Trust · Security
Security at Cerium
Last updated 23 October 2026
Cerium is built for financial-services organizations, so protecting your data is foundational to everything we do. This page summarizes the practices and controls we use to keep the platform secure. It should be read alongside our Privacy Policy and Cookie Policy.
Infrastructure
Cloud hosting on AWS
The Cerium platform runs on Amazon Web Services inside isolated virtual private clouds (VPCs) distributed across multiple availability zones for resilience. AWS maintains SOC 2, ISO 27001 and HIPAA-eligible services, and we hold a Business Associate Addendum (BAA) with AWS.
Encryption
Encrypted in transit & at rest
Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256 with keys managed in AWS KMS. Backups are encrypted.
Access control
Least-privilege access
Access to the production environment follows least-privilege, role-based principles. Administrative access requires multi-factor authentication (MFA) and a strong password policy, and access is reviewed periodically.
Network security
Segmented & restricted
VPCs are segmented, security groups restrict traffic to known sources, the Kubernetes cluster control-plane endpoint is access-restricted, and VPC flow logs are enabled.
Monitoring
Logging & threat detection
We maintain centralized logging and audit trails (including API activity via AWS CloudTrail and database auditing), continuous threat detection with Amazon GuardDuty, and automated alerting on key metrics.
Resilience
Backups & recovery
Production data is backed up on an automated schedule to encrypted storage, and databases support point-in-time recovery. We maintain a documented Business Continuity and Disaster Recovery plan that is reviewed and tested.
Vulnerability management
Scanning & testing
We perform regular vulnerability scanning and patching of the environment and engage independent penetration testing. Findings are tracked to remediation based on severity.
Incident response
Prepared to respond
We maintain a documented Incident Response Plan covering detection, containment, recovery and notification. Security and privacy incidents are logged and tracked to resolution, and affected customers are notified without undue delay where their data or service is impacted.
People & policies
A documented security program
Our security practices are governed by a set of written, internally approved policies — covering access control, data protection, incident response, business continuity, vulnerability management, and acceptable use. Employees receive security awareness training, and access to systems is granted on a need-to-know basis.
Compliance
Built to meet recognized standards
Cerium is pursuing SOC 2 and aligns its controls with the SOC 2 Trust Services Criteria. Because the platform processes health-related and other sensitive data, our controls are designed to support our obligations under HIPAA and the GDPR, and we can enter into a Data Processing Agreement (DPA) with customers where required. We continue to mature our program and welcome questions from customers and prospects.
Contact
Reporting a security concern
If you believe you have found a security vulnerability, or have a question about our security practices, please contact us at support@cerium360.com. We investigate all reports and ask that you give us a reasonable opportunity to address an issue before disclosing it publicly.