Last updated: March 2026
CesaFlow is built with security as a core principle. This page explains how we handle your data, protect your credentials, and what controls are available to you.
Your API keys are encrypted at rest with AES-256. CesaFlow calls providers on your behalf — we never resell or mark up tokens.
Generated code and AI model responses are not retained after your run completes. Workspaces are ephemeral unless you use named projects.
All data in transit is encrypted via TLS 1.2+. Cloudflare provides edge security, DDoS protection, and WAF.
When you start a run, here is exactly how your data flows:
┌─────────────┐ HTTPS/TLS ┌──────────────────┐
│ Your App │ ──────────────────▶ │ CesaFlow API │
│ (Browser, │ │ (api.cesaflow.ai)│
│ IDE, CLI) │ └────────┬─────────┘
└─────────────┘ │
│ Your encrypted API key
│ is decrypted in memory
│ (never logged, never stored
│ in plaintext)
│
┌──────────────┴──────────────┐
│ │
┌─────▼─────┐ ┌──────▼──────┐
│ AI │ │ AI │
│ Provider │ │ Provider │
│ (OpenAI) │ │ (Anthropic)│
└───────────┘ └─────────────┘
Key points:
• CesaFlow backend proxies AI calls using YOUR key
• Your key is AES-256 encrypted at rest in PostgreSQL
• Keys are decrypted only in memory during request execution
• We do NOT store prompts or model responses after run completion
• Token usage (count only, not content) is logged for billing| Layer | Method | Details |
|---|---|---|
| Data in transit | TLS 1.2+ | Cloudflare edge + origin SSL |
| API keys at rest | AES-256-GCM | Encrypted in PostgreSQL, decrypted only in memory |
| Passwords | bcrypt | Salted hash, never stored in plaintext |
| Session tokens | JWT + Redis | Short-lived tokens with server-side validation |
| Webhook signatures | HMAC-SHA256 | GitHub webhook verification |
| Data Type | Retention | Notes |
|---|---|---|
| Generated code (workspace) | Run duration | Deleted after download/completion unless project_id is used |
| AI model responses | Not retained | Streamed to client, not stored server-side |
| Run metadata | Account lifetime | Objective, status, timestamps, token counts (not content) |
| Project workspaces | Until project deleted | Persistent workspaces for named projects |
| API keys (yours) | Until revoked | AES-256 encrypted at rest |
| Audit logs | 90 days | Admin actions, auth events |
Each organization is fully isolated — runs, projects, keys, and team members are scoped to a single org. No cross-org data access.
Team members can be assigned Admin or Developer roles. Admins can manage billing, keys, and team settings. Developers can create and view runs.
All API calls require a valid API key (x-api-key header). Keys are scoped to a single organization.
The admin panel (Nexus) uses separate session-based authentication with Redis-backed tokens (8-hour TTL).
unshare-based sandboxing available for enhanced isolation.CesaFlow is committed to meeting enterprise security standards. Here is our current status and roadmap:
| Standard | Status | Timeline |
|---|---|---|
| AES-256 encryption at rest | Active | Implemented |
| TLS 1.2+ in transit | Active | Implemented |
| Role-based access control | Active | Implemented |
| Audit logging | Active | Implemented |
| Self-hosted deployment | Available | Enterprise plan |
| SSO (SAML/OIDC) | Planned | Q2 2026 |
| SOC 2 Type II | Planned | Q3 2026 |
| Penetration testing | Planned | Q2 2026 |
| GDPR compliance | In progress | Q2 2026 |
| Regional data residency | Roadmap | Q4 2026 |
To report a security vulnerability or request our security documentation for procurement, contact us at [email protected].