Cremit Infrastructure Security
How the platform is designed, where the data lives, and what protects it.
Executive Summary
A security company handling customer secrets cannot let that handling become a new attack surface. Argus was designed around that constraint. This document describes what is stored where, who can read it, and what you control, as implemented, not as aspiration.
Minimal Data Retention
No source code storage; metadata only
Secret Protection
Detected secrets are masked and encrypted
Customer Control
Customer KMS integration, instant data deletion
Network Isolation
Private Subnet-based architecture
Full Encryption
All data encrypted at rest and in transit
Passwordless Authentication
Magic Link, SSO, OAuth. No password storage
1. Security First Design
Choices made at design time are hard to undo in operation. These four principles were built into the code and infrastructure up front for that reason.
Defense in Depth
We don't rely on a single security layer. Independent security controls are applied at network, application, and data levels. Even if one layer is compromised, others provide additional protection.
Principle of Least Privilege
Every system component and user is granted only the minimum privileges necessary to perform their tasks. This principle applies equally to inter-service communication.
Zero Trust Architecture
Every request is authenticated and verified, even within the internal network. We follow 'never trust, always verify' rather than 'trust but verify'.
Privacy by Design
Data minimization principles are applied from the collection stage. We don't collect data we don't need, and collected data is securely deleted after its purpose is fulfilled.
2. Infrastructure Architecture
Cloud Environment
The Cremit platform operates on Amazon Web Services (AWS) infrastructure.
Network Security Features
Complete Private Subnet Isolation
All application servers, databases, and cache servers are located in Private Subnets, making them inaccessible directly from the internet.
Single Entry Point
The only component exposed externally is the Application Load Balancer (ALB). The ALB is integrated with AWS WAF (Web Application Firewall) to filter malicious traffic.
Security Group-Based Access Control
Each service component is protected by independent Security Groups, allowing communication only through necessary ports and authorized sources.
VPC Flow Logs
All network traffic is logged for use in anomaly detection and forensic analysis.
3. Data Processing and Protection
Source Code Processing
A scan clones the repository into a temporary working directory on the worker. When the scan finishes, including when it fails partway, that directory is deleted. Source code is never written to durable storage such as a database or object store.
For GitHub, GitLab and Bitbucket: the full repository name, the commit hash, the commit message, and the line the match sits on. For Slack: the channel ID and message timestamps. We also record whether the object was public at the time. File contents are not kept.
Secret Data Processing
Detected secrets are classified as particularly sensitive data and receive multi-layer protection.
How a detected value is stored and shown
AKIAIOSFODNN7EXAMPLEAKIA************MPLEThe console only ever shows the masked value. The original is kept separately under KMS encryption, because the only way to tell whether a credential is still live is to present the real value to the service that issued it. Point Argus at your own KMS key and the decrypt permission stays with you, revoke it and Cremit cannot read the value either, and that secret drops out of verification.
Credentials that only mean anything in pairs, an AWS access key and its secret, are not a detection when only one half turns up. The half we did find is kept, encrypted under the same KMS key as any finding, so that it can be paired if the other half appears in a different source later. These fragments never appear in the console, the inventory, or an alert; only the pairing job reads them.
4. Encryption Framework
Encryption at Rest
Encryption in Transit
Key Management
5. Access Control
Passwordless Authentication
Cremit implements a passwordless architecture to eliminate password-related security risks such as credential stuffing, phishing, and password reuse attacks.
Secure one-time login link sent via email
SAML 2.0, OIDC integration with enterprise IdPs
GitHub, Google, and other OAuth providers
6. Compliance
Controls mapped to Korea's ISMS-P framework; customer audit evidence available on request.
We help customers with SOC 2, ISO 27001, and PCI DSS audit evidence for NHI-related controls.
Instant Deletion Guarantee
Deleting an organization deletes its related records at the same time; they disappear from the console and the API immediately. Automated database snapshots are retained for 14 days, so that is when the data leaves the backups as well. Deleting individual rows out of a snapshot is not technically possible.
7. Operational Security
Vulnerability Management
- Quarterly internal security audits
- Annual external penetration testing
- Security vulnerability reporting program
- Security patches applied within 72 hours
Business Continuity
- Multi-AZ deployment eliminating single points of failure
- Geographically distributed daily automated backups
- RPO 1 hour, RTO 4 hour objectives
Incident Response
Security Summary
Everything in this document describes the configuration running today. For anything you want to verify, or for audit evidence, write to security@cremit.io.
Data Minimization
No source code storage, metadata only
Secret Protection
Masking + KMS encryption (customer KMS supported)
Network Isolation
Private Subnet, only ALB externally exposed
Encryption
AES-256 at rest, TLS in transit
Authentication
Passwordless (Magic Link, SSO, OAuth)
Access Control
SSO, RBAC support
Data Sovereignty
Customer region selection, instant deletion guarantee
Compliance
ISMS-P aligned controls; audit-evidence support for customers' SOC 2, ISO 27001, PCI DSS programs
Contact
For security inquiries or additional information, please contact:
© 2025 Cremit Inc. All rights reserved. This document provides general information about Cremit's security architecture.