn at Business tier and above. SAML / OIDC / SCIM provisioning at Enterprise.
CELVEX Group_celvex-authorize.<domain>). 90-day token TTL. See retention.Encryption
Every byte of customer data is encrypted at rest and in transit. Capsules carry a third encryption layer — a per-capsule symmetric key, sealed to the recipient — so even a compromised at-rest store does not expose unsealed PoC payloads. Signing keys move to HSM custody on the SOC 2 Type II target date.
celvexgroup.com and all subdomains. Certificate transparency monitored.celvex verify.Network architecture
The edge plane terminates customer traffic and never sees the master data store. The master plane orchestrates scans and never directly executes against customer assets. The data plane runs the actual scan, scoped to a single signed manifest, isolated per scan. See how-it-works for the customer-facing version.
Public ingress. Terminates TLS at the edge. Bot mitigation, rate limiting, WAF. No customer data at rest beyond verification-link tokens and Turnstile state.
Customer dashboard, account state, scan-schedule orchestration, billing webhooks. Issues per-scan signed scope manifests; never executes scans directly.
Per-scan ephemeral compute. Loads exactly one signed scope manifest, executes inside the safe-execution envelope, builds & signs the Proof Capsule, exits. State is purged on completion.
Customer data flows: edge → master (encrypted, authenticated). Master → data plane (signed manifest, no shared credentials). Data plane → master (signed result + Sigstore receipt). No path skips a layer.
Scope enforcement
The single most important invariant in our architecture: a scan executor cannot legally touch a host that is not on its signed scope manifest. A compromised scheduler that tries to launch out-of-scope scans gets caught at signature verification; a compromised executor that tries to fetch outside its manifest gets caught at OPA egress. Two independent layers, neither can suppress the other.
DROP, no DELETE without WHERE, no truncate, no rm -rf, no destructive HTTP verbs to write endpoints — unless the manifest's destructive-action toggle is set and the operator countersigned. Caught at the classifier and at the OPA layer.Audit
Every security-relevant event in the platform — authentication, scope grant, scan launch, capsule sign, billing transition, admin action — is written to an append-only ledger. Each row carries the SHA-256 of the previous row, so any tampering is detectable in O(N) by re-walking the chain. A second copy is replicated under S3 Object-Lock for tamper-resistance even from us.
prev_hash + row_hash (SHA-256). Daily integrity job re-walks the chain and alerts on any break.INSERT only, no UPDATE / DELETE grant. Schema migrations require a documented exception with founder approval.Vendor security questionnaire
Procurement workflows usually want a SIG, a CAIQ, or a vendor-specific spreadsheet. We've pre-filled the standard ones — most vendor-risk packets close in one round-trip with the bundle below.
Pre-filled across all 19 SIG Lite domains. Every "yes" cross-references the artifact (this page, Trust Center, MSA + DPA). Returned within one business day of request.
Pre-filled CAIQ v4 covering all 17 CCM domains. Particularly useful for cloud-procurement-driven vendor risk. Returned within one business day.
F500 procurement teams sometimes ship a bespoke spreadsheet (200–400 rows). We answer them — typical turnaround is 3–5 business days for first draft, with technical follow-up calls scheduled directly with the founder.
Standard MSA, DPA with EU SCC Module 2 attached, Section 889 / 1260H attestation, beneficial-ownership disclosure. Available as a single procurement-ready bundle.
[PLACEHOLDER: A self-serve responder portal is on the roadmap. Until it ships, the founder responds to security@ manually within one business day.]
Reporting a vulnerability
We sell offensive security; we get tested every day. The path below is the only sanctioned one — please use it before any public disclosure. Acknowledgement within 24 hours, fix-or-status update within 7 days, public credit on request, safe-harbour for good-faith research within scope.
Email security@celvexgroup.com. PGP encryption supported.
PGP key fingerprint:
[PLACEHOLDER: 4096R/XXXXXXXX — full key block published at /.well-known/security.txt when production key is generated]
Full scope, eligible classes, ineligible classes, and safe-harbour terms are documented on the Trust Center responsible-disclosure section.
The customer-facing architecture is on how-it-works. The compliance posture is on the Trust Center. The privacy contract is in the privacy policy. Anything still unclear, the founder reads every security@ email.