01Security model
CellGuard is an independent, deterministic validator for spreadsheet edits to financial models. It sits between an AI assistant and your model and returns a block / flag / pass verdict on a tamper-evident audit record. Its security properties follow directly from what it is, and from what it deliberately is not:
- It never runs a language model. Every verdict is produced by fixed, versioned rules, so identical inputs always yield an identical verdict. There is no prompt, no inference and no model in the verification path.
- It never trains on your data. There is no learning step. Any per-client rules are written and version-pinned by humans, never inferred from your content.
- No egress in the verification path. Verifying an edit or a workbook makes no outbound network call and no call to any AI provider (such as Anthropic, OpenAI, Google or Microsoft). Outside the verification path, the system makes only a few operational calls that never carry your model data: delivering the access-request notification email (Brevo's HTTPS API, with an SMTP relay as fallback) and, when OAuth is delegated to an external authorization server, fetching that server's metadata and signing keys.
- Independent by design. The assistant that proposes an edit is operated by you, under your own terms with that provider. CellGuard checks the proposed edit; it does not generate it.
Because no model runs inside verification, much of the data-exposure surface that AI tools carry is simply not present.
02Data protection
We apply technical and organisational measures appropriate to the risk. The measures below are present in the service as deployed:
- Encrypted transport. All traffic is served over TLS / HTTPS.
- Authentication. The MCP service supports OAuth 2.1 (RFC 9728 protected-resource metadata, RFC 8414 authorisation-server metadata, RFC 7591 dynamic client registration, with PKCE / S256) and/or a bearer API key.
- Fail-closed. If authentication is required but not configured, the service refuses to serve and returns
503rather than falling open. - Constant-time comparison. Secrets are compared with a constant-time function (
hmac.compare_digest) to resist timing attacks. - Cryptographically-random identifiers. Session and other identifiers are generated with cryptographically secure randomness (
secrets/uuid4) and are unguessable. - Rate limiting. Per-IP and per-key token-bucket rate limiting throttles abuse.
- Origin allowlist. Browser-facing endpoints enforce a strict
Originallowlist.
session_id, not by per-user identity. We do not present this as a multi-tenant access-control boundary: organisations that need strict per-tenant isolation should use a dedicated deployment or self-host.03Data handling & retention
What we process, and what we keep
- Edits (
verify_ops). Proposed values and any context you pass are processed in memory to compute a verdict and are never stored. - Workbooks (full-file checks). An uploaded workbook sits in an in-memory or Redis artifact store with a 1-hour sliding time-to-live (refreshed on access), then is evicted and deleted. It is processed transiently to produce a verdict. No cell values are persisted.
- Audit log. The record is SHA‑256 hash-chained and tamper-evident. Each entry stores an
ops_digest(a one-way hash of the edits) plus metadata: timestamp, decision, provenance, reason, counts and versions. It does not store cell values. - Security logs. Client IP is processed for security and rate-limiting, retained for a short period.
ops_digest and metadata only — never cell values. Self-hosted deployments set their own retention and control the storage.Retention summary
- Submitted workbooks & edits: 1-hour sliding TTL, then deleted; edit-level checks are processed in memory and never stored.
- Audit log: durably retained for 24 months (configurable), then purged; digests and metadata only, never cell values.
- Access-request / lead data: up to 24 months after last contact, or sooner on request.
- Account data: for the life of the account, then deleted save records we must keep by law.
- Security logs (incl. IP): a short period (typically 30–90 days).
We minimise by default: digests rather than values, and no analytics, advertising or tracking cookies. See our Privacy Policy for the full data-protection detail.
04Hosting & sub-processors
The managed service and the celldelta.ai website run on a small, fixed set of vendors, under data-processing terms. The principal sub-processors are:
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Railway Corporation | Cloud hosting, compute and ephemeral storage for the managed service and MCP server. | United States | EU‑US Data Privacy Framework (certified) and/or EU Standard Contractual Clauses. |
| Cloudflare, Inc. | CDN, edge and DNS proxy (processes visitor IP for delivery, security and rate-limiting). | United States | EU Standard Contractual Clauses, and the EU‑US Data Privacy Framework where the recipient is certified. |
| Brevo (Sendinblue) | Transactional email / SMTP relay for the access-request notification and account email. | European Union | Processed in the EU; for any US leg, Sendinblue Inc. is covered by the EU‑US Data Privacy Framework and SCCs. |
The EU‑US Data Privacy Framework remains valid: the EU General Court upheld it on 3 September 2025 in Latombe (T‑553/23); a CJEU appeal is pending.
