Built to sit between your agents and your most sensitive tools.
Cyproxy holds the keys to your threat intel, scanning and security platforms, so we designed it so those keys never leave it. Here's what that means for you, what's in place today and what's next.
Your integration keys never reach the agent.
API keys and OAuth tokens are encrypted as soon as they arrive and are only decrypted inside Cyproxy, for the call that needs them. Agents get results back, never credentials.
Encrypted at rest
Keys and tokens are encrypted with managed encryption keys and scoped to your account.
Write-only from the browser
Once saved, a key is never sent back to the console or shown again.
Added at call time
The key is attached to the outgoing request inside Cyproxy and never appears in a tool result.
OAuth where the tool supports it
Sign in with the tool provider instead of handling a key. Tokens refresh automatically and can be disconnected at any time.
Agents sign in. Nobody pastes tokens.
Agents connect to Cyproxy with OAuth 2.1. Claude, ChatGPT, Cursor and other clients open a browser window, you sign in and approve, and the agent gets a short-lived token.
Modern OAuth only
PKCE is required, and sign-in codes can only be used once.
Short-lived tokens
Agent access expires quickly and is renewed securely in the background.
Revoke any app
See every connected app in the console and disconnect it in one click.
Approval you can see
Every new agent asks for your approval in the console before it can connect.
Every request belongs to exactly one account.
Each request is tied to the signed-in account before anything else happens, and every lookup of keys, settings, usage and audit data is scoped to that account.
Verified on every request
Every request is checked against a signed-in account before anything else happens.
Isolation by design
One account can never read or change another account's keys, settings or logs.
Plan limits enforced server-side
Credits, rate limits and tool rules are checked in one place for every call, not in the browser.
Instant switch-off
Turn an integration off and it disappears from every connected agent straight away.
Secure by default.
Security is built into how Cyproxy is designed, deployed and tested, not added afterwards.
Encrypted in transit
Every connection to Cyproxy uses HTTPS.
Safe connections to your platforms
Self-hosted tools such as OpenCTI and MISP are only reached over secure public endpoints that you provide.
Hardened web app
The website and console follow current browser security best practice.
Tested continuously
Security checks are part of how every change is built and released.
What we keep, and for how long.
Calls pass through Cyproxy on their way to the tool. We keep only what's needed to run the service and give you an audit trail.
| Data | Why | Kept for |
|---|---|---|
| Audit log | Tool, outcome and time of each call, so you can review what agents did; on Teams and Enterprise, its arguments too | 7, 90 or 365 days by plan |
| Integration credentials | To call the tools you connect | Until you remove them |
| Usage counts | Monthly credits and limits | Life of the account |
| Service logs | Security, abuse prevention and troubleshooting | 30 days |
Most integrations are the provider's own MCP server, called with your account. For a few providers without one, Cyproxy runs a thin adapter that calls the provider's API for you; each integration page says which. Full details are in our privacy policy.
Privacy and data protection.
Cyproxy is run from the UK by Lowside Intelligence Ltd.
Data protection
We collect only what we need, and you can ask for your data to be exported or deleted.
Where data is processed
Account data, keys and audit logs are encrypted at rest. Who processes what, and where, is set out in our privacy policy.
Trusted providers
We use a small number of established infrastructure providers; the list is available on request. Tools you connect process calls under your own agreement with them.
DPA on request
A data processing agreement is available for Enterprise customers.
What's coming next.
We'd rather tell you what isn't done yet than let you assume it is.
Found something? Tell us.
If you think you've found a security issue, email security@cyproxy.io with the details and steps to reproduce. We'll reply quickly and keep you updated. Please don't access other people's data or disrupt the service while testing.
Need more for your security review?
// questionnaires, architecture details and a DPA on request