Disk encryption
Per-laptop proof that BitLocker is enforced and applied on each enrolled Windows laptop.
Security for fintech teams
Evidence your auditors and bank partners ask for.
For Indian fintech, lending, payments, wealth and insurance-tech companies of 50 to 500 people. Phone sign-in and Windows laptop management, with per-laptop evidence and an admin log that checks itself.
Evidence for the controls your auditors and bank partners ask about. We map to CIS, NIST SP 800-171, SOC 2 and ISO/IEC 27001:2022 controls.
Contact usRead the security pageYour compliance calendar sets the deadline
RBI and SEBI expectations, the DPDP Act deadline of 13 May 2027, and security reviews demanded by the banks and partners you integrate with. That calendar gives you a budget line and a date. It also gives you the longest security review of any buyer. We expect a 60- to 120-day evaluation and a security questionnaire, and we are ready for both.
What usually brings a fintech team to us
- An audit finding on access control.
- A bank partner’s security review.
- A funding round that brings in a real CISO.
- A phishing incident in the finance or ops team.
1. Evidence you can hand to an auditor
Per-laptop proof that disk encryption, screen lock, firewall and updates are applied. A log of every admin action that can be verified for tampering with one click.
Screen lock
The screen-lock rule you pushed, and which laptops confirmed they applied it.
Firewall
The firewall state reported by each laptop in its twelve-check security checklist.
Updates
The Windows updates policy each laptop reports, so you can show updates are applied.
CyberCyko console showing the security checklist reported by an enrolled Windows laptop
2. Where the data lives
AWS, serving teams worldwide
CyberCyko is hosted on Amazon Web Services (AWS) and serves teams worldwide. Each customer gets its own isolated workspace, kept apart from every other customer’s.
Sub-processors, named on request
Ask us and we name each one with its purpose, ready for your questionnaire. Our Privacy Policy lists the categories.
Priced in US dollars
Every price on this site is in US dollars. At checkout, Indian customers are billed in Indian rupees and everyone else in US dollars.
3. What happens if we are breached
There is no central store of passwords or user secrets. Each key stays on the employee’s own phone and laptop. A full compromise of our backend yields your user list, device records and public keys, none of which can sign anyone in without the hardware and the fingerprint.
4. Alerts tied to a named person and device
That is what an auditor asks for. Every enrolled Windows laptop in the console shows who uses it, and every admin action in the log names the person who made it and the device it touched.
What the product covers today
- Today: Windows laptops are fully managed, and passwordless sign-in works on Windows and at the Mac lock screen. Management for Mac, Ubuntu, Android and iOS is in development.
- Our SOC 2 Type II audit is underway; we do not hold a SOC 2 report yet.
- Today the iPhone and Android app only approves sign-in. It does not manage the phone.
- Remote lock secures the laptop screen. It does not erase a laptop or back up files.
- Consent under the DPDP Act stays with your consent manager; CyberCyko covers access, devices and audit.
Six situations fintech teams recognise
The bank partner’s questionnaire
A partner bank sends 140 questions before go-live. “How is disk encryption enforced?” “Who has admin access and how is it reviewed?” “Show us your access log.”
The compliance view answers with per-laptop evidence. The admin log answers the access question. Days, not weeks.
The audit finding on access control
An auditor flags shared passwords in the ops team.
Passwords are removed altogether. Each person signs in with their own phone and fingerprint, and every sign-in is logged per person.
The ops analyst’s laptop in a cab
The laptop held customer KYC documents. It is locked from the console as soon as it reconnects.
Encryption was enforced, and the console shows it applied on that machine. Nobody can sign in without the analyst’s phone.
Contractors on and off in a week
A collections agency’s staff need access on Monday and must lose it on Friday.
One invite each. One click to remove. Every change is in the log.
The CFO-fraud email
A convincing message asks the finance team to “re-enter your password”.
There is no password to give, so that route in is closed.
Who changed what
After an incident at a peer company, the board asks who changed what.
The audit log lists every admin action in order. The auditor clicks Verify integrity, and the chain is checked in front of them.
The DPDP deadline
Full DPDP compliance is due 13 May 2027. Access control, device security settings and a verifiable audit trail are three of the safeguards it asks for. We give you evidence for all three.
The control mappings above are for your own reporting. We are not certified by any regulator, and a control mapping is not a compliance certificate. CyberCyko itself is ISO/IEC 27001:2022 certified for information security and ISO 9001:2015 certified for quality management; the certificates are on the compliance and data handling page.
Bring your bank-partner questionnaire
Talk to an engineer about your Windows fleet, access controls and the evidence your reviewer needs. We will answer what the security page does not.
Contact usRead the security page