Secure by construction.
This page describes how Cybrotrix approaches security in the software we build and operate. It does not list certifications we do not hold. If you need specific assurances for an engagement, ask us and we will answer precisely.
What security means in our engineering.
Identity first
OpenID Connect and OAuth 2.0 for people and services, managed identities on the platform, no shared secrets in code or configuration.
Least privilege and RBAC
Roles designed around responsibilities, scoped to organizations and teams, with separation of duties for anything that reaches production.
Encryption and secrets
TLS everywhere, encryption at rest on platform services, secrets in managed vaults with rotation rather than in files.
Secure delivery pipeline
Dependency scanning, static analysis and container image scanning run in CI. Production changes go through review and approval gates.
Audit trails
Who changed what, when, through which pipeline. Traceability from requirement to release is a security control as much as an engineering one.
AI-specific controls
Models act only through scoped tools, prompts and outputs are logged, and anything with side effects can require human approval.
We apply it here too.
This site is served over HTTPS with HSTS, a nonce-based Content Security Policy, strict referrer and framing policies, and no third-party scripts. The contact form is protected by anti-forgery tokens and a honeypot, and messages are stored only for the purpose of replying to you.
Found something?
If you believe you have found a security issue in a Cybrotrix product or website, email info@cybrotrix.com with the subject "Security report". Please give us reasonable time to investigate and fix the issue before disclosing it publicly. We do not run a paid bounty program at this time.
Let's Build What Comes Next.
Have a technology challenge, modernization initiative, or product idea? Let's engineer the solution.