Trust Center
Everything we can tell you about how the platform is secured, where your data lives, and which certifications we hold — including the ones we don't.
Frameworks we align with or are actively pursuing — see current certification status below.
Data Residency & Privacy
Your data stays in Canada. Always.Primary Data Storage
Canada 🇨🇦
All customer data, scan results, and logs are stored exclusively in Canadian data centers. No data leaves Canadian jurisdiction without explicit customer consent.
Encryption at Rest
AES-256-GCM
Secrets and stored credentials are encrypted with AES-256-GCM. The encryption key is separate from the token-signing key, lives only in the server environment, and is never written to the database, the backups or the repository.
Encryption in Transit
TLS 1.3
All API and web traffic uses TLS 1.3 with perfect forward secrecy. Cipher suites are restricted to the strongest available configurations.
No Raw Traffic Logging
Zero-Knowledge
We do not log, store, or process raw network traffic or scan payloads. Only metadata (timestamps, target IPs, tool types, severity counts) is retained for operational purposes.
Our No-Logging Commitment
Data Processing Principles
Encryption in transit and at rest
TLS 1.3 with perfect forward secrecy on every connection. Secrets and stored credentials are encrypted with AES-256-GCM, under a key held separately from the token-signing key.
Isolated execution
Scans run server-side in a dedicated scan container, one process per job. The command is tokenised before any of your values are substituted, so no shell is involved, and every query is scoped to your organization.
SOC 2-aligned controls
Infrastructure designed against the SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Privacy). The Type II audit has not been completed — the framework table below says exactly where each one stands.
Append-only audit logging
Privileged actions are written to an append-only audit log, scoped to your organization and queryable from the dashboard. Logs are retained for a year.
MFA, SSO and roles
Multi-factor authentication over TOTP with single-use backup codes. SAML 2.0, OIDC and LDAP / Active Directory single sign-on on Enterprise. Role-based access control is enforced on the server, not in the UI.
Maintained toolchain
Scanner images and their vulnerability templates are rebuilt and redeployed by us. You never update a scanner, and you never patch a Kali box.
Data minimization
We store scan metadata and findings, not raw traffic. Retention is configurable, and you can export or delete your data at any time. GDPR Article 5(1)(c).
Platform monitoring
Rate limiting with cost tiers on every endpoint, statistical anomaly detection on account activity, and health watchdogs that restart a failed service without waiting for a human.
security.txt (RFC 9116)
Our security contact file, fully compliant with IETF RFC 9116. Automatically discovered by search engines and security researchers.
# CyberSec Pro Security Policy
# RFC 9116 Compliant
Contact: mailto:security@cyber-sec-pro.com
Contact: https://cyber-sec-pro.com/trust-center#responsible-disclosure
Acknowledgments: https://cyber-sec-pro.com/trust-center#acknowledgments
Policy: https://cyber-sec-pro.com/trust-center#responsible-disclosure
Hiring: https://cyber-sec-pro.com/careers
Preferred-Languages: en, tr
Canonical: https://cyber-sec-pro.com/.well-known/security.txt
Expires: 2027-07-31T23:59:59.000Z
Responsible Disclosure & Bug Bounty
1Scope
In-Scope:
- cyber-sec-pro.com and its sub-domains
- app.cyber-sec-pro.com — the SaaS platform
- api.cyber-sec-pro.com — the REST API
Out-of-Scope:
- Social engineering and phishing
- Denial of service (DoS/DDoS)
- Physical security
- Third-party services we do not operate
2Reporting Channel
Report security vulnerabilities to: security@cyber-sec-pro.com
Report template:
- Subject: [SECURITY] short description
- Affected asset: URL or endpoint
- Vulnerability type: XSS, SQLi, IDOR, …
- Steps to reproduce: 1, 2, 3 …
- Impact: data exposure, privilege escalation, …
- CVSS score (optional)
- Proof of concept or screenshots
3Response SLA
- First response: ≤ 24 hours
- Status update: ≤ 72 hours
- Fix or exception: ≤ 90 days
4Safe Harbor
- No legal action will be taken for reports complying with this policy
- Reporter's identity will be kept confidential
- Will be added to Hall of Fame after remediation
- Testing without written permission is prohibited
Compliance Frameworks
4/10 CompliantIncident Response SLA
Our incident response procedures compliant with ISO 27035 and NIST SP 800-61 Rev.2:
| Priority | Detection | Response | Notification | Resolution |
|---|---|---|---|---|
| P0 — Critical | ≤ 15 min | ≤ 30 min | ≤ 1 hour | ≤ 4 hours |
| P1 — High | ≤ 30 min | ≤ 1 hour | ≤ 4 hours | ≤ 24 hours |
| P2 — Medium | ≤ 1 hour | ≤ 4 hours | ≤ 24 hours | ≤ 72 hours |
| P3 — Low | ≤ 4 hours | ≤ 24 hours | ≤ 72 hours | ≤ 30 days |
Sub-processors
Third-party providers processing data under GDPR Article 28(2). All sub-processors have signed a DPA (Data Processing Agreement).
