Security at CPRCyber
You're trusting us with your worst day, so security is built into how CPRCyber works rather than added on. Here is what we do today.
Multi-factor sign-in for everyone
Every person must set up and use multi-factor authentication before they can see any organization's data.
Each customer kept separate
Access rules are enforced inside the database for every request, so one organization can never read another's data, and each role sees only what it should.
Staff can't browse your data
CPRCyber staff see only account records. If you want help, one of your admins can give a staff member an account in your organization, and remove it at any time.
Encrypted and backed up
Data is encrypted in transit and at rest, stored in the United States, and backed up daily by our database provider.
Audit log
Sensitive actions, such as sending alerts or changing contacts and roles, are recorded in your organization's audit log.
Uploads screened
Uploaded files are checked for programs, scripts, macros and other common malware carriers before anyone else can download them.
Hardened web app
A strict content security policy, server-side permission checks, and secrets kept only in our hosting providers' settings.
Checked on every change
Every code change goes through a pull request and must pass automated code scanning, dependency auditing and secret scanning before it ships.
No card numbers
Payments are handled by Stripe. CPRCyber never sees or stores your card number.
Report a security concern
If you think you've found a vulnerability in CPRCyber, email support@cprcyber.com. Security reports are always free and we'll respond promptly.
Contact supportWhat CPRCyber is, and what it is not
A tool for your team, not a response service
CPRCyber is for your own communication, planning and tracking. We don't investigate, contain or recover from incidents; that happens in your own systems with the providers you choose.
Tracking, not certification
Prepare helps you track your own readiness. It does not certify or guarantee compliance; that takes an official audit or an assessment by a certified assessor. CMMC certification is currently on hold.
Coordination, not sensitive records
Keep government data such as CUI, patient data and other sensitive records in your own systems and refer to them by name. Editions for healthcare and government data are planned as a future upgrade.