Русская версия

LiveCEO × Cloudflare — Client-Side Critical Data

Three verified architectures for the sweet spot: the client's critical data rests on the client's side · our IP (prompts, curation pipeline, agent harness) never leaves ours.
10-agent research workflow · 17 load-bearing claims adversarially verified against live Cloudflare / Anthropic documentation · 2026-08-04

OPTION 1 — PRIVATE DATA POD · zero client data at rest on our side · 4–6 wks MVP

The wiki + raw dumps live in a signed container on the customer's own machine (server, VPC, or a laptop during a pitch). It dials out via Cloudflare Tunnel — no inbound port ever opens on their firewall. Our agent's Read/Grep/Glob become authenticated RPCs; ripgrep runs inside the pod, so only result snippets transit. Kill the pod after the demo — nothing of theirs remains with us.

outbound-only :7844 RPC + svc token snippets only — never the corpus CUSTOMER SIDE their server · VPC · or a laptop during the pitch DATA POD vendor-signed container — deliberately dumb pod-agent RPC read · grep · glob — ripgrep + path containment WIKI CORPUS + raw/ ~2,400 md files — 100% of data at rest is HERE cloudflared outbound-only tunnel — zero inbound ports ✓ delete the pod → nothing remains anywhere on our side ⚠ pre-flight: strict egress firewalls may block port 7844 (verified) CLOUDFLARE SOC 2 Type II — all plans named tunnel / tenant Access: Service Auth virtual network / tenant audit log: every RPC (metadata only — verified) LIVECEO SIDE — Hetzner zero client data at rest · IP stays here AGENT — gVisor sandbox no wiki mount · RAM only · mcp__pod__read/grep/glob CURATION (IP) wikiCurate.ts · prompts never ships to customer NEON PG chats only* *zero-trace toggle later EGRESS PROXY allowlist: anthropic + pod host per tenant BACKUPS pod orgs excluded ANTHROPIC API SOC 2 I+II · ISO 27001/42001 · ZDR available (Sonnet 5 ✓) FLOW: agent asks → Cloudflare Access authenticates → tunnel → pod greps its own disk → snippets return → agent reasons in RAM → answer cited. Data transits (RAM, Anthropic) but never rests on the vendor side. Verified: Access logs carry metadata only; tools must be renamed mcp__pod__* (SDK namespacing).

OPTION 2 — BYOK ON NEUTRAL GROUND · ciphertext on our disk, key in THEIR Cloudflare account · 3–4 wks

Cheapest option, touches no agent code. Everything we store becomes AES-256-GCM ciphertext under a per-org key wrapped by a tiny key-service Worker in the customer's own Cloudflare account (one-click "Deploy to Cloudflare" — verified browser-only). The KEK sits in Workers Secrets — verified write-only: readable by no one after it's set. Customer revokes → every copy we hold, including backups, is permanently unreadable: crypto-shredding.

wrap DEK (build) unwrap session DEK — audited on THEIR side CUSTOMER'S OWN CLOUDFLARE ACCOUNT free tier · one-click deploy · no servers, no CLI (verified) KEY-SERVICE WORKER generic AES wrap/unwrap — no LiveCEO IP inside WORKERS SECRETS — master KEK write-only: no dashboard / API read-back (verified) ACCESS — SERVICE AUTH only our runtime can call · THEIR audit log of every unwrap ⏻ REVOKE KEY = crypto-shred everything we hold LIVECEO SIDE — Hetzner + Neon stores ciphertext only · agent code untouched BUILD-WIKI PIPELINE (IP, stays here) honest caveat: curation processes plaintext in RAM ENCRYPT — AES-256-GCM envelope last step before persist · key-service failure ⇒ hard fail (no-fallback doctrine — never silent plaintext) CIPHERTEXT AT REST — everywhere Neon wiki_pages/graph · /srv/liveceo/wikis mirror backup vault (free upgrade) · optional R2 + SSE-C AGENT SESSION session DEK → decrypt to tmpfs RAM only, gone on stop · gVisor ANTHROPIC API transient · ZDR available Revocation honesty (verified): future sessions + all at-rest copies die instantly; an already-running session keeps its tmpfs until teardown. Build the kill switch on service-token deletion — mTLS cert revocation is NOT automatic (refuted claim). Only quantified CF propagation figure: 20–30 s.

