Security at Cerul

Identity and browser security

• Web sessions use Secure, HttpOnly, host-only cookies.
• Browser JavaScript cannot read session credentials.
• Administrative views fail closed and depend on server-issued scopes.

Cloud processing and third parties

Text embedding sends bounded transcript text and search queries to the configured provider. Visual understanding and semantic annotation can send sampled frames, short video segments and task instructions to the configured model provider, including Google Gemini. OCR processing depends on the selected configuration.

Uploading a video uses short-lived signed URLs for a direct transfer to private object storage. Signing into Cerul does not upload your local library. A cloud upload or remote processing operation requires your action.

Deleting content and credentials

Video and artifact deletion returns a deletion record. queued or running means the operation is still in progress; succeeded confirms completion; failed requires follow-up. Use the record's status URL to check the outcome.

Deleting an API Key prevents subsequent authentication with that key and removes it from the manageable key list. It does not delete source media, historical calls, or billing records. Account and privacy requests can be sent to support@cerul.ai.

Report a vulnerability

Please send security reports to security@cerul.ai. Include reproduction steps and potential impact, and avoid accessing data that is not yours.