Security

Cephron is an authenticated operational platform. Public legal and compliance pages are separate from the authenticated console used by organizations and their authorized users.

This page summarizes the active security posture of the live Cephron platform in restrained terms intended for external review. It focuses on the controls that are actually represented in the current runtime.

Access to system data is restricted through authenticated sessions, role-based application logic, and database-level enforcement mechanisms.

• Authenticated users access the console through sessions managed by Cephron's authentication provider.
• Passwords are handled by Cephron's authentication provider. Cephron does not store plaintext passwords.
• Application routing, landing pages, and page access use role-based access controls.
• Sessions are linked to store context, and active session state also carries organization context where available.
• Operational SMS consent pages are public only for the intended tokenized workflow and do not expose authenticated console data.
• Organizations are responsible for provisioning and removing their own authorized users.

All application data is logically isolated by store and organization boundaries using row-level security policies enforced at the database layer.

• Operational records are associated with stores, and stores can be associated with organizations.
• The active security boundary for most operational data remains store scope.
• Public SMS consent records and delivery logs are tied back to store-scoped contact records.
• Public legal pages are intentionally separate from authenticated workflow records.

• Cephron uses row-level security in its managed database for exposed operational tables.
• Store-scoped access controls are part of the database access model for operational records.
• Authenticated clients use publishable browser credentials, while privileged database operations remain server-side.
• Privileged SMS and administrative actions are not performed directly from the public browser client.

SMS delivery is performed through secure third-party infrastructure providers. Cephron does not expose messaging infrastructure directly to end users.

Consent is required prior to any SMS being sent. Contacts begin in a pending state and are not eligible to receive messages until explicit opt-in is completed.

• HTTPS is used for browser, API, and public-page traffic in production deployments.
• Transport encryption is used for communication between browsers, servers, and infrastructure providers.
• Cephron currently supports toll-free operational SMS notifications through trusted messaging providers.
• Public opt-in and opt-out pages are tokenized and limited to a specific consent action.
• Messaging records are written back to Cephron for auditability and operational troubleshooting.

Mobile phone numbers and SMS consent data are used solely for delivering operational messages.

Cephron does not sell, rent, or share mobile numbers or SMS consent with third parties or affiliates for marketing or promotional purposes.

• Privileged secrets such as service-role and messaging provider credentials are kept in secure deployment environment variables.
• Administrative access is limited to support, maintenance, incident response, and controlled operational tasks.
• Cephron does not rely on client-side storage of privileged credentials.
• Administrative review is intended to support service operation, incident response, and compliance review rather than unrelated monitoring.

• Workflow activity is recorded through operational event history.
• SMS consent changes and message delivery events are logged for auditability.
• System diagnostics and error monitoring tools may be used when the active environment is configured for them.
• Secure cloud infrastructure supports storage protections at rest.
• These records support troubleshooting, incident review, and reviewer verification of the consent workflow.

Cephron uses vetted service providers to host, secure, monitor, and deliver the platform.

Additional subprocessor information may be provided to customers during contracting or security review. Contact contact@cephron.com for service-provider inquiries.

Privacy, terms, and cookie disclosures are maintained on the Privacy Policy, Terms of Service, and Cookie Policy.

• Investigate, contain, and resolve security or operational incidents.
• Review relevant workflow, consent, message, and system telemetry as part of incident handling.
• Notify affected organizations when Cephron determines notice is appropriate under the circumstances.

contact@cephron.com

Cephron LLC