Everything we ask customers to do, we do ourselves. Here's how we protect your data.
Certified to ISO/IEC 27001:2022. We certified early, before it was commercially necessary, because it validated our own platform.
| Standard | ISO/IEC 27001:2022 |
| Certification Body | Prescient Security LLC |
| Scope | CyberHeed platform and operations |
| Surveillance | Annual surveillance audits |
| Recertification | Three-year cycle |
We chose to certify early, before customers required it. If CyberHeed helps organisations achieve ISO 27001, we should demonstrate it works by using it ourselves.
Our ISMS covers the entire platform. When we improve CyberHeed, we experience those improvements as users first.
Each organisation's data is logically isolated at the database level. Isolation is enforced at the application layer and validated through automated testing in our CI/CD pipeline.
Evidence files are stored in encrypted S3 buckets with per-organisation key separation. Access controlled through application-layer authorisation.
Access governed by RBAC enforced at both application and API layers. Every permission grant and revocation is logged.
All administrative actions logged in append-only, tamper-resistant storage. Logs include timestamp, actor, action, target, and outcome for every auditable event.
AI interactions are scoped to your organisation's data only. No cross-contamination between organisations.
Your compliance data is never used to train AI models. Policies, evidence, conversations: none of it.
Human in the loop. All AI-generated content is presented for your team to review before it becomes part of your compliance record.
Independent third-party testing covering web application, API, authentication, authorisation, data isolation, and infrastructure.
Automated scanning across infrastructure and application stack. Critical vulnerabilities prioritised for immediate remediation.
Documented procedures covering detection, assessment, containment, eradication, recovery, and post-incident review. Managed on CyberHeed.
All team members complete training. Phishing simulations, secure development practices, and incident reporting tracked as ISMS controls.
Third-party suppliers assessed against security requirements covering data handling, access controls, and compliance posture.
BCP and DR plans documented, tested, and reviewed. Backup procedures automated. RPO and RTO defined and tested regularly.
Questions we hear most often from security teams evaluating CyberHeed.
We're transparent about how we protect your data. Questions about security practices, certifications, or data handling? We're here.