Built carefully. Explained honestly.
Cyte is a young company, and this page doesn't dress that up. What it does do: say exactly how your data is handled today, what's live in the product, and what we're still working toward.
If you need a DPA, a security questionnaire, or a specific answer — email security@cyte.si.
Encryption at rest and in transit
Everything sensitive is AES-256-GCM at rest — including your stored API keys, prompt data, and run results. TLS 1.3 for anything moving between your browser and our servers. Database volumes are encrypted at the infrastructure level by the hosting provider.
API key handling
When you bring your own OpenAI, Google, Perplexity, DeepSeek, or Grok keys, they’re encrypted before storage, kept in a separate table from your workspace data, and never written to logs. You can rotate or revoke them anytime from Settings.
Input validation on sensitive endpoints
Authentication, billing, and data-mutation endpoints validate inputs through Zod schemas before executing. Malformed payloads fail fast at the gate. We’re expanding this coverage across more endpoints each release — it’s not everywhere yet, and we’d rather tell you than claim otherwise.
Data retention you control
Raw LLM responses kept per your plan’s retention window (90 to 730 days). Aggregated metrics kept for plan duration. Workspace deletion triggers soft-delete immediately, then hard-purge across all backups within 30 days.
Rate limiting
Per-user rate limits on all expensive actions — runs, site crawls, analysis. Redis-backed rolling windows. Abuse patterns trigger automatic lockouts. API keys get their own per-key limit.
Audit log (enterprise)
Enterprise workspaces get a full customer-facing audit log: who did what, when, from where. Every settings change, data export, key rotation, and member action is recorded. Exportable as CSV.
What's real today.
We don't list SOC 2 or ISO 27001 on this page because we don't have them yet. When we do, we'll say so. Until then, we won't pretend.
The promises we won't make.
· We do not use your brand data, your prompts, your content, or your LLM keys to train any model — ours or anyone else's.
· We do not share workspace data across tenants. Every database query is scoped by workspace ID at the application layer.
· We do not sell, rent, or aggregate customer data for any secondary purpose. No data brokering, no lookalike marketing.
· We do not pretend to have certifications we don't. When SOC 2 is done, we'll say so. Until then, we don't claim it.
· We do not promise uptime. Cyte is still in beta, run by a small team, and we only promise what we can back.
Have a specific security question? Need the DPA or a SIG-Lite questionnaire?