| Provider | Purpose | Location | DPA |
|---|---|---|---|
| Stripe, Inc. | Payment processing | United States (EU SCC + DPF) | ✓ Signed |
| Cloudflare, Inc. | DDoS protection, WAF, CDN, TLS termination | Global edge (EU SCC + DPF) | ✓ Signed |
| Mailjet | Transactional email | EU (EU SCC) | ✓ Signed |
| Google (Gmail SMTP) | Transactional email (fallback relay) | United States (EU SCC + DPF) | ✓ Signed |
| Cloudflare R2 | Off-site storage of encrypted database backups | Automatic placement, no jurisdiction set (encrypted; we hold the only key) | ✓ Signed |
Last updated: September 2026. We give 30 days notice before a sub-processor changes.
Data Processing Agreement (DPA)
We provide a Data Processing Agreement (DPA) for all customers under GDPR Article 28. The DPA includes EU Standard Contractual Clauses (EU SCC 2021) and UK IDTA.
DPA Scope
- Purpose and means of processing
- Categories of personal data and of data subjects
- The list of sub-processors and how new ones are approved
- Technical and organisational measures (TOMs)
- Breach notification, without undue delay and within 72 hours
- Transfer mechanisms (EU standard contractual clauses)
Data protection impact assessment
Not yet carried outWe have not completed a GDPR Article 35 DPIA, and we will not claim one we do not hold. Our processing is limited to account data, billing metadata and the scan results you generate against targets you own; we have not assessed it as large-scale processing of special-category data. If your own assessment requires a DPIA from us, write to the DPO address below and we will tell you honestly where we are.
Security Tests & Audits
Continuous internal security testing using our own platform and manual review. Independent third-party penetration testing is planned; summary reports will be available to Enterprise customers under NDA once completed.
Nuclei 3.11 + Wapiti 3.2, run against production
Scope: https://app.cyber-sec-pro.com — TLS, headers, CORS, misconfiguration and exposure templates, plus XSS, SQLi and open-redirect probes
Findings: 0 critical, 0 high, 0 medium, 31 informational. Wapiti: 0 vulnerabilities.
CyberSec Pro Security Team (internal)
Scope: Authentication, authorization, secrets handling, API keys, MFA, SSO and session management, across the whole repository
Findings: Several controls were found to be non-functional in production and were rebuilt; the secrets they protected were rotated. Each fix is locked in by a regression test.
Security Hall of Fame
We thank the researchers who report vulnerabilities in accordance with our responsible disclosure policy.
You could be the first researcher added to our Hall of Fame by reporting a vulnerability.
Report VulnerabilitySecurity Contact
Security: security@cyber-sec-pro.com
Legal/DPA: legal@cyber-sec-pro.com
Privacy: privacy@cyber-sec-pro.com
Trust Center last updated: September 2026 · Policy version: 2.2.0 · Next review: March 2027