Enterprise Security & Trust Center
This center describes security controls, privacy and security mapping, and target assurance milestones. Control status is provided only where documented evidence for the applicable environment and period is available.
CISO & Security Governance Commitment
Control descriptions are not representations of active production enforcement unless dated evidence is available for the applicable environment and period. Roadmap dates are targets, not completed assurance engagements or certifications.
Security Controls Described by CyberAgest
A control description is not evidence of active enforcement in a specific environment or period unless documented evidence is available.
End-to-End Encryption Architecture
Data at rest encrypted via AES-256-GCM. Data in transit strictly protected via TLS 1.3 with Perfect Forward Secrecy.
Database Tenant Isolation (Postgres RLS)
PostgreSQL Row-Level Security (RLS) dynamically policies tenant data access, guaranteeing physical/logical isolation.
WebAuthn Passkeys & Multi-Factor Auth
Native FIDO2 / WebAuthn passkey authentication and Time-based One-Time Passwords (TOTP) for phishing-resistant access.
Isolated Container Scan Sandbox
Automated scan tasks run within unprivileged, ephemeral container sandboxes restricted by custom Linux seccomp profiles.
AegisGPT Non-Destructive Protocol & Instant Kill-Switch
Guaranteed non-destructive verification markers with multi-tiered kill-switch terminating scans and destroying containers in under 10 seconds.
Hybrid Zero-Trust Architecture & Credential Masking
Strict separation between agentless EASM and lightweight collectors, with AES-256-GCM encrypted credentials and zero disk persistence.
Immutable Audit Trail & Activity Logs
All system operations, workspace modifications, and API calls generate immutable, timestamped audit events.
Automated CI/CD SAST & Dependency Scans
Automated static analysis, dependency vulnerability checks, and container linting integrated directly into GitHub Actions.
Regulatory & Privacy Framework Alignment
CyberAgest is designing and mapping selected controls to relevant privacy and security principles. This is not a certification or legal compliance determination.
Saudi Arabia PDPL Alignment
Architected around SDAIA guidelines, supporting in-country data sovereignty, explicit user consent, and subject request workflows.
EU GDPR Privacy Architecture
Full alignment with data minimization, right-to-be-forgotten, data export, and purpose-limited processing.
OWASP Top 10 & NIST Frameworks
Hardened application logic mitigating OWASP Top 10 vulnerabilities and mapped to NIST Cyber Security Framework (CSF) controls.
Target Assurance & External Audit Milestones
Target audit and assurance milestones are subject to engagement completion and publication of independent evidence.
Independent Third-Party Penetration Test
No third-party penetration-test executive summary is currently published. When an engagement is completed, a dated summary will be published or made available only to the extent permitted by the engagement and applicable confidentiality obligations.
SOC 2 Type II Observation Period Kickoff
Formal initiation of the 6-month observation period with an accredited CPA firm evaluating Trust Services Criteria (Security, Confidentiality, Availability).
Target SOC 2 Type II & ISO/IEC 27001 Assurance Milestones
Target assurance milestones only. CyberAgest does not represent that a SOC 2 Type II report or ISO/IEC 27001 certificate has been issued unless a dated, applicable independent report or certificate is explicitly made available.
Enterprise Vendor Due Diligence Package
Access our Security Architecture Summary, Vendor Assessment Questionnaire (CAIQ / SIG), and NDA-governed Audit Package.