Trust and security
How we run our own security.
We sell software for managing cybersecurity, so it is fair to ask how we manage ours. This page is what a security reviewer or a procurement team usually asks for, in one place.
ISO/IEC 27001
We are working towards ISO/IEC 27001 certification, and the certification audit is in progress.
The management system behind that audit runs in Cyberismo, and has done for a long time. In June 2026 we moved it to Cyberismo Cloud, the same hosted service we sell to customers. The risk register, the controls, the evidence and the policy checks our certification auditor looks at are the ones the product produces, on the service you would be buying.
The management system is in place and running, but the certificate has not been issued yet. If your timeline depends on the certificate, ask us where the audit currently stands.
Cyberismo Cloud
Reviewers usually ask first where the content is stored and who owns it.
Your content stays in Git
A Cyberismo project is an ordinary Git repository of AsciiDoc and JSON files. Moving to Cloud is a matter of pointing the hosted tenant at your repositories, on whichever host you already use, such as GitHub, GitLab, Azure DevOps, Bitbucket or a server of your own.
There is no proprietary store to import into, so there is nothing to migrate on the way in and nothing to extract on the way out. Your security documentation keeps the branches, reviews, history and diffs it had before.
Your content stays yours
It is plain text you can read without us and without the application. There is no export to request, because the working format and the portable format are the same thing.
If you stop paying, the content keeps working. The open-source tool still opens it, including everything a subscription module has already put into your project. Only the module updates stop.
The operational controls
Tenant isolation
Each customer runs in a dedicated, network-isolated instance of the application.
Authentication and access
OIDC authentication with role-based access control for administrators, editors and readers, and optional federation to your Microsoft Entra ID or another identity provider.
EU data residency
Data is processed and stored exclusively on EU-based infrastructure and is not replicated to other jurisdictions.
Transport security
TLS throughout, between your browser and the service and between the service and your repositories.
Monitoring and backups
Infrastructure monitoring and automated backups, operated by us. Your team does not need to run any servers.
Open-source compatible
Cloud runs all the content that the open-source Cyberismo application runs, so a project can move between Cloud and a self-hosted setup.
Where your content lives
In all three cases your content can live in your own Git repositories. The difference is who runs the software.
Your own infrastructure
The open-source tool runs on your machines and in your CI/CD pipeline. Your content lives in your own Git repositories and never reaches us. Free, and where most teams start.
Cyberismo Cloud
We run the application in your own isolated tenant on EU infrastructure, with the controls listed above. Your content stays where it already is, in your own Git repositories, and we run the application against them. This is the option we recommend.
A custom deployment
Some regulated environments require the software to run inside your own perimeter. The application is the same one, and we can deploy and support it there. This is a custom deployment rather than a standard offering: scoped to your environment, priced on top of the subscription, and agreed case by case.
Reporting a vulnerability to us
Vulnerabilities in the Cyberismo software go through the GitHub security advisory channel. Anything else goes to our security address, which is published with its encryption details in our security.txt.
We acknowledge reports within five working days. The full process is in the vulnerability disclosure policy.
Policies and documents
Security policy
Our own policy statement: risk-based management, and the commitments behind it.
Vulnerability disclosure policy
How to report a vulnerability to us, and what we do when you do. Acknowledgement within five working days.
RFC 9116 security.txt
Machine-readable contact details, including how to encrypt email to our security address.
EU Data Act information
Switching, portability and the contractual terms that apply to Cyberismo Cloud.
What to ask us for
The data processing terms, the sub-processor list and the international transfer provisions are part of the Cyberismo Cloud Agreement and its appendices, which we send on request. If your review needs something that is not on this page, such as a specific control mapping, service levels or the current state of the certification audit, ask us.
Contact
- 01
A short conversation
Thirty minutes on what you are trying to achieve and which standards apply.
- 02
A concrete proposal
Which modules, hosted or self-run, what adoption support you would want, and what it costs.
- 03
You try it first
We recommend that your team tries the open-source version before you buy anything.
Cyberismo is based in Tampere, Finland. We work smoothly with teams anywhere in the world.