Security & Trust

Security that audits itself.

Cyfriq is an enterprise security platform. We hold ourselves to the same — and a stricter — bar than we ask of our customers. This page documents how.

Certifications & frameworks

Independently audited. Continuously verified.

SOC 2Type IIAnnual audit · current report on request
ISO / IEC27001:2022Information-security management system
DPDPAct 2023Built-in control mapping & evidence
ISO 27701AlignedPrivacy information management
HIPAABAA-readyHealthcare customer deployments
GDPRArticle 28DPA for EU data controllers
CERT-InAligned6-hour breach-notification workflow
STQCAssessedFor Government of India deployments
Architecture

How your data is protected at every layer.

ENCRYPTION
AES-256 at rest · TLS 1.3 in transit

All customer data is encrypted at rest with AES-256 using a dedicated KMS key per tenant. In transit, everything uses TLS 1.3 with forward secrecy.

ISOLATION
Per-tenant key hierarchy

Cross-tenant access is cryptographically impossible. Each tenant's root key lives in AWS KMS, used only to decrypt that tenant's per-record data keys.

RESIDENCY
AWS India — ap-south-1

Customer data is stored in Mumbai by default. US-East and EU-West regions are available on request. Data never traverses regions without explicit customer action.

AUTHENTICATION
MFA everywhere · FIDO2 ready

Every Cyfriq employee authenticates with phishing-resistant FIDO2 hardware tokens. Your workload API calls require rotating, least-privilege credentials.

AUDIT
Immutable WORM logs

Every control-plane action is sealed to a tamper-proof log. Retained up to 5 years. Replayable by your auditors on request.

RESILIENCE
Multi-AZ active-active

Deployed across three availability zones. Agent enforcement continues offline via local policy cache for up to 14 days.

Operational controls

The practices behind the platform.

Access

Least privilege by default

Every Cyfriq employee starts with zero access. Access to customer tenants is time-bounded, ticket-justified and logged. No customer data access outside an open support ticket.

Change

Peer-reviewed, auto-tested

No code reaches production without peer review, automated security tests (SAST, SCA, secrets detection) and a documented rollback plan. Infrastructure defined as code and reviewed the same way.

Vulnerability

Continuous scanning

Every build runs dependency scanning, static analysis and container scanning. External penetration tests quarterly by independent firms. Public bug bounty with responsible-disclosure policy.

Personnel

Background-checked & trained

Every employee and contractor is background-verified before access. Annual security awareness training mandatory; phishing simulations run monthly.

Business continuity

Tested, documented, measured

RPO 15 minutes · RTO 1 hour. Full disaster-recovery exercise executed twice a year against a restored, isolated environment. Results published to customers on request.

Incident response

Defined, rehearsed, communicated

24×7 on-call rotation. Severity-based response SLAs. Status page updates within 15 minutes of SEV1 detection. Root-cause analysis published within 5 business days.

Sub-processors

Every vendor that touches your data.

Customers are notified at least 30 days before any sub-processor is added or changed.

Sub-processorPurposeLocationCertifications
Amazon Web Services (India)Primary infrastructure hosting & KMSMumbai (ap-south-1)SOC 1/2/3, ISO 27001/17/18, PCI, STAR
CloudflareDNS, WAF, DDoS mitigation, edge TLSGlobal edge · India PoPsSOC 2, ISO 27001, PCI
DatadogObservability & internal operational telemetryUS · with data residency controlsSOC 2, ISO 27001, HIPAA
ZendeskCustomer support ticketing & communicationGlobal · EU/USSOC 2, ISO 27001
StripeBilling & payment processing (card only)GlobalPCI-DSS Level 1, SOC 2
HubSpotSales CRM (prospect metadata only)US · EUSOC 2, ISO 27001

Sub-processor list is current as of this page's last revision. Customers may subscribe to sub-processor change notifications in the Cyfriq admin portal.

Data Processing Agreement

A DPA built for DPDP & GDPR.

Every enterprise customer signs a Data Processing Agreement aligned to the DPDP Act 2023, GDPR Article 28, and industry best practices. Available for redline review before signature.

  • Purpose limitation — processing only per customer instruction
  • Breach notification — within 6 hours of confirmed incident
  • Sub-processor disclosure — advance notification of changes
  • Audit rights — annual independent audit evidence shared
  • Data return & deletion — exportable on termination, cryptographically erased 30 days after
Read the full DPA →
INCIDENT RESPONSE
How we respond.

T + 0:15 · SEV1 public status-page update
T + 1:00 · Customer notifications sent
T + 6:00 · DPA-mandated breach notification
T + 24:00 · Interim impact assessment
T + 72:00 · Full RCA delivered
T + 5 days · Public post-mortem published

Public status page with 90-day uptime history: status.cyfriq.com

Responsible disclosure

Found something? Please tell us.

We operate a public vulnerability disclosure programme with a safe-harbour policy. Bounties for qualifying reports. Encrypted reporting via email or HackerOne. First acknowledgement within 24 hours.