Security is the product. Here's how we prove it.
Everything below reflects how Cyrion itself is built, operated and audited, the same rigor we apply when testing your environment.
Certifications
& frameworks.
SOC 2 Type II
Control objectives covering security, availability and confidentiality; formal audit underway.
ISO 27001
Information security management practices aligned to the ISO 27001 control set.
GDPR
EU data-subject rights, lawful basis and DPA terms available for every customer.
CREST
Our methodology is reviewed against CREST-approved penetration testing standards.
Need a copy of a report or attestation under NDA? Request one from our security team →
How we handle
your data.
We rely on a small set of vetted infrastructure, database, and AI model sub-processors to operate the Service. Each is selected for its security posture and bound by a data processing agreement; none are permitted to train on your scan data. Full sub-processor details are available in our Privacy Policy or on request.
- All findings, scan telemetry and report artifacts are encrypted in transit (TLS 1.2+) and at rest (AES-256).
- Customer data is logically scoped per-tenant; no cross-customer data sharing, ever.
- Production-touching probes are rate-limited, tagged, and can be restricted to non-prod surfaces with a single policy flag.
- Retention defaults to 12 months of finding history, configurable per contract.
- Access to raw scan data is limited to on-call engineering and audited quarterly.
Privacy
& terms.
Our privacy policy covers what we collect on this site (contact and newsletter form submissions), how long we retain it, and your rights as a data subject. Our terms of service govern authorized testing scope, liability and disclosure timelines for any Cyrion engagement.
Read the full Privacy Policy and Terms of Service. A signed DPA is available during onboarding, or on request.
Responsible
disclosure.
Found a vulnerability in Cyrion's own platform? We ask that you report it privately and give us 90 days to remediate before any public disclosure. We do not pursue legal action against good-faith researchers who follow this policy.
Report to security@cyrion.ai. PGP key available on request.
Our engagement
charter.
Every Cyrion engagement runs under a signed scope agreement defining authorized targets, testing windows and escalation contacts. Exploit candidates are validated in an isolated sandbox before anything is reported or, with explicit customer opt-in, safely demonstrated in production. We stop immediately on request and never retain access beyond the contracted engagement window.
Have a security or compliance question we didn't cover?
Our security team responds within one business day.