Your infrastructure.
Your security
controls.
Cerpent is deployed on-premise. Your data never reaches our servers. This is not a feature — it is the architecture.
The security boundary is yours.
Most SaaS GRC tools ask you to send your risk data, control evidence, and audit records to their cloud. Then they ask you to trust their security posture. For a bank or insurer, that is not an acceptable trade.
Cerpent is deployed inside your perimeter — whether that is an on-premise data center, a private cloud, or a hybrid environment. We write the software. You run it. The data never leaves.
Your data center or private cloud
Cerpent runs wherever you run your regulated workloads. No external network connectivity required for core operations.
You own the encryption keys
Data at rest and in transit is encrypted. Key management stays inside your HSM or KMS. Cerpent never holds your keys.
You control access
Integrate with your existing IAM, LDAP, or SSO. Cerpent does not manage user credentials or authentication.
You own the audit log
Every action generates an append-only, tamper-evident log entry — stored in your infrastructure, queryable by your auditors.
Our security responsibilities.
We can't secure your infrastructure — that's the point. But we are rigorous about the code we ship and the practices we follow. Below is the full scope of what Cerpent owns.
Secure software development
- Code review required on all production changes
- Dependency vulnerability scanning in CI/CD pipeline
- Static analysis and SAST tooling on every build
- Secrets never committed to version control
Penetration testing
- Customer-initiated pen tests of their deployment supported and encouraged
- No-scope limitations on customer-run tests within their own environment
Audit-grade data handling
- Append-only event log — no record can be deleted or modified
- Full lineage on every data point: who created it, when, from what source
- AI outputs carry confidence scores and derivation metadata
- Schema versioning ensures data integrity across upgrades
Access control architecture
- Role-based access control (RBAC) with fine-grained permissions
- Integration with LDAP, Active Directory, SAML 2.0, and OIDC
- MFA enforcement configurable at deployment level
- Session management and idle timeout policies customer-controlled
Network architecture
- No required inbound internet connectivity for core platform
- All inter-service communication over mTLS within the deployment
- Optional air-gapped deployment for highest-sensitivity environments
- Outbound telemetry is opt-in and customer-controlled
Vulnerability disclosure
- Responsible disclosure program — report to [email protected]
- Acknowledgement within 2 business days
- Critical vulnerabilities patched within 30 days of confirmed report
- CVE coordination for vulnerabilities in Cerpent-owned components
Built for regulated environments.
Because Cerpent runs in your environment, your existing controls — network segmentation, DLP, SIEM, endpoint protection, backup policies — apply to the platform automatically. There is no new vendor to assess for data sovereignty.
DORA (EU) 2022/2554
Art. 30Requires financial entities to maintain operational resilience and retain control over critical ICT assets. Cerpent installs inside your own infrastructure, so your ICT risk, incident and third-party data stays under your own governance. It supports your ICT risk management, incident handling and third-party oversight under DORA.
UAE Information Assurance Regulation
Sets information assurance requirements for UAE government and critical entities. Cerpent runs in your environment, so you keep control of where data sits and who can access it.
Basel Committee — Operational Resilience
BIS 2021 §15Requires critical systems to be within the direct control of the regulated entity. Cerpent is not a third-party processor — it is software running in your environment.
What we own.
What you own.
On-premise means a clear division. No ambiguity about where responsibility lies. Regulators want you to control your risk tooling, not outsource it.
Cerpent is responsible forSecurity questions or reports.
If you have discovered a vulnerability in Cerpent, please disclose it responsibly. We acknowledge all reports within 2 business days and share our remediation timeline. For security architecture questions during a procurement or vendor assessment, reach out directly.
Report a vulnerability
Acknowledged within 2 business days
Security assessment inquiries
For procurement and vendor questionnaires