Security, privacy and what the AI can reach.
How Cyril handles security, tenant isolation and the AI layer’s access to your data, including the commitments that are not yet in force.
- SOC 2 Type 1Type 2 follows six months after Type 1
- Preparing for first audit
- GDPRAccess, erasure, rectification, portability
- Built for GDPR
- Data Processing AgreementPublished for evaluation
- Draft, pending counsel review
- Model training on your dataProviders’ published API terms; no signed DPA yet
- Not used
- Primary data residenceHostinger, Lithuania and the Netherlands
- EU, no Australian region
- Uptime commitmentPre-launch, per the Terms of Service
- No SLA yet
- Bug bountyPublic credit, no legal action
- Recognition only
The AI works inside your permissions.
Cyril’s AI answers as the individual user, not as the organisation. Search retrieval is filtered by the same ownership, role and workspace permissions as the interface, and each agent step is checked against the asker’s role on the server. That is enforced in code, not given to the model as an instruction it could be argued around.
Two invoices are overdue, 55,867.00 in total.
I can’t show invoices. Your role doesn’t include Finance, so none were retrieved.
More controls on the AI layer.
Because the AI reads your business records to be useful, we hold it to the same access rules as the rest of the platform, and are explicit about what leaves our infrastructure.
- Enforcement is tested, not asserted
- Automated cross-role isolation tests run in CI on changes to the API and must pass before code merges. AI retrieval through Ask Cyril is recorded to an internal access log.
- Identifiers are masked in prompts
- Before a chat prompt reaches a model provider, structured direct identifiers (email addresses, phone numbers, IP addresses, national insurance and social-security numbers, IBANs and card numbers) are replaced with reversible tokens, then restored in the response you see. Identifiers in free-form prose, such as a name written mid-sentence, are not tokenised, and text sent to OpenAI to build search embeddings is not masked.
- You can turn external AI off
- An organisation admin can disable external-LLM processing for their tenant entirely. The switch is enforced at the single point every AI call passes through, and refuses the call before any request body is built, not at the interface layer.
- A no-egress option is planned
- For organisations that cannot send data to a third-party model at all, we plan to offer self-hosted inference with no public-provider fallback: a request would either reach the private endpoint or fail. It is not available to customers yet.
- Tenant isolation applies to AI too
- Every AI and retrieval query is scoped to a single organisation. Two organisations never share retrieval results, and never share a cached prompt prefix with a model provider.
What is still in progress.
- Countersigned DPAs with each model providerNot yet in force
- Zero Data Retention terms with model providersNot yet in force
We would rather tell you this than let you assume it. Two commitments are not yet in force: countersigned data-processing agreements with each model provider under our operating entity, and Zero Data Retention terms that remove the short abuse-monitoring window during which a provider may hold a request.
Until both are in place, providers are used under their standard published terms, our customer DPA is offered as a draft rather than a counsel-approved agreement, and we make no contractual retention claim beyond what those published terms give us. Organisations that need a guarantee sooner can use the tenant AI switch above.
Model training. We use Anthropic and OpenAI through their commercial API tiers, which under those providers’ published terms are not used to train their models. The consumer-chat training behaviour people are usually thinking of does not apply to API traffic.
The engineering controls above come from an internal AI trust posture audit, including the gaps we found and what we did about each one. It is available on request from security@getcyril.com.
A record of every agent run.
Ask Cyril shows its plan and waits for your approval. Each step is checked against your permissions on the server before it runs, and every run is recorded: the plan, who approved it and what each step did. There is no one-click undo for an agent run yet.
| Time | Step | Approved by | Checked against | Result |
|---|---|---|---|---|
| Reminder sent: Kestrel invoice overdue since ThursdayFinance, 4 recipients | CDClaire Donovan | Claire Donovan’s permissions | Sent | |
| Follow-up task created, due Thu 3 Sep, 10:00Projects, kickoff Fri 4 Sep | CDClaire Donovan | Claire Donovan’s Owner role | Done | |
| Invoice ROWA-1001 created as DraftFinance, 59,085.00 | MBMarcus Bell | Finance role | Done | |
| Ticket #13 resolvedSupport, Kestrel Freight Systems | CDClaire Donovan | Owner role | Done | |
| Task assigned: workshop packProjects, Kestrel Advisory Engagement | OROwen Reed | Owen Reed’s Projects role | Done | |
| Lead stage updatedSales, Halloway Dental Group | NWNina Whitfield | Sales role | Done |
- Step
- Follow-up task created
- Actor
- Ask Cyril
- Approved by
- CDClaire Donovan
- Checked against
- Owner role, Claire’s permissions
- Record
- Kestrel Freight Systems
- Checked
- On the server
Recovery and export, from the published policies
Deleted records stay in the recycle bin until someone restores them or deletes them for good.
Exporting your data is free at any time, whether or not you are cancelling.
After termination, your content remains available for export before it is scheduled for deletion.
Backups are kept for 365 days, then expire automatically.
Security practices.
