Built to be trusted.
pearlblack is designed with security as an architectural property, not a perimeter add-on. This center documents how the system is built, what controls are in place, and how to report a security issue.
Claims in this center use the vocabulary: DESIGNED (architectural intent), IMPLEMENTED (in the built code), READY FOR ACTIVATION (implemented, awaiting deployment configuration), ACTIVE (enforced in the current deployment), VERIFIED (confirmed by test or review). No CERTIFIED, audited, SOC2, ISO, pen-tested, or compliance-status claims are made here - none of those exist at this stage.
Security by architecture.
Security in pearlblack is expressed as architecture: explicit trust boundaries, cryptographic identity, governed authority, and tamper-evident records are design properties of the system, not configuration added afterward.
Cryptographic assurance
Strong cryptography, key isolation, and verifiable integrity are specified in the architecture. Implementation completeness varies by component and version.
Verifiable provenance
Information and consequential actions are traceable to their origin. The lineage chain is designed to be tamper-evident.
Tamper-evident history
Append-only records with verifiable lineage form the audit foundation. Design intent; deployment verification is in progress.
Fail-closed design.
The system is designed to deny by default and fail closed. An access boundary is implemented in the Cloudflare Worker that fronts every request. The public website is intentionally public: the boundary is active for the restricted Portal surfaces, not for the public pages.
Portal access boundary
The Worker fronts every request and gates the restricted Portal routes: without authenticated authorization they never reach content. The public pages are served publicly by explicit configuration. Missing configuration causes the Portal to deny, not permit.
Individual identity
Portal identity is individual, provided by Cloudflare Access: each authorized email is verified with a single-use one-time code against an explicit allowlist, with a 24-hour personal session and per-user revocation. No shared credentials exist.
High-assurance authentication
Sensitive Portal surfaces require an independent, phishing-resistant security-key verification (WebAuthn) beyond baseline identity. The application refuses lower-assurance identity on those surfaces, and authorization is re-evaluated on every request.
Passwordless by architecture
No pearlblack-managed user passwords, no shared Portal passwords, no memorized emergency password. Emergency access uses an offline-signed, single-use, replay-defended capability verified asymmetrically; temporary authority is granted through time-bounded, revocable grants.
Your data stays yours.
Sovereignty is a core design principle. The system is built to run in environments where the operator retains full control of data, models, and infrastructure. Offline capability and CPU-first design support air-gapped and restricted deployments.
No data egress by design
The architecture does not require external API calls for core operation. Data does not leave the deployment boundary unless the operator configures it to.
CPU-first and offline-capable
Core capabilities are designed to function without continuous cloud connectivity. Suitable for restricted networks and high-security environments.
Governed by architecture.
Authority in pearlblack is explicitly modeled and enforced through the architecture. Policy is not configuration applied post-hoc - it is a first-class property of the system. Cryptographic identity and role-based authority boundaries operate together.
Governed authority model
Authority boundaries are defined in the architecture. Policy becomes executable - not enforced by convention or manual review.
Cryptographic identity
Identities are cryptographically bound. Authority assertions are verifiable, not asserted by name alone.
Audit trail
Every access and consequential action is designed to produce a verifiable, tamper-evident record. Auditability is a design property.
Infrastructure and operations.
This website is served by Cloudflare Workers Static Assets; the Worker fronts every request and enforces the Portal boundary. Content is distributed via Cloudflare's edge network. No secret material exists in the repository or the build output.
Secret-free repository
Access secrets are Cloudflare Worker secrets, never committed to the repository or present in the build output. The release controller scans for secret-like assignments on every release.
Security headers
All responses carry X-Content-Type-Options, Referrer-Policy, X-Frame-Options, and a Content Security Policy. frame-ancestors none prevents framing.
HTTPS
The site is served over HTTPS via Cloudflare; plain-HTTP requests are redirected to HTTPS at the edge.
Report a security issue.
We welcome good-faith security research. If you believe you have found a security issue in pearlblack.co or our published software, please report it to security@pearlblack.co.