Trust Center
Security, privacy, compliance, and transparency buyers can trust.
At Cayosoft, protecting customer data is not an add-on. It is a core responsibility built into how we design, develop, operate, and support our solutions. We take a disciplined, security-first approach to safeguarding the systems and information our customers rely on, with practices focused on privacy, resilience, compliance, and transparency.
Our Trust Center brings together the policies, controls, commitments, and resources customers need to evaluate Cayosoft with confidence and understand how we protect their data at every stage of the customer relationship.
Start your review here:
Privacy & Data Protection
Our Privacy Commitment
Cayosoft treats privacy and data protection as a business-critical commitment. We handle personal information with care, accountability, and discipline, and we design our practices to support responsible processing, customer trust, and compliance with applicable privacy laws and contractual obligations.
Security & Compliance
Secure Development Lifecycle (SDLC)
Cayosoft is designed to help organizations monitor, protect, and recover identity systems across Microsoft Active Directory, Microsoft Entra ID, Intune and Microsoft 365. Because identity represents a critical control plane in modern environments, Cayosoft applies security-by-design principles throughout the SaaS and on-premises platform lifecycle.
Cayosoft builds security into the way our products are designed, operated, and supported. We apply technical and organizational safeguards to help protect customer information, preserve the integrity and availability of our services, and give procurement, security, and compliance teams the information they need to evaluate Cayosoft with confidence.
Controls are applied from design through deployment and ongoing maintenance.
- Security considerations are incorporated during product design and architecture reviews
- Code changes undergo peer review prior to release
- Automated testing and penetration testing is used to validate functionality and reduce regression risk
- Regular patching and update processes are applied to the SaaS platform
- Reported security vulnerabilities are assessed, prioritized, and remediated
Compliance and Certifications
Cayosoft provides security and compliance documentation to help procurement, security, legal, and compliance teams complete vendor evaluations with confidence. Our resources are designed to give buyers a clear view of the safeguards, operating practices, and commitments that support responsible use of Cayosoft solutions.
Security & Compliance Questionnaires
Cayosoft completes security and compliance questionnaires to support customer and prospect vendor reviews. Please work with your Cayosoft sales representative or customer success representative to submit questionnaire requests and coordinate completion. If you are unsure who your representative is, please complete this form and a Cayosoft team member will route your request appropriately.
Additional Security and Compliance Documentation (NDA-gated)
Additional security and compliance documentation may be available to qualified customers and prospects under NDA. To request access, contact your Cayosoft sales representative or customer success representative. If you are unsure who to contact, complete the request form and a Cayosoft team member will route your inquiry appropriately.
- SOC 2 Type II report
- Pen test summary
- Detailed control documentation
- Business Continuity and Disaster Recovery Plan
- Cayosoft Security Policy Guide
Cayosoft on Responsible AI
Learn more about Cayosoft’s responsible artificial intelligence development as well as
vision for AI in identity resilience: https://www.cayosoft.com/ai/.
- AI in marketing: See our Privacy Policy for use of AI on our website and in our marketing.
- AI in products: See our Terms of Service for the use and controls of artificial intelligence in our products.
Sub-Processors
Authorized Sub-Processors
Cayosoft works with trusted third-party service providers only when needed to deliver, operate, secure, and support our services. Sub-processors are reviewed to help ensure they meet Cayosoft’s expectations for security, confidentiality, privacy, and operational reliability.
Procurement and compliance teams can use the sub-processor list to understand which providers may support Cayosoft services, the purpose of their processing, and how Cayosoft manages oversight of those relationships.
| Subprocessor | Link to Website | Purpose | Location |
|---|---|---|---|
| Maxio | Visit | Billing and subscription management | US |
| Salesforce | Visit | Customer Relationship Management (CRM) platform | US |
| HubSpot | Visit | Customer management and marketing tool | US |
| Zendesk | Visit | Support ticket management system | US |
| SendSafely | Visit | Secure attachment management integrated with Zendesk | US |
| Microsoft M365 | Visit | Business operations including Office, email, Teams, and SharePoint | US |
| Microsoft Azure | Visit | Infrastructure as a Service | US / EU |
Support & Security Reporting
Product Support
Cayosoft customers can access support resources, submit support requests, and find guidance for product-related questions through the Cayosoft Support page: https://www.cayosoft.com/support/
Support hours vary by support level:
- Standard Support Hours: Monday through Friday, 8AM to 8PM, Eastern Time (ET), excluding U.S. holidays.
- Professional Support Hours: Monday through Friday, 24×5, Eastern Time (ET), excluding U.S. holidays.
- Enterprise Support Hours: 24×7 for Guardian Forest Recovery P1 issues; 24×5 for all other products and features.
