CyberCyko security architecture

Security answers you can take into a review.

Written for the person who will ask the hard questions. Every section is short enough to paste into a security questionnaire, and what ships today comes first.

Author: CyberCyko engineering team.Page updated: October 2026.

The short version

• There is no central store of passwords or user secrets. We keep your user list (name, work email) and public keys.
• Each identity is a key generated and kept on the employee’s own phone and laptop. Where the device has a security chip, the key stays inside it and never leaves it, and the phone asks for a live fingerprint or face before using it.
• Every device proves itself on every request, and sign-in through CyberCyko is checked against the enrolled device and phone.
• Security checks are designed to fail closed, with no fallback to a weaker path.

Background reading: MFA fatigue attacks explained, and how to stop them.

Scope and roadmap

What the product covers today, and what is in development.

• Today: Windows laptops are fully managed, and passwordless sign-in works on Windows and at the Mac lock screen. Management for Mac, Ubuntu, Android and iOS is in development.
• The admin console is a web console, opened in the browser on an enrolled Windows or Mac computer.
• Today the iPhone and Android apps only approve sign-in. They do not manage the phone.
• Remote lock secures the laptop screen. It does not erase a laptop or back up its files.
• Access is enforced at sign-in: removing someone blocks sign-in through CyberCyko, without changing accounts inside your other apps.
• Access-request workflows, periodic access reviews and conflicting-access rules are outside the product’s scope.
• CyberCyko works alongside your antivirus and makes sure the one built into Windows is on and configured.
• The audit trail covers actions taken through CyberCyko. It is not a complete history of access to your customer data in other systems.

Where identities live

Every identity in CyberCyko, whether a person or a device, is a cryptographic key generated on the device. Where the device has a security chip, the key is kept inside it and cannot be exported. When someone signs in, their identity comes from the proof on the request itself, checked against the public key we hold. Nothing we store could sign anyone in.

For engineers

• Windows laptops: the TPM 2.0 chip.
• iPhone and Mac: the Secure Enclave.
• Android phones: StrongBox.
• Private keys are generated on-device, and are non-exportable where held in the chips above.
• App sign-in uses the OpenID Connect standard. Microsoft 365 domain sign-in is set up with a guided flow and our help.

What an attacker gets if we are breached

Your user list (names and work emails), a list of devices and a set of public keys. None of them can sign anyone in without the physical hardware and the person’s fingerprint. There is no user table with credentials in it.

How a device proves itself

Enrolment creates the device’s key, bound to its security chip where it has one. The device proves that key on every connection. Checks are designed to fail closed: a device that cannot prove itself does not connect, and there is no fallback to a weaker path.

What the Windows agent does

The agent applies supported settings, reports their state and the twelve checks, runs remote lock and restart, and supports a live remote session with keyboard and mouse control. Remote sessions are logged. The agent does not read the contents of files on the laptop. Ask us for the current privilege list.

What we store, and what we cannot see

Stored

Your user list (names and work emails), device records (hardware detail, reported settings, check results, local users, activity), public keys, per-person and per-app access grants, and the admin audit log.

Cannot see

Private keys, fingerprints or face data, passwords (there are none to see), and the contents of files on a laptop. We do not provide file backup.

Separation

CyberCyko is a hosted service. Each customer organisation gets its own isolated workspace, and its data is kept apart from every other customer’s. The keys that sign your people in stay inside their own devices. We never hold them.

Development and production use separate signing keys and certificates. A development credential cannot authenticate to production.

Keys and secrets

Private keys live in hardware or in memory, never in a file on disk. Storage and signing keys are encrypted and managed with cloud key management, and storage encryption is always on. Traffic between devices and the service is encrypted in transit.

The audit trail

Each admin record is chained to the one before it, per organisation. A “Verify integrity” button re-checks the whole chain and names the first record that does not match. That shows an edit, a deletion or a reordering by anyone, including us.

The trail is tamper-evident: an edit shows up when the log is checked. That is different from saying an edit is impossible.

Compliance posture

CyberCyko is ISO/IEC 27001:2022 certified for its information security management system (certificate 09115388E) and ISO 9001:2015 certified for its quality management system; the certificates and our Government of India recognitions are set out on the compliance and data handling page. Separately, twelve continuous checks run on every enrolled Windows laptop and are mapped to the frameworks below for your own reporting; those mappings are not certifications. CyberCyko’s own SOC 2 Type II audit is in progress and we do not hold a SOC 2 report. We share our current evidence under NDA.

• Firewall
• Disk encryption
• Antivirus real-time protection
• Secure Boot
• Windows updates
• Account lockout
• Screen lock
• Remote Desktop policy
• SMB1 disabled
• Guest account disabled
• Credential Guard
• Audit policy

DPDP Act 2023 and IT Act 2000

Full DPDP compliance is due 13 May 2027. Access control, device security settings and a verifiable audit trail are three of the safeguards it asks for. We give you evidence for all three. We are built for Indian data-protection obligations and are one control in your programme, not a certification. We are not a consent manager and do not handle consent.

Hosting and sub-processors

CyberCyko is hosted on Amazon Web Services (AWS) and serves teams worldwide. Prices are in US dollars. Indian customers are invoiced in Indian rupees at checkout; everyone else in US dollars.

Our Privacy Policy lists the categories of sub-processor we use. Ask us and we will give you each one’s name, purpose and data flow in the form your questionnaire needs. Read the Privacy Policy.

Data processing agreement (DPA)

Ask us for the current DPA and contract wording.

Security contact

To report a vulnerability, email contact@cybercyko.com with “Security” in the subject. Include the address or feature affected, the steps to reproduce it and what you saw. Please test only against your own account and data.

To send a security questionnaire, talk to our engineering team. Bring the questionnaire; we will answer what this page does not.