Legal
Security and Trust
Last updated: 7 September 2026
Security is central to the design and operation of CyfroSec. This page provides a high-level overview. Detailed contractual security measures are provided through the applicable Data Processing Addendum, Order Form or security review and may be subject to confidentiality restrictions.
Security governance
CyfroSec maintains security responsibilities, access rules, incident-handling processes and review procedures appropriate to the nature and risk of the services. Personnel and contractors with authorised access are subject to confidentiality and access restrictions.
Access control
CyfroSec uses role-based access control, account and tenant separation, least-privilege principles and authentication controls. Customers are responsible for selecting account administrators, approving users, assigning appropriate roles and promptly removing unnecessary access.
Encryption and communications
CyfroSec uses encryption for relevant service communications in transit and for relevant stored information at rest. Customer-deployed components communicate with CyfroSec services through documented and secured interfaces appropriate to the deployment.
Infrastructure and data location
CyfroSec supports SaaS, customer-environment/on-premises and hybrid deployments as stated in the applicable Order Form. Primary hosted customer services use European infrastructure, including AWS Europe (Frankfurt), unless another location such as an agreed OVHcloud European deployment is selected.
Logging, monitoring and recovery
CyfroSec maintains relevant security, audit and operational logs, protected backups and recovery controls. Retention and deletion are described in the Data Retention, Export, Switching and Deletion Notice.
Secure customer operation
Customers must protect credentials, configure least-privilege roles, control authorised scan scope, maintain appropriate backups and review remediation output before implementation. CyfroSec findings and AI-assisted output do not replace customer governance, testing, patch management or incident response.
Suppliers and subprocessors
CyfroSec assesses and contractually governs service providers according to their role and risk. Material providers and data locations are listed at https://www.cyfrosec.com/subprocessors/.
Incident and vulnerability reporting
Suspected security incidents or vulnerabilities affecting CyfroSec should be reported to safety@cyfrosec.com. Do not include unnecessary personal data or secrets in an initial report. Our Vulnerability Disclosure Policy is available at https://www.cyfrosec.com/security/vulnerability-disclosure/.
Platform status is available at https://status.cyfrosec.com/.
CyfroSec does not claim a certification, audit opinion or compliance status on this page unless the claim is expressly stated and supported by current evidence.