Security governance
Defined security responsibilities, access rules, incident handling and review procedures. Personnel and contractors with access are bound by confidentiality and access restrictions.
Trust Centre
How CyfroSec handles security, your data and AI
One place for our security practices, data lifecycle, use of AI and subprocessors. Each summary links to the legal page that carries the binding text.
- Hosting
- European by defaultPrimary hosted customer services run on European infrastructure, including AWS Europe (Frankfurt).Details
- Model training
- Not on paid customer dataPaid Subscription Customer Data is not used to train or fine-tune general-purpose or cross-customer models without separate written authorisation.Details
- Export
- Your data, portableAvailable Customer Data can be exported in formats such as CSV, JSON, API output and downloadable reports.Details
- Deletion
- 90 days after the endPaid-subscription Customer Data is scheduled for permanent deletion 90 calendar days after termination or expiry.Details
Security
Controls that protect the platform
A high-level view. Detailed contractual security measures are provided through the Data Processing Addendum, Order Form or a security review.
Access control
Role-based access control, account and tenant separation, least privilege and authentication controls.
Encryption
Encryption for relevant service communications in transit and for relevant stored information at rest.
Infrastructure and location
SaaS, customer-environment and hybrid deployments. Hosted services use European infrastructure unless another agreed European location, such as OVHcloud, is selected.
Logging and recovery
Security, audit and operational logs, protected backups and recovery controls.
Suppliers
Service providers are assessed and contractually governed according to their role and risk.
Shared responsibility
Customers protect credentials, configure least-privilege roles, control the authorised scan scope, keep appropriate backups and review remediation output before implementing it. CyfroSec findings and AI-assisted output do not replace your governance, testing, patch management or incident response.
Certifications
CyfroSec does not claim a certification, audit opinion or compliance status unless the claim is expressly stated and supported by current evidence. None is claimed here.
Data lifecycle
Who controls the data, and when it is deleted
Standard terms. A signed Order Form, customer agreement or DPA prevails where it states something different.
CyfroSec as processor
Your Customer Data
Repositories, source code, scan evidence, asset information, prompts, findings and other data processed on your behalf. You are the controller, and processing follows your agreement and the DPA.
CyfroSec as controller
Account and business information
Business contacts, billing, account administration, service security, support administration and compliance records, as described in the Privacy Policy.
After a subscription or trial ends
Paid subscription
Retrieval window
Access may be suspended
Day 90: Permanent deletion
14-day free trial
Trial data retained unless converted
Day 120: Permanent deletion
Days count from termination, expiry or trial expiry. Data removed from active systems may remain in protected backups for up to 90 days of ordinary backup ageing, subject to legal holds and mandatory retention. Temporary repository clones and workspaces are removed after processing, within 30 days at most.
AI
AI that supports your team, under your control
CyfroSec does not use Paid Subscription Customer Data to train or fine-tune its general-purpose or cross-customer models unless you give separate, express and documented written authorisation.
- Generative-AI functions use OpenAI Ireland Ltd. and its authorised subprocessors, and only for features you enable.
- Only information reasonably necessary for the request is sent. Credentials, secrets and unrelated personal data are filtered or redacted where technically feasible.
- Supported Responses API calls run with response storage disabled. API inputs and outputs are not used to train OpenAI models by default.
- Provider abuse-monitoring logs may retain inputs and outputs for up to 30 days by default.
- AI output is untrusted until reviewed. It never decides tenant scope, permissions or authorisation.
- No branch, pull request, commit or other repository change is published without the approval your workflow requires.
Subprocessors
Who helps us run the service
Whether a provider processes your Customer Personal Data depends on the services, deployment model and Order Form you select. Website providers do not process data you submit to the platform.
| Provider | Purpose | Location | Used for |
|---|---|---|---|
| Amazon Web Services | Cloud infrastructure, storage, networking, logging and backup | European Union, including AWS Europe (Frankfurt) | Platform |
| OVHcloud | Optional European hosting where selected in the Order Form | Poland or another agreed European location | Platform |
| OpenAI Ireland Ltd. | Generative-AI processing for enabled CyfroAI Insights, CyfroAssistant and CyfroCode features | Ireland for EEA customers; authorised affiliates and subprocessors elsewhere | Platform |
| Vercel Inc. | Hosting, delivery and security of the public website | EEA, United States and other delivery locations | Website |
| Metricool Software, S.L. | Website analytics and attribution, only after consent | Spain/EEA | Website |
Documents
Every policy and agreement
Security and AI
Security and TrustSecurity governance, access control, encryption, infrastructure, data location and incident reporting.Vulnerability Disclosure PolicyHow to report a suspected vulnerability, the rules for authorised research and our safe-harbour position.AI Transparency NoticeHow AI-assisted functions are used, external AI processing, human oversight and limitations.Subprocessors and Data LocationsMaterial service providers, their purposes, locations and transfer positions.
Customer agreements
Platform TermsBusiness access to CyfroSec accounts, free trials, online services, APIs and software.Acceptable Use PolicyAuthorised scope, prohibited use, credential handling and enforcement.Data Processing AddendumHow to request and execute the DPA for personal data processed on your behalf.Data Retention, Export, Switching and DeletionThe Customer Data lifecycle, retrieval periods, switching and deletion.
Privacy and website
Privacy PolicyHow we process personal data as controller and processor, and how to exercise your rights.Cookie PolicyThe cookies and similar technologies we use and how to manage your consent.Website Terms of UseThe terms for using cyfrosec.com and other public CyfroSec websites.Recruitment Privacy NoticeHow candidate personal data is processed, retained and protected.Legal NoticeCompany details, registration and contact addresses.Third-Party Software NoticesOpen-source components we deliver to your browser, with their licences.
Report an issue
Found a vulnerability? Tell us.
Send reports to safety@cyfrosec.com with the subject line “Security Vulnerability Report”. Include the affected URL or service, a description of the impact and steps to reproduce. Do not send live credentials, private keys or unnecessary personal data.
Good-faith research that follows the policy is treated as authorised. There is no bug-bounty programme.
Contacts
- Security and vulnerabilitiessafety@cyfrosec.com
- Privacy and data requestsprivacy@cyfrosec.com
- Legal and the DPAlegal@cyfrosec.com
- Supportsupport@cyfrosec.com