Security & Data Protection

What We Protect

Cyberity only collects evidence necessary for compliance. Nothing more.

We Collect

Backup verification results
Server health metrics
Configuration snapshots
Security logs & alerts
Compliance check results
Audit trails & timestamps

We Never Collect

Passwords or credentials
User personal data (PII)
Email content
File contents
Customer data
Anything not needed for proof

We Never Share

Data with third parties
Data with advertisers
Data with other customers
Data with government (unless required by law)
Data without your consent
Unencrypted data over the internet

How Your Data Flows

Local collection → Encrypted transmission → Secure storage.

The Three-Layer Architecture

Layer 1: Local Agent (Your Infrastructure)

Our lightweight agent runs on your servers. It reads logs, checks configs, verifies backups. Data never leaves your network until encrypted. You can audit the agent code. You control what it collects.

Layer 2: Encrypted Transport (Your Network → Cloud)

Data is encrypted with AES-256 before leaving your infrastructure. TLS 1.3 for transport. Keys never leave your control. You can require IP whitelisting. You can audit the transport logs.

Layer 3: Secure Storage — Your Choice of Cloud

Encrypted evidence is stored on a reputable, SOC 2 Type II certified provider — choose managed storage on our platform, or bring your own AWS, Azure, Google Cloud, or Cloudflare account so data stays in your control. Encryption at rest (AES-256). Zero-knowledge architecture — we don't have access to your decrypted data. You can request data deletion anytime.

Encryption & Security Standards

Enterprise-grade security, not optional.

What's Encrypted

Data at Rest: AES-256 encryption on all stored data
Data in Transit: TLS 1.3 for all network communication
Evidence Ledger: Hash-chained with Ed25519 signatures for tamper-proof proof
Backups: Encrypted at source before any transmission
Audit Logs: Immutable, encrypted, timestamped for compliance

Compliance & Certifications

Cyberity is built for compliance. We use the same security standards required by ISO 27001, SOC2, PDPA, and other frameworks we help you prove.

✓ SOC2 Type II — Annual audit of our security controls
✓ ISO 27001 — Information security management system certified
✓ GDPR/PDPA Compliant — Data processing agreements available
✓ No Vendor Lock-In — Your data can be exported anytime

Common Questions

Real questions IT managers ask. Real answers.

❓ "What if there's a security breach?"

We notify you within 48 hours. You have access to our SOC 2 audit reports showing our controls. Your data sits on tier-1 providers (AWS, Azure, Google Cloud or Cloudflare) with 99.99%+ uptime and 24/7 monitoring. Encrypted data is unreadable even if breached. Our insurance covers data protection liability.

❓ "Will the agent slow down our systems?"

Less than 2% CPU overhead. The agent runs lightweight read-only queries. No data modification. Scheduled collection (default: hourly). You control the collection schedule. Can be paused anytime.

❓ "Can we audit your code?"

Yes. Independent security audits available. We provide source code review for enterprise contracts. You can verify encryption implementation. Agent logs show exactly what data was collected.

❓ "What about data residency?"

You choose your provider and region. Store evidence with AWS, Azure, Google Cloud or Cloudflare, in the region you need (EU, US, APAC, etc.) — or in your own cloud account. Complies with local data-protection laws; covered in our agreements.

❓ "Can we delete our data?"

Anytime. No questions asked. Request deletion, we delete all encrypted data within 30 days. Your evidence ledger can be exported before deletion. Full compliance with GDPR/PDPA deletion rights.

❓ "Where is my data stored?"

On the reputable cloud you choose. Managed storage runs on SOC 2 Type II certified infrastructure, or bring your own AWS, Azure, or Google Cloud account so backups and evidence never leave your control. Either way it's encrypted, and yours to export or delete anytime.