Security
Security and data stewardship.
How Cyshel protects the data entrusted to our portfolio companies, which partners process it on our behalf, and how to report a vulnerability.
Practices
Controls in place across the portfolio.
Encrypted in transit
Every Cyshel site and API is served over HTTPS with a managed certificate. There is no plaintext path to any of our services.
Managed identity
Sign-in runs on Amazon Cognito rather than a password store we wrote ourselves. Passwords are never held by our own services, and sign-in with Google and with Apple are supported.
Card details never touch us
Payments are processed by Tranzila. Card numbers are held by the processor and never stored on Cyshel infrastructure, so a compromise of our systems cannot expose one.
Least data, on purpose
We collect what a feature needs and keep it for as long as the privacy policy says. A field nobody uses is a field we would rather delete than defend.
Monitored, not assumed
Errors and crashes are reported to Sentry so a fault is visible to us before a customer has to describe it.
Gated before it ships
Changes pass type checking, linting, automated tests and a set of required checks before they can reach production. A change that fails one of them does not merge.
Subprocessors
Partners that process data on our behalf.
These are the third parties that process data on our behalf across the Cyshel properties, and it is the same list our privacy policy names. A processor is added here before it is wired, never after.
Amazon Web Services
Hosting, databases, file storage and the sign-in service (Cognito). Data is stored in the United States.
Sign-in with a Google account and usage measurement (Google Analytics), per your consent choices on services that show the cookie banner.
Apple
Sign in with Apple and app distribution through the App Store.
Mixpanel
Product analytics, and in the Lineapp app also session replay: your screen interactions in the app are recorded to diagnose faults and improve it.
Meta
Advertising measurement (pixel), per your consent choices on services that show the cookie banner.
Sentry
Error monitoring and crash reports, to operate the service.
Tranzila
Card payment processing. Card details are held by Tranzila, never by us.
Disclosure
Reporting a vulnerability.
Write to legal@cyshel.com with the subject line Security report. Every report is read by a person, not a queue.
Email us with enough detail to reproduce the issue: the URL or endpoint, the steps, and what you observed.
Allow a reasonable window for remediation before any public disclosure. We will agree a timeline with you.
Do not access, modify or delete data that is not yours, and do not run tests that degrade the service for other people.
We will confirm receipt, keep you updated while we work, and credit you if you want to be credited.