Security

This page is for security teams reviewing CYBER AI SECURITY LLC as a vendor. It describes how we handle client data today. We only list controls we have in place. We hold no security certifications.

1. What Client Data We Handle

• Account and contact details: company name, contact name, email, and phone for portal users and people who contact us.
• Engagement files: files you upload to the client portal, and the reports we deliver to you.
• Test configuration: target endpoints and any credentials you give us so we can test an AI system.
• Findings and logs: our findings, draft analysis, and account activity logs (sign-ins, uploads, and the IP address used).

Inventory engagements use read-only access to your environment.

2. Encryption

In transit. All traffic to our website and client portal uses HTTPS (TLS 1.2 or 1.3). Plain HTTP is redirected to HTTPS, and HSTS is enabled. Traffic passes through Cloudflare, which terminates TLS and re-encrypts traffic to our server. Calls from our platform to our AI provider and email provider use HTTPS.

At rest. The server disk is an encrypted AWS EBS volume. Backups are stored in Amazon S3 with server-side encryption, and public access to the backup bucket is blocked. On top of that, files you upload to the portal, contact email and phone fields, and test credentials are encrypted by our application with AES-256-GCM.

3. Where Data Is Hosted

The client portal runs on Amazon Web Services (AWS) in the US East (N. Virginia) region, us-east-1. Backups are stored in Amazon S3. Client data is not stored outside AWS, except as described under Subprocessors.

4. Backups

The portal database and uploaded files are backed up nightly and weekly to encrypted Amazon S3 storage. Each backup is deleted automatically within 90 days of being taken.

5. Who Can Access Client Data

CYBER AI SECURITY is a one-person firm. The founder is the only person with access to client data. There are no employees or contractors with access.

• Portal accounts: client users can see only their own engagements. Administrative access is limited to the founder's account.
• Server access: SSH uses key-based sign-in only, with password and root sign-in disabled. Network access to SSH is limited to a single approved address.
• AI tooling: the founder uses AI assistants to help with analysis and operations on our server, and those tools can read data stored there. AI-generated output is a draft. The founder reviews it before anything is delivered to a client.

6. AI Processing

We use Anthropic's Claude models through Anthropic's commercial API. We do not have a zero data retention agreement with Anthropic. Under Anthropic's published policy, API inputs and outputs are deleted within 30 days and are not used for model training. See our Privacy Policy for details.

We run automated detection to redact personal data before sending reports and chat questions to Anthropic. It does not cover every request, so engagement content you share with us may be sent to Anthropic for analysis.

Use of third-party AI on engagement data is agreed with each client during scoping. Clients can opt out, and we then do not send their engagement data to any third-party AI provider.

7. Subprocessors

• Amazon Web Services: hosting and backups
• Cloudflare: network proxy and TLS for our website and portal
• Anthropic: AI processing
• Twilio SendGrid: email delivery
• Stripe: payment processing
• Expo: push notifications for our mobile app, delivered through Apple and Google
• Google Analytics: website analytics, only if you accept cookies.
• Calendly: scheduling calls you book with us

8. Authentication and Account Security

• MFA: authenticator-app (TOTP) MFA is required for every web portal account, including the administrator account. Clients cannot turn it off. Sign-in from our mobile app also requires MFA.
• Sessions: web sessions end after 30 minutes of inactivity. Session cookies are Secure and HttpOnly.
• Lockout and rate limits: accounts lock for 15 minutes after 5 failed sign-in attempts. Sign-in and API requests are rate-limited.

9. Security Incidents

Reporting a security issue to us: email [email protected]. Our security.txt lists the same contact.

10. Questions

For security questionnaires or more detail on any item above, contact [email protected].