Security posture

Built on the
same standards
we evidence.

CyberIQ holds itself to the security expectations of the customers who layer it onto their stack. Here’s the detail — data residency, encryption, multi-tenant isolation, identity, retention, compliance posture, and how to reach our security team.

RLS-first multi-tenant EU & US data residency TLS 1.3 & AES-256 at rest
REGION DEFAULT EU — Frankfurt REGION OPT-IN US — Virginia CUSTOMER DATA NEVER CROSSES REGIONS WITHOUT EXPLICIT CONFIG
01 / Data residency

Pick your region at tenant creation. Stay there.

Customer data lives in the region you choose when your tenant is created and does not leave that region without an explicit, customer-initiated configuration change. Two regions today — Frankfurt for the EU default and Virginia for US-resident customers.

Region · default
EU — Frankfurt
Active

All new tenants default to the EU region. Database, file storage, edge compute and telemetry remain in EU infrastructure under our managed-Postgres provider’s Frankfurt presence. GDPR-resident by default; no transfer to the US unless the tenant administrator opts in to a US tenant at sign-up.

Region · opt-in
US — Virginia
Available

US-resident customers can elect Virginia at tenant creation. Once chosen, the region is fixed for the lifetime of the tenant. Cross-region migration is a deliberate, contracted operation — never automatic, never silent, never as a result of routine platform work on our side.

No cross-region replication. EU tenant data is not replicated to the US for analytics, support or backup. Backups are kept in-region under the same regional boundary as the live tier.
02 / Encryption

In transit and at rest — configured to the highest tier our providers offer.

We rely on industry-standard providers for the encryption layer and configure to their strongest settings. Where the provider supports stricter posture than the default, we take it.

In transit

TLS 1.3 minimum

All client traffic to cyberiq.cc and the platform API is terminated over TLS 1.3. Older protocol versions and weak cipher suites are disabled at the edge. HSTS is enabled for the production domain.

Protocol TLS 1.3 minimum across all client-facing endpoints
Edge Managed certificate rotation; no manual key handling
HSTS Enabled with preload on the production domain
At rest

AES-256 on storage

The underlying Postgres tier and object storage are managed by an industry-standard provider with AES-256 encryption on disk. Backups are encrypted with the same posture. Customer file uploads (avatars, report exports) inherit the same encryption.

Database Managed Postgres tier; AES-256 disk encryption
Storage Object storage with AES-256 at rest; encrypted backups
Keys Managed by the underlying provider; rotated on their schedule
03 / Multi-tenant isolation

RLS is the second wall behind authentication.

Row-Level Security is enabled on every table that carries customer data. Cross-tenant reads are denied at the database layer, not at the API surface — meaning a bug in a route handler cannot grant access to another organisation’s rows.

01

RLS on every customer-data table

Every table that stores profile, organisation, session, telemetry, results, or policy data has RLS enabled and a deny-by-default posture. Migrations that introduce new tables are required to ship with RLS policies as part of the same change.

02

4-tier RBAC enforced in-database

Platform Admin / Org Owner / Manager / Player. Roles are derived from organisation membership and evaluated inside RLS policies — the same policy decides what an Org Owner can see and what a Player cannot. The frontend cannot loosen this; the API surface cannot loosen this.

03

Cross-tenant reads are impossible by design

Tenant isolation is enforced by the database row policy, not by an application filter on top of an open query. A misrouted request, a logic bug, or a stolen JWT cannot return another tenant’s rows — the wall is one layer deeper than the API.

RLS policy · evidence
Live

Profiles — tenant-scoped read

A typical policy from the live schema: a row in profiles is visible to a caller only if the caller is a member of the organisation that owns that profile. There is no escape hatch in the API layer above.

-- profiles: tenant-scoped read CREATE POLICY profiles_select_same_org ON profiles FOR SELECT USING ( auth.uid() IN ( SELECT user_id FROM org_members WHERE org_id = profiles.org_id ) );

Representative policy. The full set is reviewable under a signed engagement and is regression-tested by an internal RLS assertion pack on every release.

04 / Identity

SSO and SCIM where you need it. Magic-link where you don’t.

Enterprise customers get federated identity and automated provisioning. Standalone customers get a passwordless flow that’s simpler than rolling your own. Multi-factor is available on every tier.

Enterprise tier

SAML SSO & SCIM 2.0

Federate identity with your IdP and let the platform reflect joiners, movers and leavers automatically. No shadow user lists. No quarterly reconciliation spreadsheet.

