Trust Center
Everything we can tell you about how the platform is secured, where your data lives, and which certifications we hold — including the ones we don't.
Frameworks we align with or are actively pursuing — see current certification status below.
Data Residency & Privacy
Stored in Canada, on servers we run ourselves.Primary Data Storage
Canada 🇨🇦
Account data, scan results and logs are stored in Toronto, Canada, on servers we own and operate. Encrypted nightly backups are also copied to Cloudflare R2, which has no fixed location; only we hold the key. Each sub-processor listed below receives only what its service needs.
Encryption at Rest
AES-256-GCM
Secrets and stored credentials are encrypted with AES-256-GCM. The encryption key is separate from the token-signing key, lives only in the server environment, and is never written to the database, the backups or the repository.
Encryption in Transit
TLS 1.3
All API and web traffic uses TLS 1.3 with perfect forward secrecy. Cipher suites are restricted to the strongest available configurations.
No Traffic Capture
Never
We never capture or store network traffic. What a scan prints — the tool's output and the findings parsed from it — is stored so you can read it and build reports, and is deleted after 90 days.
What We Keep
Data Processing Principles
Encryption in transit and at rest
TLS 1.3 with perfect forward secrecy on every connection. Secrets and stored credentials are encrypted with AES-256-GCM, under a key held separately from the token-signing key.
Isolated execution
Scans run server-side in a dedicated scan container, one process per job. The command is tokenised before any of your values are substituted, so no shell is involved, and every query is scoped to your organization.
SOC 2-aligned controls
Infrastructure designed against the SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Privacy). The Type II audit has not been completed — the framework table below says exactly where each one stands.
Append-only audit logging
Privileged actions are written to an append-only audit log, scoped to your organization and queryable from the dashboard. Logs are retained for a year.
MFA, SSO and roles
Multi-factor authentication over TOTP with single-use backup codes. SAML 2.0, OIDC and LDAP / Active Directory single sign-on on Enterprise. Role-based access control is enforced on the server, not in the UI.
Maintained toolchain
Scanner images and their vulnerability templates are rebuilt and redeployed by us. You never update a scanner, and you never patch a Kali box.
Data minimization
We store scan metadata and findings, not raw traffic. Retention is configurable, and you can export or delete your data at any time. GDPR Article 5(1)(c).
Platform monitoring
Rate limiting with cost tiers on every endpoint, statistical anomaly detection on account activity, and health watchdogs that restart a failed service without waiting for a human.
security.txt (RFC 9116)
Our security contact file, fully compliant with IETF RFC 9116. Automatically discovered by search engines and security researchers.
# CyberSec Pro Security Policy
# RFC 9116 Compliant
Contact: mailto:security@cyber-sec-pro.com
Contact: https://cyber-sec-pro.com/trust-center#responsible-disclosure
Acknowledgments: https://cyber-sec-pro.com/trust-center#acknowledgments
Policy: https://cyber-sec-pro.com/trust-center#responsible-disclosure
Hiring: https://cyber-sec-pro.com/careers
Preferred-Languages: en, tr
Canonical: https://cyber-sec-pro.com/.well-known/security.txt
Expires: 2027-07-31T23:59:59.000Z
Responsible Disclosure
1Scope
In-Scope:
- cyber-sec-pro.com and its sub-domains
- app.cyber-sec-pro.com — the SaaS platform
- api.cyber-sec-pro.com — the REST API
Out-of-Scope:
- Social engineering and phishing
- Denial of service (DoS/DDoS)
- Physical security
- Third-party services we do not operate
2Reporting Channel
Report security vulnerabilities to: security@cyber-sec-pro.com
Report template:
- Subject: [SECURITY] short description
- Affected asset: URL or endpoint
- Vulnerability type: XSS, SQLi, IDOR, …
- Steps to reproduce: 1, 2, 3 …
- Impact: data exposure, privilege escalation, …
- CVSS score (optional)
- Proof of concept or screenshots
3Response SLA
- First response: ≤ 24 hours
- Status update: ≤ 72 hours
- Fix or exception: ≤ 90 days
4Safe Harbor
- No legal action will be taken for reports complying with this policy
- Reporter's identity will be kept confidential
- Will be added to Hall of Fame after remediation
- Testing without written permission is prohibited
Compliance Frameworks
4/10 CompliantIncident response targets
Targets for how quickly we act once an incident is detected or reported to security@cyber-sec-pro.com. CyberSec Pro is run by one person, so the clock runs from 07:00 to 23:00 Toronto time, every day; a report that arrives overnight starts it at 07:00. Legal deadlines for reporting a breach run around the clock. These are targets, not contractual commitments. The procedure follows the NIST SP 800-61 phases: detect, contain, eradicate, recover, review.