What is implemented today. Anything still in progress is disclosed as prose on this page, so this list can never overstate what is enforced.
Encryption in transit
All traffic to Cyril is encrypted with TLS 1.2 or higher. HTTPS is enforced on every endpoint; HTTP requests are redirected.
Encryption at rest
Per-org integration secrets, OAuth tokens and TOTP seeds are encrypted at the application layer with a master key stored outside the database. Encrypted backups are written via age before upload to object storage. The primary database relies on the hosting provider’s volume encryption, provider-managed AES-256.
Access controls
Role-based access control with least-privilege defaults. Multi-factor authentication is enforced for platform administrators and can be required organisation-wide by customer admins.
Vulnerability management
Dependabot opens weekly dependency updates; pnpm audit and Semgrep static analysis report findings but block nothing. A Trivy container scan blocks production deploys on fixable high or critical vulnerabilities. Coordinated disclosure runs through our bug-bounty programme.
Incident response
A documented incident-response runbook with severity levels and named SLAs. Personal data breaches are notified to affected customers within 72 hours of confirmation, in line with GDPR Article 33. For Australian customers the same notice supports the Notifiable Data Breach scheme: a suspected eligible breach is assessed within 30 days, and the OAIC and affected individuals are notified as soon as practicable where serious harm is likely.
Tenant isolation
A shared database with org_id row isolation enforced at the service layer. Cross-tenant isolation tests are required for every entity type by our Definition of Done. There is no cross-tenant data sharing.
Certifications and commitments.
Cyril is pre-launch software. Where a commitment does not exist yet, this section says so rather than leaving you to assume it.
SOC 2 Type 1
SOC 2 Type 1 is a general-availability gate for Cyril. Type 2 follows six months after Type 1 attestation. We hold no certification today and no audit report is available.
GDPR
Built for GDPR: access, export, correction and erasure requests are handled in the product. Our data processing agreement will be ready before customers sign.
Data Processing Agreement
Our DPA is available to read now, but it has not yet completed legal-counsel review and is published as a draft for evaluation rather than as a final agreement. Customers needing an executed DPA should contact us and we will confirm timing.
Uptime and status
Cyril is pre-launch software under active development, and our Terms of Service say plainly that there is no uptime commitment and no service level agreement. We publish no availability percentages, and there are no service credits. The service may be interrupted for maintenance, features may be briefly unavailable during a deployment, and defects will be found in production because the product is young.
Service levels and support response times exist only where an Enterprise Order agrees them, and none apply by default. A public status page is live at status.getcyril.com, showing per-component health and an incident log.
Customer data lives in the European Union.
The database and API run on Hostinger, in data centres in Lithuania and the Netherlands. That is the primary residence, published on the sub-processor list, not a region a customer can elect.
If you need data to stay in Australia (government work, IRAP, or a board that will not accept an overseas disclosure) Cyril cannot meet that requirement yet. We would rather say that here than have it surface in a deal.
APP 8. If you are an APP entity under Australia’s Privacy Act, putting personal information into Cyril is an overseas disclosure, and you remain accountable for it. As at May 2026 no countries are prescribed as providing substantially similar protection, so APP 8 applies in full. We do not claim that EU, Lithuanian or Netherlands law is a prescribed equivalent.
What we offer instead is contractual APP-equivalent handling in the draft DPA: processing only on your instructions, security measures, assistance with access and correction, Notifiable Data Breach notice timed to the 30-day assessment, deletion or return on termination, and responsibility for sub-processors. The DPA is still a draft pending counsel review.
This section is not legal advice, not IRAP, and not a promise of an Australian region. The DPA names the facts and the handling; it does not close APP 8 for you.
Sub-processors.
Some third parties are part of how Cyril runs, and every organisation uses them. Others are integrations, engaged only when somebody at your organisation switches one on from Settings → Integrations.
| Provider | What it does | Region |
|---|---|---|
| Hostinger (Cyprus) | Hosting for the API and database, the primary residence of customer data | EU |
| Cloudflare (USA) | DNS, CDN and firewall; storage for uploaded files and encrypted backups | Global edge |
| Twilio SendGrid (USA) | System email, and invoices and documents you send clients | USA / EU |
| Sentry (USA) | Error monitoring, configured to scrub personal data | USA |
| Apollo.io (USA) | B2B prospect search and contact enrichment | USA |
| Brandfetch (Netherlands) | Logo and brand-colour lookup for new accounts | EU |
| Google Maps Platform (USA) | Address autocomplete and company enrichment | Global |
| Anthropic (USA) | Primary model provider for AI features | USA |
| OpenAI (USA) | Secondary model and embeddings provider | USA |
| Stripe (USA) | Subscription billing, and Connect when you take card payments | USA / EU / AU |
| ElevenLabs (USA) | Voice for the assistant and the page reader, on Cyril’s own account | USA |
| Google Analytics (USA) | Website analytics after opt-in; a module-name-only property in the app | USA / EU |
| Ahrefs (Singapore) | Cookieless analytics on this website | Not published |
Optional, off until connected
If nobody at your organisation turns one of these on, no data reaches that provider and it is not a sub-processor for you.