SAML Okta, Azure AD / Entra ID, Google Workspace, generic SAML 2.0
SCIM SCIM 2.0 provisioning & deprovisioning; group sync to org roles
MFA Inherited from your IdP; we honour the assertion
Session JWT-backed; revocable on deprovision via SCIM event
Free & Standalone

Email & magic-link

Passwordless by default — a one-time link to the registered email address. Password sign-in is supported for customers whose policy requires it. Either way, multi-factor is available.

Primary Magic-link to verified email; one-time codes
Fallback Email + password with strong-password policy enforced
MFA TOTP authenticator app on all tiers; available, not enforced by default
Sessions Refresh-token rotation; revocable from the user’s profile
One identity, all surfaces. The same account governs the dashboard, the games, the reporting layer and the API. There’s no separate “game player” user pool sitting outside the IdP boundary.
05 / Retention

365 days by default. Configurable on Enterprise. Erasure on request.

We hold the minimum data we need to evidence competency. Session-level telemetry rolls off on a default 365-day window; aggregates that have been anonymised are kept for model calibration.

Default
365days

Rolling retention

Session-level telemetry — question responses, timing, miss-tracking, score deltas — is retained on a 365-day rolling window. After that, the row-level data is purged. The aggregate Cyber IQ Score continues forward.

Enterprise
Custom

Per-tenant configurable

Enterprise tenants can tighten or extend retention to match their internal records policy. Common windows are 90 days, 180 days and 730 days. Configured in the admin surface; effective on the next nightly roll.

On request
30day SLA

Hard delete — right to erasure

A written request from a verified org admin triggers a hard delete of the named subject’s personal data within 30 days. GDPR Article 17 right-to-erasure; mirrored for CCPA where applicable. The request and its completion are logged in the audit trail.

Anonymised aggregates. Stripped of any identifier, aggregate signals (band distributions, calibration anchors) are retained beyond the rolling window for the sole purpose of keeping the Cyber IQ Score model stable across releases. These aggregates cannot be re-identified to a named subject or tenant.
06 / Compliance posture

Honest about what we evidence, and what we’re still working toward.

Two things are easy to conflate: the audit evidence CyberIQ produces for our customers, and the audits we run on ourselves. The first is what the product does. The second is where we are on our own roadmap. We split them here so you can see both clearly.

Live
For your audits

Customer audit alignment

CyberIQ is designed to produce the per-employee competency evidence your auditors are looking for. Mapped 1:1 to:

  • NIS2 — Article 20(1) cybersecurity training evidence
  • ISO 27001 — Annex A.6.3 awareness, education & training
  • Cyber Essentials — user-awareness control evidence
In progress
On us

CyberIQ self-audit

CyberIQ itself is not yet third-party audited. Here’s honestly where we are:

  • SOC 2 Type II
    Readiness work in progress. Not yet attested. Target window shared under engagement.
  • ISO 27001
    On the roadmap, after SOC 2 readiness lands. We will not claim certification before it is awarded.
  • Internal control library
    RLS regression pack, access reviews, change management and incident runbooks — live and operating today.
Live
Disclosed

Sub-processors

The complete list of processors that may touch customer data on our behalf. Reviewed and updated quarterly; material changes communicated in advance to tenant admins.

Supabase
Managed Postgres & storage
EU / US
In-region only
PostHog Cloud EU
Product analytics
EU
Aggregated events
Resend
Transactional email
EU / US
Auth & reports

List complete as of today. The current version is always available at /sub-processors.

07 / Responsible disclosure

Found a security issue? Email us first — we’ll respond fast.

We follow a 90-day coordinated-disclosure window. Send a clear write-up and a reproducer to the inbox below; you’ll hear back within two business days. We don’t run a paid bug bounty yet, but we credit researchers in our hall of fame once a finding is remediated and disclosed.

Security inbox
security@cyberiq.cc
The process

How a report becomes a fix

1
Triage — within 2 business days
Acknowledge receipt, confirm reproducibility, assign a severity.
2
Remediate
Patch developed, staged, regression-tested against the RLS & auth assertion pack.
3
Coordinated disclosure — 90-day window
Public disclosure after remediation or at 90 days, whichever comes first. Researcher credited in the hall of fame.
Paid bug bounty
On roadmap
A formal bounty programme is on the roadmap. Until it lands, hall-of-fame recognition is the form of thanks.

Have a security question
we didn’t answer?

Talk to Sales. We’ll set up a security-led call with the people who run this platform day-to-day — not a deck.

Security inbox · 2-business-day response · 90-day disclosure window