Security Practices

Scanning is passive and non-intrusive. We query DNS, inspect TLS and HTTP response metadata, check for publicly reachable paths, and consult third-party reputation and vulnerability databases. No exploitation, no credential testing, no writes to your systems.

All traffic to the platform and to third-party data sources uses TLS. Stored data is encrypted at rest by our managed database provider.

Account data and saved scans are protected by row-level authorisation, so records are readable only by the owning account. Administrative database credentials are held in managed secret storage and are never exposed to client code.

Third-party API keys — threat intelligence, vulnerability data and AI gateway — are stored as server-side secrets and used only inside server functions. They are never sent to the browser.

Each scan records the authorisation confirmation you provide, forming an auditable trail consistent with UAE Federal Decree-Law No. 34 of 2021.

We send only the domain, hostname or IP under assessment to third-party intelligence sources. Guest scans are never written to our database.

SYBERIS is not ISO/IEC 27001 certified and holds no SOC 2 report. UAE data residency is planned for Q4 2026 and is not in place today. Continuous or scheduled monitoring is not live — all scans are on demand.

Report suspected vulnerabilities to security@syberis.ae with reproduction steps. Please give us a reasonable window to remediate before public disclosure. We do not pursue legal action against good-faith researchers who avoid privacy violations, service degradation and data destruction.