Zero-knowledge is not a policy — it is a property of the system. CYFR's architecture ensures we have no technical ability to access, inspect, or decrypt customer data.
All data is encrypted with AES-256-GCM before it leaves the client environment. Encryption keys are generated and held exclusively by the customer. CYFR servers never possess plaintext keys or unencrypted data.
Key ceremonies are performed in the customer's environment using hardware security modules. Our infrastructure facilitates key operations without ever storing key material. Key rotation is automated and customer-controlled.
TLS 1.3 with perfect forward secrecy protects all data in transit. Each session negotiates ephemeral keys independently. Compromise of one session does not compromise any other.
Every file access generates a unique, cryptographically signed URL tied to the authenticated user's session. This enables precise access auditing, granular revocation, and anomaly detection — without exposing customer data to CYFR. These URLs embed a non-reversible session identifier that allows us to respond to legal notices and abuse reports while maintaining zero-knowledge of the underlying content.
Immutable append-only logs record every access event. Organizations receive weekly audit summaries. All logs are customer-accessible via API.
Individual URLs can be revoked in real time. Bulk revocation by user, time window, or content identifier. Revocation takes effect within 60 seconds globally.
Automated monitoring detects unusual access patterns — geographic anomalies, velocity spikes, and credential sharing. Alerts are configurable per organization.
| Layer | Control | Detail |
|---|---|---|
| Physical | Tier III+ data centers | Biometric access, 24/7 guards, redundant power and cooling |
| Network | DDoS protection, WAF, IDS/IPS | Multi-layer filtering, rate limiting, threat intelligence feeds |
| Host | Hardened Linux, SELinux enforcing | Immutable infrastructure, automated patching, kernel hardening |
| Application | OWASP Top 10 mitigation | SAST/DAST in CI/CD, dependency scanning, manual code review |
| Data | Customer-siloed, encrypted at rest | Per-customer encryption keys, no shared storage tenancy |
If you believe you have discovered a vulnerability, please contact us at security@cyfr.technology. We participate in responsible disclosure and will respond within 48 hours.
For copyright or abuse complaints, please use our Abuse Reporting Portal or review our DMCA Policy.