CyberICS Solutions is built by security practitioners, for security practitioners. Here is an unvarnished look at how we protect your data, your clients, and your exercises.
Last updated: March 2026 · Questions? security@cybericsolutions.com
All sensitive data is encrypted in transit and at rest using industry-standard cryptographic algorithms.
Defense-in-depth controls applied across every layer of the application stack.
| Control | Implementation | Status |
|---|---|---|
| Content Security Policy (CSP) | Strict CSP headers applied to all responses, restricting script/style/connect sources to known allowlisted origins. | Live |
| XSS Sanitization | All user-supplied content is escaped and sanitized before rendering. Input validation and output encoding is enforced across all user-facing rendering paths. | Live |
| CORS Allowlist | All Edge Functions enforce an explicit CORS allowlist. Requests from origins not in the allowlist receive a blocked CORS response regardless of JWT validity. | Live |
| Rate Limiting | AI functions enforce per-user call limits (coach: 10/session, AI analysis: 5/hr). Webhook delivery is throttled. Prevents abuse and runaway API costs. | Live |
| Payment Webhook Verification | Billing webhook events are cryptographically signed and verified before any subscription change is processed. Replayed or tampered events are rejected. | Live |
| Idle Session Timeout | Authenticated sessions automatically expire after a configurable inactivity period. Back-button bfcache exploit mitigated via page visibility event listener. | Live |
| Row-Level Security (RLS) | Every database table enforces row-level isolation policies. Users can only read or write their own records. Cross-tenant data access is prevented at the database layer. | Live |
| DNS TXT Domain Verification | SSO domain registration requires cryptographic proof-of-ownership via DNS before any identity provider is activated. Prevents unauthorized domain registration and spoofing. | Live |
| noindex on Sensitive Pages | Platform pages (portal, exercise runner, admin tools) carry noindex meta tags to prevent search engine indexing of authenticated-only surfaces. |
Live |
| Penetration Testing | Annual third-party penetration test against web application and API surface. First test scheduled Q2 2026. Results summary will be published on this page. | Q2 2026 |
| Bug Bounty Program | Formal bug bounty program with defined scope and reward tiers. Launch planned alongside SOC 2 Type II completion. | Planned |
CyberICS's infrastructure stack is built entirely on SOC 2 and PCI DSS certified providers. We inherit their security controls and undergo their audit programs. Full sub-processor identities are available in our Enterprise Security Package.
Every access path to customer data is gated by authenticated, role-scoped controls.
We are committed to achieving SOC 2 Type II certification and will publish the report summary when complete.
We collect only what is necessary to operate the platform. We do not sell, broker, or share customer data with third parties for advertising purposes.
We welcome responsible security research on our platform. If you discover a vulnerability, please report it to us privately before public disclosure.
Send a detailed report to security@cybericsolutions.com with:
1. Description — A clear description of the vulnerability type (e.g., XSS, IDOR, SSRF, auth bypass)
2. Steps to reproduce — Detailed reproduction steps and any proof-of-concept
3. Impact — Your assessment of what data or functionality is at risk
4. Your contact — So we can keep you informed and credit you if desired
We will acknowledge receipt within 2 business days and aim to remediate critical findings within 14 days. We request that you do not publicly disclose findings until we have had the opportunity to remediate.
Safe Harbor: We will not pursue legal action against researchers who follow this policy and act in good faith. We consider this policy a legal authorization for security research within its defined scope.
Out of scope: Social engineering attacks against CyberICS staff, denial-of-service testing, physical security testing, or attacks against customer accounts without their explicit written consent.
We provide a comprehensive security documentation package to qualified enterprise prospects and their security teams.
For security reports, questionnaires, or enterprise security reviews.
Security vulnerabilities, compliance questionnaires, pen test report requests, or enterprise procurement security reviews — we respond within 2 business days.
✉ security@cybericsolutions.comFor general inquiries: info@cybericsolutions.com · Privacy requests: privacy@cybericsolutions.com