Built to fail closed — and to never fake "active".
You're trusting DelegatedSSL with the certificates on your clients' domains. Here's exactly how that trust is enforced — in the database, at the edge, and on every request.
Tenant isolation by design
Every row of every table is guarded by Postgres row-level security scoped to your organization. Isolation is enforced in the database, not just in application code.
Hashed secrets, shown once
API keys and webhook secrets are stored only as SHA-256 hashes. The plaintext is returned exactly once at creation — we can't recover it, and neither can anyone else.
No private-key custody
Certificate keys never leave Cloudflare's edge. DelegatedSSL orchestrates issuance and reads status; it never holds or exports key material.
Auth0-backed identity
Access is authenticated with Auth0 (JWT + JWKS), with issuer and audience validated on every request against the DelegatedSSL API audience.
Durable, global rate limits
A Cloudflare Durable Object meters public verification and API traffic so abuse is contained consistently worldwide, with Retry-After and rate-limit headers.
Full audit trail
Domain creation, delegation checks, key rotation, webhook changes — every privileged action is written to an immutable, org-scoped audit log.
At a glance
The stack behind the padlock.
DelegatedSSL runs on Cloudflare Workers with a Postgres datastore reached only through row-level-security-scoped access. Certificate issuance rides Cloudflare for SaaS; identity rides Auth0. No part of the design requires us to hold a private key or a plaintext secret.
Request a security review- Certificate authority
- Cloudflare for SaaS (DV)
- Validation method
- Delegated DCV · TXT
- Identity
- Auth0 (JWT / JWKS)
- Data isolation
- Postgres row-level security
- Transport
- HSTS · TLS 1.2+
- Secret storage
- SHA-256, never plaintext
Responsible disclosure
Found something? We want to hear from you before anyone else does. Email security@delegatedssl.com with details and reproduction steps, or see our security.txt. We acknowledge reports quickly and will keep you updated through remediation. Please give us a reasonable window to fix an issue before any public disclosure.