Compliance and data handling
Certifications, audit status, hosting, data handling and the documents for your security review, in one place.
Author: CyberCyko engineering team.Page updated: October 2026.
At a glance
| ISO/IEC 27001:2022 | Certified, certificate 09115388E |
|---|---|
| ISO 9001:2015 | Certified, quality management system |
| SOC 2 Type II | Audit in progress |
| Hosting | AWS, serving teams worldwide |
| Sub-processors | Each named with its purpose, on request; categories in our Privacy Policy |
| Passwords stored | None: there is no password database |
| Admin log | Tamper-evident, checked in one click |
| Data processing agreement (DPA) | Available on request |
Security certifications
Certified
ISO/IEC 27001:2022
Information Security Management System
- Certificate no.
- 09115388E
- Holder
- Cybercyko Technologies Private Limited
- Status
- Certified
Certified
ISO 9001:2015
Quality Management System
- Holder
- Cybercyko Technologies Private Limited
- Status
- Certified
Government recognitions
Government of India recognition and registration
- DPIIT-recognised startupDepartment for Promotion of Industry and Internal Trade
- MSME-registeredMinistry of Micro, Small and Medium Enterprises
Our SOC 2 Type II audit is in progress. We do not hold a SOC 2 report yet.
See it working
The product demonstration, about a minute long: an employee approves a sign-in on their phone, then an administrator manages people, devices and apps from the console.
What we store, and what we cannot see
Stored
Your user list (names and work emails), device records (hardware detail, reported settings, check results, local users, activity), public keys, per-person and per-app access grants, and the admin audit log.
Cannot see
Private keys, fingerprints or face data, passwords (there are none to see), and the contents of files on a laptop. We do not provide file backup.
If we are breached
Your user list (names and work emails), a list of devices and a set of public keys. None of them can sign anyone in without the physical hardware and the person’s fingerprint. There is no user table with credentials in it.
Separation
CyberCyko is a hosted service. Each customer organisation gets its own isolated workspace, and its data is kept apart from every other customer’s. The keys that sign your people in stay inside their own devices. We never hold them.
Hosting and sub-processors
CyberCyko is hosted on Amazon Web Services (AWS) and serves teams worldwide. Prices are in US dollars. Indian customers are invoiced in Indian rupees at checkout; everyone else in US dollars.
Our Privacy Policy lists the categories of sub-processor we use. Ask us and we will give you each one’s name, purpose and data flow in the form your questionnaire needs. Read the Privacy Policy.
The audit trail
Each admin record is chained to the one before it, per organisation. A “Verify integrity” button re-checks the whole chain and names the first record that does not match. That shows an edit, a deletion or a reordering by anyone, including us.
Documents for your review
- Data processing agreement (DPA). Our current DPA and contract wording.
- Master services agreement (MSA). For teams that buy through procurement.
- Sub-processor list. Each sub-processor, with its purpose and data flow.
- Security questionnaire. Send yours and we answer it in your format.
- Windows agent privileges. The current list of what the laptop app is allowed to do.
Ask for any of them and we will come back within one working day.
Ask for the documentsRead the security pageSecurity contact
To report a vulnerability or send a security questionnaire, email contact@cybercyko.com or talk to our engineering team.
Contact us