Response times and service level commitments may vary based on the customer’s support plan, agreement, issue severity, and the nature of the request. Critical issues are prioritized in accordance with the applicable support terms.
Report a Vulnerability or Security Concern
Cayosoft takes security reports seriously and provides a clear path for customers, partners,
and security researchers to report potential vulnerabilities or security concerns involving Cayosoft products or services. To report a concern, please email securityincident@cayosoft.com.
Cayosoft appreciates responsible disclosure from security researchers, customers, and partners. Reports are reviewed by the appropriate security team members and investigated through established response procedures so issues can be assessed, prioritized, and addressed responsibly.
Legal Resources
Legal Documentation
Cayosoft makes key legal and privacy resources available to help buyers complete vendor review, understand contractual terms, and evaluate privacy obligations before purchase or renewal.
Trust Center Updates
Subscribe for Updates
Cayosoft keeps Trust Center resources current so customers and buyers can stay informed about updates that may support vendor governance, compliance review, privacy assessments, and security evaluations.
- New or updated Trust Center resources
- Changes to Cayosoft sub-processors
- Security-related announcements
- Privacy policy or data protection updates
- Compliance documentation updates
- Availability of new customer-facing security or procurement resources
Trust Center Frequently Asked Questions
We offer two deployment models:
Customer-hosted: Runs in your environment; we do not host your business content. The product processes directory/configuration metadata you select; retention is under your control; no Cayosoft employees or systems have access to your deployment and its data.
SaaS: The SaaS solution acts as a processor/service provider that hosts personal data and other data from your enterprise directory (Active Directory, Entra ID), including product log files. Scope and retention follow the Agreement/DPA.
Customer-hosted: On-prem or your cloud (e.g., Azure/AWS). Residency/sovereignty are customer-controlled. No Cayosoft employees or systems have access to your deployment and its data.
SaaS: International transfers use approved safeguards (e.g., EU SCCs, UK/Swiss addenda as applicable). Data location and transfer mechanisms are documented in the DPA and service documentation.
In transit TLS 1.2/1.3; at rest AES-256 (or storage-provider equivalent). Customer-managed keys/KMS/HSM supported where applicable. Immutable/WORM or air-gapped storage is supported per your architecture (customer-hosted) or via the service’s supported options (SaaS).
SSO/MFA via your IdP (AD/Entra ID). Least-privilege RBAC with admin/read-only roles and support for approval workflows/four-eyes for sensitive operations. Break-glass procedures are documented. JIT/PIM can be integrated with your controls (e.g., Entra PIM).
Customer-hosted: Support for multiple backups per day, integrity checks, test restores, granular through full recovery, including staged/sandbox and cross-site/tenant scenarios; the actual frequency and RPO/RTO depend on environment size, design, and configuration.
SaaS: Backups follow documented schedules with integrity controls; upon termination or request, data is deleted, subject to legal/backup retention windows, with written certification available per the DPA.
Detailed audit/operational logs (who/what/when), job telemetry, and security events. Customer-defined retention/export to SIEM (e.g., syslog/API/Sentinel) is supported. For SaaS, security and access logging is maintained for operations and compliance; retention and access are defined in service documentation and the DPA.
Secure SDLC with code reviews and automated testing; signed releases and SBOM available. Independent security assessments/penetration tests are performed periodically and summary reports are available under NDA. Regular release cadence plus expedited patches for critical issues; customers control upgrade timing in customer-hosted deployments. Independent audit reports (e.g., SOC 2 Type II or comparable) may be provided to satisfy audit requests under NDA.
Documented IR playbooks with severity definitions, forensics support, and customer communications. For SaaS, we notify customers without undue delay in accordance with applicable law and the DPA; we cooperate on investigation, mitigation, and remediation. For customer-hosted deployments, incidents are typically contained within your environment; we provide guidance/support.
Alignment with industry frameworks (including SOC 2, CMMC 1, and CISA Secure by Design). The DPA addresses roles (Controller/Processor or Business/Service Provider), GDPR/UK GDPR/CCPA obligations, audit rights, DPIA assistance, return/deletion on termination, and SCCs for international transfers. We do not sell or share personal data under the CCPA.
Sub-processors for SaaS, if used, are under written terms no less protective than the DPA. Cayosoft maintains a public list of sub-processors on the Trust Page and provides at least 15 days’ advance notice for additions or replacements. You may sign up for notifications in our Trust Center.
Each customer environment is logically isolated with separate encryption and RBAC boundaries.
Support offerings include business-hours and 24×7 options with defined response targets. Maintenance windows and upgrades are scheduled to customer needs for customer-hosted deployments.
Roadmap transparency is available under NDA.