- Gravatar
- Twilio SMS
- Pipedrive
- HubSpot
- Adobe Experience Manager
- Gmail and Google Calendar
- Microsoft 365 and OneDrive
- Google Drive
- Slack
- DocuSign
- Microsoft Entra ID
- ElevenLabs Voice Studio
- Klaviyo
- Salesforce
- Revolut Merchant
Notification of changes. The sub-processor list is where a change appears first, with the date it carries. Section 3.2 of the Data Processing Agreement commits to 60 days’ written notice before any always-on provider changes, with a right to object during that window. The DPA is still a draft, so that commitment is as firm as a draft can be. To be told when the list changes, email legal@getcyril.com.
Bug bounty.
We run a coordinated vulnerability disclosure programme and welcome reports from security researchers acting in good faith. We will never pursue legal action against anyone who follows this policy.
Report a security issuesecurity@getcyril.comWe acknowledge receipt within 2 business days. If you have not heard back by then, please re-send; your message may have been filtered.Full policyWhat to include
- A clear description of the vulnerability and its potential impact
- Step-by-step reproduction instructions, ideally with a minimal proof-of-concept
- The affected URLs or endpoints, and any account context required
- Your CVSS estimate and severity tier (we will adjust if needed)
- Whether you would like public credit, and the name to use
Severity and response times
| Severity | CVSS v3.1 | Examples | First response |
|---|---|---|---|
| Critical | 9.0 to 10.0 | Remote code execution; full database compromise; cross-tenant data exposure; payment-flow bypass | 24 hours |
| High | 7.0 to 8.9 | Authenticated privilege escalation; SSRF reaching internal services; auth bypass on a single endpoint | 48 hours |
| Medium | 4.0 to 6.9 | Stored XSS in an authenticated surface; CSRF on a state-changing endpoint; IDOR with limited blast radius | 5 business days |
| Low | 0.1 to 3.9 | Reflected XSS requiring victim interaction; rate-limit gaps without abuse path; informational leaks | 10 business days |
These are times to first triage, not times to fix, and they are targets. The commitment we hold ourselves to is the acknowledgement within 2 business days, whatever the severity. Cyril is a small team without a 24-hour on-call rota, and we would rather tell you that than publish a number we cannot always meet.
Scope
In scope
- Staff app frontend
- Public REST API and MCP audit endpoints
- Platform-admin frontend
- Client portal frontend
- This site, including its lead-capture and reporting endpoints
- Organisation subdomains, once they are available, excluding any host with a -staging suffix
Out of scope
- Findings against staging or development environments
- Third-party services we depend on; report directly to that vendor
- Social engineering of staff, customers or vendors
- Physical attacks on facilities, hardware or personnel
- Denial-of-service or volumetric attacks
- Spam, phishing, or anything that contacts non-consenting third parties
- Findings only reproducible with brute-forced credentials or stolen tokens
- Issues affecting out-of-date browsers (we support the last two major versions of Chrome, Firefox, Safari and Edge)
- Self-XSS, missing headers without demonstrated impact, missing rate limits without an abuse path
- Automated scanner output without a working proof-of-concept
Safe harbour
Provided you act in good faith and follow this policy, Cyril considers your research to be authorised conduct. We will not pursue legal action against you, including under the Computer Misuse Act 1990 (UK), the Computer Fraud and Abuse Act (US) or analogous legislation elsewhere, and we will work with our sub-processors and law enforcement where necessary to support that protection. In return, you commit to:
- Stop testing as soon as you confirm the vulnerability, and not exfiltrate data beyond the minimum needed to demonstrate impact.
- Not access, modify or destroy data belonging to other users or organisations.
- Not interrupt service for other users.
- Not publicly disclose the vulnerability before we have had a reasonable opportunity to fix it (typically 90 days, with extensions agreed in writing for complex remediations).
- Comply with all applicable laws.
Recognition
The programme is currently recognition-only. With your consent we credit reporters publicly on this page once a fix has shipped and a reasonable disclosure window has elapsed. We are evaluating monetary bounties as the platform matures; when that ships, the rewards table will appear here, and reporters who landed an eligible report before the change will be made whole retroactively.
The documents behind this page.
- Privacy PolicyUpdated 4 October 2026What we collect on getcyril.com, what the platform processes for organisations, who we share it with and how long we keep it.
- Terms of ServiceUpdated 17 August 2026What we commit to, what we ask of you, what is not settled yet, and how either side can end the arrangement.
- Cookie PolicyUpdated 4 October 2026Which cookies and similar technologies this site uses, and how to control or refuse the rest.
- All legal documentsDrafts, legal review pendingEvery policy in one place, including the data processing agreement and the sub-processor list.
- Security issues
- security@getcyril.com
- DPA and sub-processor notices
- legal@getcyril.com
- Anything else
- Contact us