Security and data handling
Where program images, debug information, trace and results are processed, what leaves the customer environment, and how components are updated.
Program images, debug information, trace streams, coverage results and requirements can reveal sensitive product behavior.
Deployment modes
For each product, the deployment description identifies whether acquisition, reconstruction, analysis and reporting run on CEDARbox, on a customer-managed host, in a customer-managed server environment or in an external service. “On premises” is not used as a blanket description if any operational data or telemetry leave that boundary.
| Product | Acquisition | Reconstruction / analysis | Reporting | External service involved |
|---|---|---|---|---|
| CEDARbox + CEDARtools.Coverage | CEDARbox (customer premises) | CEDARbox FPGA + customer-managed host | customer-managed host | none in the measurement path |
| CEDARtools.SmartTrace | target MCDS via probe path | customer-managed host | customer-managed host | none in the measurement path |
| CEDARtools.Stream / StreamX (in development) | device (customer premises) | live processing in the device/host | customer-managed host | none in the measurement path |
| CEDARtools.TraceEncoder | RTL in the customer’s SoC | customer toolchain | customer toolchain | none - source delivery |
| CEDARtools.Forge | customer environment | per engagement: local or named model provider | customer environment | model provider per agreement (see below) |
Program images, debug information and trace streams are processed on the customer side in all measurement products; they are not uploaded to Accemic services as part of normal operation. Support cases that require sharing such artifacts use an agreed transfer channel (see contact).
Data inventory
For each product, the delivery documentation includes a data inventory: whether it processes or stores raw trace, reconstructed addresses, executable images, debug information, source paths, coverage databases, timing observations, requirements, prompts or generated code - and for each artifact, the default location, retention period, export path and deletion control. These inventories are provided with the product for review, not published on this website.
Network and telemetry
The delivery documentation identifies required outbound connections, license checks, update services, crash reporting and optional telemetry. A configuration with no external communication should be identifiable and testable.
Updates and vulnerability handling
Product updates are authenticated and versioned. The supported-version policy, security-update period, vulnerability-reporting contact and process for communicating relevant third-party vulnerabilities are provided with the product documentation of the applicable delivery.
CEDARtools.Forge and model providers
For Forge*, the engagement identifies which data are sent to each model provider, whether provider retention is disabled, whether customer data are used for training, which local deployment modes exist and which secrets or repositories the agent can access. The fields that a pilot agreement fixes before any project artifact moves are listed under data and execution boundary on the CEDARtools.Forge page.
Customer responsibility
The customer remains responsible for classifying its artifacts, configuring access controls and deciding which data may be processed in each deployment mode. Accemic provides the technical information needed for that decision.
Related: CEDARbox · CEDARtools.Forge · contact