Security

1. How we protect data

• In transit. Cyrano’s connections to its database and to other services are encrypted, with HTTPS or TLS.
• At rest. Our database provider, Supabase, and our hosting provider, Vercel, state that they encrypt the data they store.
• Stored keys. The keys that connect Cyrano to a store and a helpdesk, and the real values behind the placeholders that hide shoppers’ details, are stored encrypted with AES-256-GCM.
• Access. The database lets a merchant’s sign-in read only that merchant’s data. Our staff tools run on a separate site that only invited staff can sign in to, and that site refuses every request if its sign-in is not set up.
• Record of actions. The actions the agent and people take are written to a record that no one can delete, and that changes only when an erasure removes the details in it or the account it belongs to is deleted. Each entry is chained to the one before, so a change breaks the chain.
• Data masking. Before shoppers’ details reach an AI model, Cyrano replaces the personal details it recognises, such as names, email addresses, phone numbers and street addresses, with placeholders; the first name, the email’s domain, city and country stay visible. A merchant can switch masking off for an agent: that agent’s own requests then carry the shopper’s details as written, while Cyrano’s own checks and its memory writing keep the placeholders.
• Reply checks. Before a reply goes to a shopper, Cyrano checks it for secrets, internal system details and harmful content. A reply that would reveal sign-in details, or is harmful, is stopped and the conversation is handed to the merchant; for a smaller problem, the agent rewrites the reply.
• Code checks. The app’s build fails if new code can post a reply to a shopper outside the one path built for it, and each commit is checked for secrets before it is saved.
• Backups. Supabase makes a backup of the database every day. How long backups are kept is in the Privacy Policy.

2. Incident policy

An incident is anything that puts personal data at risk: data that is lost, changed, seen by someone who should not see it, or unavailable when it is needed.

2.1 How serious it is

• High: personal data was, or may have been, seen or taken by someone who should not have it, or was lost.
• Medium: personal data was at risk, or wrong, or unavailable for a time, and no one who should not have it is known to have seen it.
• Low: a weakness or a near miss, with no personal data affected.

2.2 Who leads

Elevate Digital Media AB leads every incident response. Its contact address is security@meetcyrano.com.

2.3 How we notice

• Sentry emails the people on Cyrano’s Sentry account when an error in the Cyrano app becomes high priority.
• When the check on outgoing replies stops a reply, the ticket is flagged to the merchant with the reason.
• We read our record of actions when we investigate.
• The companies that run parts of Cyrano tell us about incidents on their side.
• Anyone can report a problem to security@meetcyrano.com.

2.4 How we contain it

• Switch the affected agents to wait for the merchant’s approval before they send anything or act in the store.
• Disconnect an affected store or helpdesk.
• Roll back to an earlier version of the Cyrano app.
• End people’s sign-in sessions.
• Replace a key for an outside service, or ask the merchant to connect a store or helpdesk again.

2.5 Who we tell, and how fast

Merchants. For personal data we handle for a merchant, our Data Processing Agreement sets the notice:

Shopify. If a breach affects data from a Shopify store, we tell Shopify within 24 hours of becoming aware of it, as Shopify’s terms for apps require.

IMY. For personal data we decide about, we tell the Swedish Authority for Privacy Protection (IMY) within 72 hours of becoming aware of a breach, unless it is unlikely to put anyone at risk, as Article 33 of the GDPR requires. If it is likely to put people at high risk, we also tell them without undue delay.

Shoppers. For shoppers’ data, the merchant decides whether to tell IMY and the shoppers, and we help.

2.6 How we record incidents

We write down every incident, whether or not we had to report it: what happened, which data was affected, what we did, whom we told, and why we did or did not report it.

3. Report a problem

To report a security problem or a possible breach, write to security@meetcyrano.com.