Skip to main content
Security

How we secure Ciyora Fabric

A security platform has to hold itself to a higher standard than the systems it protects. These are the controls built into Ciyora Fabric, and how to tell us if you find a problem.

Platform controls

Architecture details are on the platform page. We share deeper documentation with customers and prospects under NDA during security review.

Tenant isolation
Every customer is a separate tenant. The tenant for a request comes from the organization in the signed-in user’s token and is checked on every API call, and data access is scoped to that tenant. Ingest endpoints take the tenant from the API key, never from the request body.
Encryption
All traffic is encrypted in transit: TLS for the console, API and ingest, and WireGuard for the mesh. Sensitive values such as vault secrets and connector credentials are encrypted with AES-GCM under a data key unique to each tenant, itself wrapped by a master key.
Hash-chained audit
Audit entries form a per-tenant SHA-256 chain over a canonical form. Appends are serialised, updates and deletes are blocked in the database, and the chain can be verified in the browser and on the server.
Outbound-only components
Site gateways, collectors and Ciyora Client connect outward to Ciyora Fabric. Customers do not open inbound ports for Ciyora.
Sign-in and sessions
Ciyora Console uses the OAuth authorization code flow with PKCE, run on the server, so access tokens never reach the browser. The session cookie is encrypted and HTTP-only, sessions have a maximum lifetime, and cross-origin writes are refused. Sender-constrained tokens (DPoP) are supported.
Step-up for the most sensitive actions
Revealing a privileged credential can require a hardware security key (WebAuthn) in addition to the user’s session.
Secrets are write-only
Connector credentials, model provider keys, SSO client secrets and enrolment keys are never shown back in the console after they are saved; enrolment keys are shown once at creation.
Hosting
Hosted in India · data stays in India. Data processing follows DPDP Act 2023 obligations.
Responsible disclosure

Report a vulnerability

If you believe you have found a security vulnerability in Ciyora Fabric, Ciyora Console, Ciyora Client or ciyora.com, please email us. We read every report.

Security reports

Please include

  • A description of the issue and its impact
  • Steps to reproduce, with the affected URL, component or version
  • Any proof-of-concept code or screenshots, and how we can reach you

We ask that you

  • Test only against accounts and tenants you own, or with the owner’s permission
  • Do not access, change or delete other customers’ data, and stop as soon as you see any
  • Avoid denial-of-service testing, spam and social engineering of our staff or customers
  • Give us reasonable time to fix the issue before you disclose it publicly

In return, we will

  • Acknowledge your report and keep you informed as we investigate
  • Not pursue legal action for good-faith research that follows these guidelines
  • Credit you when we announce the fix, if you would like

Privacy questions and requests go to our grievance officer at privacy@zpoa.com. See the privacy notice.