Security controls

CP Word List runs as a Cloudflare Worker and stores its data in Cloudflare D1. This page describes the controls that protect your Cloudpath credentials, your passphrase data, and dashboard access.

Cloudpath API credentials

Your Cloudpath API username and password are the most sensitive data the service holds. They are:

• Encrypted at rest using AES-256-GCM, with a per-tenant key derived via HKDF-SHA256 from a master secret (kept in Cloudflare’s encrypted secret store) combined with your tenant context. A database compromise alone does not expose credentials.
• Never shown back to you. Once saved, the dashboard displays “Configured (encrypted)” rather than the value.
• Decrypted only at the moment of use, for server-to-server calls to your Cloudpath server. They are never included in browser-side code or shown to end users.

Tip

Use a dedicated Cloudpath API account with the minimum permissions required, rather than a personal admin account. See Cloudpath connection settings.

Access control and sessions

• Dashboard sign-in uses Google OAuth — there’s no tenant password for the service to store. Admin console access uses passwords stored with one-way hashing (PBKDF2-SHA256); plaintext passwords are never stored or logged.
• Sessions expire after 1 hour and are set with HttpOnly, Secure, and SameSite cookies.
• Admin and tenant sessions are isolated — one cannot access the other’s routes.

Tenant isolation

• Each tenant has a unique Shared Secret and can only reach its own configuration, passphrase data, and activity logs.
• The /api/get-dpsk lookup is CORS-scoped to your Cloudpath server’s origin, so other domains can’t query your passphrase data from a browser.
• All database queries are parameterized.

Passphrase handling

• The old DPSK shown in the enrollment page’s JavaScript has already been replaced on the controller — by the time it appears in the browser it is no longer a valid credential.
• Old-to-new passphrase mappings are cached for 5 minutes only, then purged automatically.
• If a device is already connected on a DPSK, the passphrase change is blocked to avoid disrupting an active user.

Infrastructure

The service runs on Cloudflare’s global network: TLS 1.3 in transit (with hybrid post-quantum key agreement), automatic DDoS mitigation, edge compute with no origin server to expose, and data stored in Cloudflare D1. Cloudflare Access can be placed in front of administrative dashboards to enforce SSO, MFA, and device posture.

Audit trail

Every passphrase change, error, and administrative action is logged with a timestamp and enrollment ID. Tenants can review their own history on the Activity Logs page in the dashboard.

Questions about security or compliance? Contact support or email cpwordlist@neuralconfig.com.