| Priority | Response | Notification | Resolution |
|---|---|---|---|
| P0 — Critical | ≤ 1 hour | ≤ 4 hours | ≤ 24 hours |
| P1 — High | ≤ 4 hours | ≤ 24 hours | ≤ 72 hours |
| P2 — Medium | ≤ 24 hours | ≤ 72 hours | ≤ 7 days |
| P3 — Low | ≤ 3 days | ≤ 7 days | ≤ 30 days |
Sub-processors
Third parties that process personal data on our behalf (GDPR Art. 28). Each DPA is part of the provider's own terms, accepted with the account; we hold no separately signed copies. Gmail is the exception: it is a consumer account, and Google offers no DPA for one.
| Provider | Purpose | Location | DPA |
|---|---|---|---|
| Stripe, Inc. | Payment processing | United States (EU SCC + DPF) | ✓ In force |
| Cloudflare, Inc. | DDoS protection, WAF, CDN, TLS termination, cookieless web analytics, inbound email routing | Global edge (EU SCC + DPF) | ✓ In force |
| Brevo (Sendinblue SAS) | Transactional email, with link-click tracking | EU (EU SCC) | ✓ In force |
| Google (Gmail) | Our inbound mailbox: mail sent to our addresses | United States (EU SCC + DPF) | None |
| Cloudflare R2 | Off-site storage of encrypted database backups, each kept for 30 days | Automatic placement, no jurisdiction set (encrypted; we hold the only key) | ✓ In force |
| Google Analytics | Aggregate site usage statistics | United States (EU SCC + DPF) | ✓ In force |
Last updated: November 2026. A change to this list is published here and in the privacy policy on the day it takes effect. The latest: Brevo replaced Mailjet on 29 September 2026, after Mailjet closed our account. On 30 October 2026 the Brevo row was corrected to say that Brevo tracks link clicks, which it had done all along. On 4 November 2026 Gmail stopped relaying our outgoing mail; it remains only our inbox.
Data Processing Agreement (DPA)
Every customer can have a data processing agreement under GDPR Article 28: ask for one and we send it to you for signature. Personal data from the EU and the UK comes to us in Canada under the adequacy decisions both have made for Canada, so that transfer needs no standard contractual clauses. Our privacy policy lists each sub-processor, where it is and what it receives.
DPA Scope
- Purpose and means of processing
- Categories of personal data and of data subjects
- The list of sub-processors and how new ones are approved
- Technical and organisational measures (TOMs)
- Breach notification, without undue delay and within 72 hours
- International transfers, and the safeguard each one relies on
Data protection impact assessment
✓ Approved, November 2026In November 2026 we carried out a GDPR Article 35 data protection impact assessment of the whole service, including scans, device identification and weekly network checks. It is a self-assessment approved by our founder; no data protection officer (none is appointed or required) and no supervisory authority has reviewed it. No remaining risk was rated high. We review it every year and before any change to the personal data we process. Customers can request a copy.
Security Tests & Audits
Continuous internal security testing using our own platform and manual review. Independent third-party penetration testing is planned; summary reports will be available to Enterprise customers under NDA once completed.
Nuclei 3.11 + Wapiti 3.2, run against production
Scope: https://app.cyber-sec-pro.com — TLS, headers, CORS, misconfiguration and exposure templates, plus XSS, SQLi and open-redirect probes
Findings: 0 critical, 0 high, 0 medium, 14 informational. Wapiti: 0 vulnerabilities.
CyberSec Pro Security Team (internal)
Scope: Authentication, authorization, secrets handling, API keys, MFA, SSO and session management, across the whole repository
Findings: Several controls were found to be non-functional in production and were rebuilt; the secrets they protected were rotated. Each fix is locked in by a regression test.
Security Hall of Fame
We thank the researchers who report vulnerabilities in accordance with our responsible disclosure policy.
You could be the first researcher added to our Hall of Fame by reporting a vulnerability.
Report VulnerabilitySecurity Contact
Security: security@cyber-sec-pro.com
Legal/DPA: legal@cyber-sec-pro.com
Privacy: privacy@cyber-sec-pro.com
Trust Center last updated: September 2026 · Policy version: 2.2.0 · Next review: March 2027