OPTION 3 — LICENSED RUNNER, REMOTE BRAIN · full on-prem that stays paid · 7–9 wks

Everything — data, chat history, transcripts, inference egress — on the customer's infrastructure. The box is inert without our control plane: prompts, curation playbooks, and connector manifests are streamed per-run into RAM (never their disk), usage meters back, and a lapsed license degrades then stops the product. Replicated-pattern precedent (verified). Solves "on-prem gives the product away": you don't sell the box, you rent the brain.

heartbeat prompts streamed → RAM only, per run inference — our key or THEIRS (BYO-key, zero code change) CUSTOMER INFRASTRUCTURE — licensed container fleet all client data at rest here · shipped image = low-IP scaffolding only APP (licensed image) Next.js + ingester + Caddy AGENT — gVisor prompt held in RAM · never fs.writeFile THEIR POSTGRES wiki · chats · transcripts · datasets — zero schema change LICENSE SIDECAR heartbeat → short-TTL signed lease grace → soft-degrade → stop no lease = box goes inert WIKI DISK + BACKUPS their storage or R2 + SSE-C (their key) ⚠ honest: root can memory-dump prompts — protection is contract + metering + watermarked prompts + kill switch, not cryptography (TEE: not a Cloudflare capability — probed) CLOUDFLARE Tunnel + Access Service Auth / tenant logs: metadata only (bodies never — verified) LIVECEO CONTROL PLANE RUNTIME BUNDLE system prompt · playbooks connector manifests THE IP — never at rest there LICENSE + METERING per-tenant token · revoke one = kill one (Replicated pattern) BILLING / USAGE aggregate counts only — never chat content ANTHROPIC API under THEIR agreement if BYO-key Composio Enterprise "run on your own cloud" exists (verified) — the connector-OAuth layer can also move under customer control.

DECISION MATRIX

1 · Private Data Pod2 · BYOK Neutral Ground3 · Licensed Runner
Client data at rest, our sidenoneciphertext onlynone (incl. chats + transcripts)
Client data in our RAMtransient, per answertransient + ingestionnever (runs on their box)
Anthropic legour key · ZDR availableour key · ZDR availableour key or theirs (BYO-key)
IP exposurenone new — pod is dumbnone newprompts extractable by root (contractual protection)
Privacy pitch★★★★ + killer live demo★★★★★★★★
Monetization safetyfull (SaaS)full (SaaS)license lease + kill switch
Effort4–6 wks MVP · 8–10 prod3–4 wks7–9 wks
New failure modespod offline · port 7844 blockedtheir CF account breaks ⇒ hard failclient ops burden · dunning UX
Cloudflare cost~$0 → Enterprise near 50 tenants~$0$0–50 / tenant

ADVERSARIAL VERIFICATION — 17 CLAIMS vs LIVE DOCS

8 CONFIRMED

  • • Workers Secrets are write-only after set
  • • Deploy-button = no-CLI customer setup
  • • Access logs carry metadata only, never bodies
  • • Service tokens don't consume paid seats
  • • Tunnel/Access/VNet primitives all real (no official combined example — we integrate)
  • • No official tunnel-latency figure exists → benchmark before quoting SLA

6 REFUTED — designs corrected

  • • cloudflared does NOT "just work" on strict corporate networks (port 7844, TLS inspection) → pre-flight check at demos
  • • mTLS revocation is not automatic → kill switch = token deletion
  • • SDK can't override Read/Grep/Glob names → mcp__pod__* + prompt rewrite
  • • Good news ×2: prod model = Sonnet 5 (not a Covered Model) → ZDR available; Composio Enterprise runs on customer cloud

3 UNVERIFIED — test in pilot

  • • Exact revocation-propagation window (only 20–30 s figure is for session tokens)
  • • Service tokens on Access Free plan (no gating language found either way)
  • • "R2 never logs the SSE-C key" — no affirmative doc statement → envelope encryption stays the primary layer

RECOMMENDATION — ONE PRODUCT, THREE RESIDENCY TIERS

NOW — ship Option 2 (3–4 wks)

  • • Smallest change, zero agent-code impact
  • • Sales answer upgrades to "ciphertext under your key, revocable from your own dashboard"
  • • Backups become ciphertext for free
  • • + 1 day: request Anthropic ZDR agreement (available for Sonnet 5 — verified)

NEXT — Option 1 flagship tier

  • • "Private Data Plane" premium tier
  • • The pitch weapon: pod on their laptop, real answers, delete it live
  • • Before first pitch: latency benchmark + port-7844 pre-flight + hotspot fallback

LATER — Option 3 for whales

  • • Full residency incl. chat + transcripts
  • • Sales-motion product, priced accordingly
  • • BYO-Anthropic-key: zero code change (same secret-file path)

ОТВЕТ ДЛЯ ПИТЧА (RU)

Мы разделяем продукт на «данные» и «мозг». Данные компании — вики, переписки, транскрипты — остаются в контуре клиента: либо физически на его машине («под» + Cloudflare Tunnel, исходящее соединение, ни одного открытого порта), либо у нас, но зашифрованные ключом, который лежит только в Cloudflare-аккаунте клиента — отозвал ключ, и все наши копии, включая бэкапы, навсегда нечитаемы. «Мозг» — промпты и пайплайн курирования — никогда не покидает нашу сторону. Честно: в момент ответа данные транзитом проходят через нашу память и API Anthropic (SOC 2, соглашение о нулевом хранении), но не сохраняются нигде. И это можно показать вживую: под запускается на ноутбуке клиента, отвечает по реальным данным, а потом удаляется у него на глазах — у нас не остаётся ни байта.

frontend / app compute / agent data store Cloudflare / customer boundary security / IP / keys external (Anthropic)