Don't trust the report. Re-check it.
Drop a CyberTwin proof file into the verifier and your own browser recomputes the hash chain and re-runs the reachability check. We can't see what you check. Nothing is taken on faith.
You export a config and send it. The engine never reaches into your network.
The bundle is hashed and signed with an Ed25519 key — tamper it and the check fails.
The verifier runs client-side. We never see what you re-check, and nothing uploads.
SCHEMATIC — HASHES SHOWN ARE ILLUSTRATIVE
VERIFY A REAL PROOF BUNDLE →Most security tools ask you to install an agent and hand over standing access. CyberTwin asks for a file. That difference is the whole posture — there is nothing of ours inside your walls, and no live blast radius to worry about.
Nothing to install
No agent, no sensor, no long-lived credential sitting inside your network. There is nothing of ours running on your machines to compromise, patch, or trust.
You hand us the file
We never reach into your environment. You export a config — a firewall rule set, a cloud snapshot, an identity dump — and upload it. The engine reasons over the file you chose to send. Nothing is scanned, probed, or connected live.
No standing access to your network
CyberTwin is upload-based: nothing of ours connects into your network, and no review needs a key of yours. We hold a credential only if you choose to link one: a ticketing tool (Jira or ServiceNow) so findings open tickets there. It is stored encrypted, used only for that purpose, and deleted when you write to support@cybertwin.io. Each review starts from a file you chose to hand over, and secrets in it are redacted in memory before anything is written to disk, unless you explicitly opt out for a configuration review.
The short version. The full Privacy Policy and Data Processing Agreement are linked at the bottom of this page — this is the plain-language summary of what we take, how long we hold it, and what stays yours.
What we collect
Account details, the environment data you upload, and operational logs. Marketing pages report conversion events (which button was used, no identity) to our own server. PostHog analytics and the LinkedIn Insight Tag load on marketing pages only after you click Accept in the cookie banner; Decline is one click, and Global Privacy Control is honoured. The signed-in app sets session cookies only.
How long we keep it
While your account is active. After cancellation the account is read-only for 90 days so you can export, then retained a further 90 days for re-activation before deletion — 180 days total. Audit logs are kept 12 months; billing records as tax law requires. These deletions are handled manually today, not by an automatic job. What we send our AI subprocessor, Anthropic, is deleted on its side within 30 days by default; the subprocessor list below has the exceptions.
Your rights
Access, correction, deletion, and portability on request — email privacy@cybertwin.io and we respond within 30 days. You own the artifacts the engine produces.
Data residency
Need your data to live in a specific region? Region-pinned residency is available on Enterprise — contact us to scope it for your organisation.
The technical measures protecting customer data, in plain language. Every one is live in production today — present tense, no roadmap promises.
Encryption, in transit and at rest
TLS 1.2 or higher everywhere with HSTS preload. Data encrypted at rest.
Authentication
Customer sign-in runs on Clerk, so we store no customer passwords. SAML single sign-on for Enterprise is being built on Clerk’s enterprise connections and is not available yet. Our internal admin console uses its own password (the default is refused in production) and, in production, always asks for a one-time code from an authenticator app (TOTP); an operator without one is sent to set it up before anything opens, and it cannot be switched off. Console sessions are held on the server, end after 12 hours (or 2 hours unused), and can be signed out remotely.
Tenant isolation
Every query is scoped to the customer's organisation. Cross-tenant boundaries are enforced in code and covered by a dedicated isolation test suite.
Audit log
A timestamped record of the changes that matter — uploads and reviews, environment changes, share links and API tokens — available in-product to your org admins and exportable as CSV. Not every action writes a record yet; we add them as we go.
Secrets management and dependency scanning
Secrets live in Fly's managed secret store and reach the app only at runtime — never in source. Every push to the repository runs a leaked-credential scan (gitleaks) and a dependency vulnerability scan of the lockfile (OSV-Scanner) in CI; once a week, CI audits production dependencies (npm audit, failing on high or critical advisories), and Dependabot proposes dependency updates weekly.
Read-only by design
CyberTwin has no live access to your environment. Your review runs from a dated, scoped configuration snapshot you upload — there are no standing connectors and no agents in your systems.
Our security program is built to map onto the criteria customers ask about — so your diligence lands on familiar ground.
SOC 2
ReadinessSOC 2 readiness underway; no auditor engaged yet. There is no SOC 2 report today.
GDPR / UK-GDPR
DPAA Data Processing Agreement, a public subprocessor list, self-serve data export, and deletion on request (run by hand today).
ISO 27001
Not certifiedNot certified, and no certification body is engaged. Some of our practices borrow from the ISO 27001 control set.
Secure SDLC
PracticeOWASP-guided development, a leaked-credential scan and a dependency vulnerability scan on every push, and least-privilege access throughout.
NONE OF THESE IS A CERTIFICATION. WE HOLD NO SOC 2 REPORT AND NO ISO 27001 CERTIFICATE TODAY.
Every third party that processes customer data on our behalf, and exactly what each one touches. We notify customers in writing before adding a subprocessor.
| Subprocessor | Purpose | Data accessed |
|---|---|---|
| Fly.io | Application hosting, compute, and the persistent volume holding the database. The sole processor of customer data at rest. | All account, environment, finding, and audit-log data; uploaded documents |
| Anthropic | AI analysis via the Claude API — report narrative, intake follow-up questions, document and diagram analysis, copilot question compilation, and optional configuration-review commentary | Profile metadata (industry, size, region, frameworks, budget ceiling) and structured engine output; the free-text intake answers and copilot questions you type; the text, tables and images of documents you choose to upload for document analysis or diagram extraction; and, if you switch on AI commentary for a configuration review, a digest of its findings (check id, severity, title, config section) rather than the configuration file itself. Under Anthropic’s Commercial Terms, Anthropic does not train models on customer content sent through the API. Anthropic’s published policy is to delete API inputs and outputs within 30 days of receipt or generation, keeping them longer only if a request is flagged under its Usage Policy (up to 2 years) or the law requires it. Shorter retention, down to none, needs a separate agreement with Anthropic; we do not have one today. |
| Clerk | Authentication and session management (SAML single sign-on for Enterprise is not available yet) | Auth identifiers (email, hashed password, MFA factors) |
| Polar | Payment processing and subscription billing (merchant of record — Polar takes the payment and handles VAT; card details never touch CyberTwin) | Billing identity (name, email, company), payment method, subscription and invoice records |
| Resend | Transactional email | Recipient email addresses, message content |
| Sentry | Error monitoring | Error message, stack trace and request metadata (route, record ids), scrubbed in our code before the send: email addresses, bearer/API tokens and secret-looking values are redacted; user, org and session identifiers are replaced with short one-way hashes; any field named like a raw upload, config, document or text body is dropped; every string is truncated. |
| PostHog | Marketing-site product analytics (EU Cloud) | Marketing-page behaviour only. Loaded on public pages exclusively — never inside the authenticated product, so no environment, finding, or exposure data reaches it. |
| Ad conversion measurement and audience building (Insight Tag) | Marketing-page visit signals for ad attribution. Public pages only — the tag never loads inside the authenticated product. |
Found a vulnerability?
Email security@cybertwin.io. We acknowledge within 24 hours and aim to triage within 72. Our public security.txt lives at /.well-known/security.txt. Please give us a chance to fix an issue before you publish it.
Acknowledgments. With your permission, we credit researchers who report a valid issue here. No one is listed yet.
Request the security pack
Email us and we'll send the DPA, the subprocessor list, our encryption-in-transit certificate, and an infrastructure architecture overview. Typical turnaround: same business day.