Security controls
CP Word List runs as a Cloudflare Worker and stores its data in Cloudflare D1. This page describes the controls that protect your Cloudpath credentials, your passphrase data, and dashboard access.
Cloudpath API credentials
Section titled “Cloudpath API credentials”Your Cloudpath API username and password are the most sensitive data the service holds. They are:
- Encrypted at rest using AES-256-GCM, with a per-tenant key derived via HKDF-SHA256 from a master secret (kept in Cloudflare’s encrypted secret store) combined with your tenant context. A database compromise alone does not expose credentials.
- Never shown back to you. Once saved, the dashboard displays “Configured (encrypted)” rather than the value.
- Decrypted only at the moment of use, for server-to-server calls to your Cloudpath server. They are never included in browser-side code or shown to end users.
Access control and sessions
Section titled “Access control and sessions”- Dashboard sign-in uses Google OAuth — there’s no tenant password for the service to store. Admin console access uses passwords stored with one-way hashing (PBKDF2-SHA256); plaintext passwords are never stored or logged.
- Sessions expire after 1 hour and are set with
HttpOnly,Secure, andSameSitecookies. - Admin and tenant sessions are isolated — one cannot access the other’s routes.
Tenant isolation
Section titled “Tenant isolation”- Each tenant has a unique Shared Secret and can only reach its own configuration, passphrase data, and activity logs.
- The
/api/get-dpsklookup is CORS-scoped to your Cloudpath server’s origin, so other domains can’t query your passphrase data from a browser. - All database queries are parameterized.
Passphrase handling
Section titled “Passphrase handling”- The old DPSK shown in the enrollment page’s JavaScript has already been replaced on the controller — by the time it appears in the browser it is no longer a valid credential.
- Old-to-new passphrase mappings are cached for 5 minutes only, then purged automatically. A scheduled job sweeps expired rows every 5 minutes, so nothing lingers waiting to be read.
- Activity logs never contain passphrases. A log entry records the event type, the enrollment ID, and an error reason — not the credential.
- If a device is already connected on a DPSK, the passphrase change is blocked to avoid disrupting an active user.
What the service stores, and for how long
Section titled “What the service stores, and for how long”| Data | Retention |
|---|---|
| Cloudpath FQDN, API credentials (encrypted), SSID name | Until you change or delete them |
| Tenant ID and Shared Secret | Until you regenerate the secret |
| Old-to-new passphrase mappings | 5 minutes, then purged automatically |
| Activity log entries (event, enrollment ID, error reason, timestamp) | Retained for your audit trail |
| Terms acceptance records (version, timestamp, IP address, browser user agent) | Retained as the record of consent |
| Sign-in sessions | 1 hour |
| Pending sign-ups awaiting terms acceptance | 10 minutes, then discarded |
| Feedback you submit (message, optional name, IP address) | Retained until reviewed |
Nothing here leaves Cloudflare’s network, and the service never sees or stores an end user’s device details.
Outbound calls
Section titled “Outbound calls”The service only ever contacts your Cloudpath server at the FQDN saved on your account. There is no public endpoint that accepts a hostname or URL from a caller, so the service cannot be used to reach an arbitrary destination. Test Connection runs from your signed-in dashboard session, and it is disabled entirely while an account is pending review.
Infrastructure
Section titled “Infrastructure”The service runs on Cloudflare’s global network: TLS 1.3 in transit (with hybrid post-quantum key agreement), automatic DDoS mitigation, edge compute with no origin server to expose, and data stored in Cloudflare D1. Cloudflare Access can be placed in front of administrative dashboards to enforce SSO, MFA, and device posture.
Audit trail
Section titled “Audit trail”Every passphrase change, error, and administrative action is logged with a timestamp and enrollment ID. Tenants can review their own history on the Activity Logs page in the dashboard.
Next steps
Section titled “Next steps”- Passphrase format and strength — how much entropy a generated passphrase carries.
- Cloudpath connection settings — the credentials this page describes, and how to rotate the Shared Secret.
- HTTP API reference — the endpoints exposed and what authenticates each one.
Questions about security or compliance? Contact
support or email cpwordlist@neuralconfig.com.