Security & Compliance

What we actually verified — and what we haven't.

This page describes the platform's real architecture and its own verification practice. It is not a substitute for a third-party audit, and we say exactly where one hasn't happened.

Sensitive-domain isolation

Healthcare module

Its own service, routes, and frontend module — verified unreachable from the general Content Factory framework, and vice versa
Read-only by design: no create/edit/delete route exists for case records at all
No identifying schema field — case pipeline tracks only a non-identifying reference, stage, region, and consent status; never a name, DOB, diagnosis, or clinical note
No AI-generation feature — there is no text box that sends anything to a model, removing the possibility of PHI reaching an AI context

MSP / cybersecurity module

Fully separate architecture from both Content Factory and Healthcare — verified unreachable in both directions
Read-only, no credential field of any kind — confirmed via direct API test: POST/DELETE on any collection returns 404
Sample data uses IANA-reserved, guaranteed-non-real identifiers (TEST-NET ranges, example.com) — not just obviously-fake-looking placeholders
“Not production scanning” warnings appear on every scan-related field

How the platform treats automation and secrets

Confirmation-gated actions

Destructive or automated actions — container restart/stop, git push/pull/sync, content publishing — show the exact action before it runs. Nothing executes silently.

Secrets stay server-side

Settings exposed to the frontend are non-secret configuration only (URLs, ports). API keys are never sent to the client.

Fixed, not hidden, when found

A reliability gap — unprotected process-exec calls that could crash the server under memory pressure — was found and fixed as shipped work, not swept into a quiet known-issues list.

Compliance status, reported honestly

The Healthcare module's own Compliance Status and Regional Compliance views report real, current state: no HIPAA-compliant storage is connected yet, and no region has a completed compliance review. These are not placeholders waiting to be filled with better-looking numbers — they are the current, accurate state.

No third-party certification today

CyberPro AI OS does not currently hold SOC 2, ISO 27001, or HIPAA certification. If your deployment requires one, say so on the Contact page — we'll tell you plainly whether and when that's feasible rather than implying it's already in place.

Questions about a specific deployment?

Contact us →