You are considering handing the telemetry of your whole estate to a security company. You should know exactly where it goes, what leaves, who can see it, and how it is kept under control. This page is that conversation, in public. Anything it does not answer, ask, and we will answer in writing.
Ask us anything, and you have the answer in writing. We complete security questionnaires in full, share our architecture, policies and test results under a non-disclosure agreement, and commit what leaves your region to writing before anything connects. The platform was built from the first line by certified security operators with the controls below, and your own Settings page shows the live state of each one, so what is written here can be checked against what is actually on.
When your organisation is created you choose its data region, and it is fixed from then on. A move is a request we carry out with you, never a silent migration.
Everything for your organisation lives here.
Abu Dhabi, with Dubai as its backup pair.
Every other public cloud region can be requested at sign-up; demand is what decides the order we open them in.
The free posture scan reads configuration and inventory only: no logs are collected and nothing enters the data lake. It uses its own dedicated app in your Microsoft tenant with read-only permissions, and a read-only role in AWS, never the credential used to connect your products for monitoring. You can revoke it at any moment by deleting the Enterprise application or the stack, and a scan that is not continued is deleted thirty days after the last scan.
Your own Settings page shows the live state of each of these for your organisation, so what is written here can be checked against what is actually on.
Email to your own people (approvals, notifications, reports) is sent from our region through Amazon's email service. Nothing else leaves. In particular: your raw events never leave your region, and no other customer's organisation can ever read them.
Every table carries your organisation's scope and the database itself enforces it (row-level security), not just the application. Queries are compiled to typed plans with your scope fixed server-side; nothing a person or the AI types can widen it. An isolation test suite runs on every change.
Cyvantic AI reaches your data only through a tool gateway with a per-organisation allowlist. Every call is audited, budgeted and cited. Lookups, joins and enrichers decide what they can decide; the model judges, it does not guess, and every claim it makes carries the evidence it rests on.
Response actions execute only through one approval gate, under a policy you set per action type and can lower in one click. Reading your products and acting on them are separate consents. A managed provider acting for you is limited to the kinds of action you allow it.
Every query, decision, approval and action lands in a per-organisation ledger whose entries are chained with a keyed hash. An edit breaks the chain visibly. You can verify it yourself and export it for an auditor.
Sign in with Microsoft or Google single sign-on; multi-factor is enforced. Every route checks a specific permission. Our own staff reach your organisation only by an audited, time-boxed impersonation that you can see in your ledger.
Every connection uses modern transport encryption; every store is encrypted at rest. The credentials you grant to your products are encrypted with authenticated encryption under keys that never live in code or in a container image.
A cap per run and a cap per day are enforced inside the AI's loop. It halts; it never quietly overruns. The balance and today's spend are live on your billing page.
Retention is yours to choose, from 12 to 84 months. Data older than your window is removed by a daily sweep; shortening the window takes effect after 72 hours and can be cancelled until then; a legal hold pauses all purging. Leaving means your data is purged, and we show you that it was.
This site sets no cookies and loads nothing from anyone else. We count visits ourselves, without identifying you, as the privacy policy describes. Our form uses an invisible proof-of-work challenge, not a third-party captcha.
| Provider | Purpose |
|---|---|
| Amazon Web Services (Ireland) | Hosting of the platform, the Cyvantic Data Lake, backups and outbound email. Everything in your region. |
| Anthropic | The AI model behind Cyvantic AI's investigations, hunts and reports. Receives case context, never raw bulk telemetry. Governed by your AI processing policy. |
| OpenRouter, OpenAI | Embedding models for the knowledge base you choose to connect (your runbooks and policies), so the AI can find the right passage. Governed by the same policy. |
| ip-api, AbuseIPDB, VirusTotal | Threat-intelligence enrichment of indicators (addresses, domains, hashes) on incoming alerts. Optional: switchable off for your organisation. |
| Brave, Tavily, urlscan.io, Google Web Risk | Web research and address reputation, only under a web-access setting that allows them. Optional, and every disclosure is written to the ledger first. |
The live list for your organisation, with each item's current state, is on your Settings page under Data residency. We tell customers before adding a sub-processor that would receive their data.
If you believe you have found a vulnerability in Cyvantic, this website or our infrastructure, tell us through the form and choose "to report a security issue". A security engineer acknowledges every report within one working day, keeps you informed, and credits you if you wish. We will not pursue researchers who act in good faith, respect our customers' data and give us reasonable time to fix what they find.