Security

An app is visible to the people its managers named: one person, a team, or everyone in the company. That rule is checked where the data is read, not in a list of paths, so a page cannot ship unprotected by being forgotten.

Apps are reached through Cira’s own proxy. A request without a valid session never reaches your app at all.

Cira is a conduit, not a vault. The values of your environment variables pass through on their way to Google and are never written to Cira’s database or its logs; Cira keeps their names and a fingerprint so a page can say what is set. Credentials Cira issues - CLI tokens, invitations, device codes - are stored only as hashes.

Cira reaches Google with short-lived tokens from workload identity federation. There is no downloadable service-account key.

An assistant acts as the person using it and gets exactly their permissions. Anything that changes data stops and waits for that person to agree. Every run is recorded - who, what, from where, and how it ended - and never what it was called with or what came back.

Metadata: names, addresses, which operations exist, deploy history, and what ran. Not your apps’ own data - a database Cira makes for an app is that app’s alone, a separate Neon project with its own password, and Cira keeps no copy of the address. Ask Cira’s conversations live in the browser tab that holds them, and only what a question cost is kept.

Cira’s own error reports are stripped of request bodies, cookies, queries and headers before they leave.

Every company’s apps run in one Google project, isolated by Cloud Run’s own boundaries rather than by separate projects. SAML and SCIM are not built. Cira has not been through a SOC 2 audit or an external penetration test. All three are planned, and none of them is true today.