The full list, including our source-code host and business mailbox provider, with purposes and transfer safeguards, is on our Sub-processors page. Self-hosted deployments use no sub-processors for customer content. No AI or model-hosting provider acts as our sub-processor, because verification runs no model.
05Data residency
The managed service is currently hosted in the United States (Railway), with Cloudflare at the edge. Submitting the website access form, or using the managed service, therefore involves a transfer outside the European Economic Area, made under the safeguards described above (DPF certification and/or SCCs).
We do not offer EU data residency as a default on the managed service today. EU-region and on-premises deployment are available for self-hosted and enterprise customers: in a self-hosted deployment your workbooks, edits, verdicts and audit records stay within your own perimeter and never reach us. If EU or in-region residency is a requirement, contact us about a self-hosted or enterprise deployment.
06Governance & compliance posture
CellDelta is operated by an EU-established controller (Krzysztof Dalewski, sole proprietor trading as CellDelta, Warsaw, Poland). Our posture:
- GDPR-aligned. We process on documented legal bases, minimise data, honour data-subject rights and make a Data Processing Agreement available. No special-category (Article 9) data is processed.
- Controller / processor split. On the managed service we act as processor for customer workbook content (the customer is the controller) under a DPA; for website and account data where we set the purpose, we are the controller.
- International transfers. Transfers outside the EEA rely on the EU‑US Data Privacy Framework where the provider is certified, and/or EU Standard Contractual Clauses.
- CSA STAR (CAIQ). We have completed a Cloud Security Alliance CAIQ v4 self-assessment (CSA STAR Level 1, self-assessment). This is a self-attestation, not a third-party certification.
- DPA available. A Data Processing Agreement, and copies of the relevant transfer safeguards, are available on request.
07Responsible disclosure
We welcome reports from security researchers and treat good-faith disclosure as a contribution, not a threat. This policy is aligned with ISO/IEC 29147 (vulnerability disclosure) and ISO/IEC 30111 (vulnerability handling). Alignment is not certification.
Scope
mcp.celldelta.ai— the CellGuard MCP service.celldelta.ai— the marketing website and its endpoints.
Safe harbour
If you make a good-faith effort to comply with this policy during your research, we will consider your activity authorised, we will not pursue or support legal action against you for it, and we will work with you to understand and resolve the issue. Good faith means: you stay within the scope above; you avoid privacy violations, data destruction, and any degradation of the service; and you give us a reasonable opportunity to remediate before disclosing publicly.
How to report
Email [email protected] with enough detail to reproduce the issue (affected URL or endpoint, steps, and impact). Please do not include customer workbook content or other personal data in your report; a redacted proof of concept is sufficient. We run no paid bug-bounty program.
Out of scope
- Denial-of-service, volumetric or load testing, and any automated scanning that degrades the service.
- Social engineering, phishing, or physical attacks against CellDelta, our staff or our vendors.
- Reports about third-party services we use (for example the hosting, edge or email providers) — please report those to the provider; we will assist where we can.
- Findings with no realistic security impact, such as missing best-practice headers without a demonstrated exploit, software-version banners, or self-XSS.
- Spam, rate-limit or email-deliverability configuration issues without a concrete security impact.
A machine-readable contact is published at /.well-known/security.txt (RFC 9116).
08Contact
Security reports: [email protected]. Everything else, including a DPA or a copy of a transfer safeguard: [email protected].
Krzysztof Dalewski (CellDelta)
ul. Capri 4/18, 02‑762 Warsaw, Poland
NIP 5214160761 · REGON 544460460
[email protected]
You can also contact the Polish supervisory authority — Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00‑193 Warsaw, uodo.gov.pl.