Security & operational controls

This page summarizes the security posture of ProcessPrint and related Cybersavvy AI services for customers evaluating production deployment. It is intended for technical and procurement review.

1. Transport security

• Public services are served exclusively over HTTPS (TLS) via Traefik with automated certificate issuance.
• HTTP requests are redirected to HTTPS.
• Security response headers are enforced at the edge, including:
  • Strict-Transport-Security (HSTS, includeSubDomains, preload)
  • Content-Security-Policy
  • X-Frame-Options: DENY / frame-ancestors none
  • X-Content-Type-Options: nosniff
  • Referrer-Policy: strict-origin-when-cross-origin
  • Permissions-Policy restricting camera, microphone, and geolocation

2. Application architecture

• Services run as isolated containers on a dedicated VPS.
• Edge routing is centralized through Traefik; application ports intended for internal use bind to localhost wherever practical.
• ProcessPrint application traffic terminates at the edge and is proxied to an internal container bind.
• Host firewall (UFW) defaults to deny and restricts non-essential published container ports.

3. Data handling

• Customer process definitions, operational logs, and account data are stored in service-specific application storage with access limited to platform operators.
• Secrets (API keys, integration credentials) are stored outside web roots and injected at runtime; they are not embedded in public JavaScript or static HTML.
• Customer content is not used to train public foundation models under Cybersavvy AI control.
• Chat and automated systems may use third-party model providers (currently via OpenRouter) for inference. Customers should avoid submitting regulated special-category data unless contractually scoped.

4. Identity & access

• Server SSH access is key-based; password authentication is disabled.
• Root SSH is limited to key authentication.
• Administrative access to production systems is restricted to Cybersavvy AI operators.
• Application admin surfaces use authentication controls appropriate to each product (including dashboard authentication on ProcessPrint where enabled).

5. Availability & operations

• Containers are configured with restart policies for service continuity.
• Backups are maintained for ProcessPrint application data under operator-controlled backup paths.
• Service health endpoints are used for critical public components (for example chat widget health).
• Incident response is operator-led with direct customer communication via chris@cybersavvyai.com.

6. Subprocessors & dependencies

Category	Examples	Purpose
Infrastructure	Hostinger VPS, Docker, Traefik, Let’s Encrypt	Compute, containers, TLS edge
AI inference	OpenRouter and upstream model providers	Language model completion for agents/chat
Payments / commerce	Gumroad; Stripe where configured	Subscriptions and product checkout
Analytics	Plausible	Privacy-oriented web analytics
Email delivery	Customer SMTP / Gmail app mail where configured	Transactional notifications
Integrations	Clio, QuickBooks, Google, Microsoft, CRM APIs	Customer-authorized system connectivity

Subprocessor inventories can evolve. Contact us for an updated list when required for vendor risk review.

7. Customer responsibilities

• Grant least-privilege credentials for connected systems.
• Maintain lawful basis for any personal data processed through automations.
• Avoid HIPAA / protected health use cases—Cybersavvy AI does not offer a BAA or HIPAA-eligible environment.
• Review agent outputs before high-impact external actions where policy requires human approval.

8. Compliance posture

9. Contact

Security and procurement inquiries: chris@cybersavvyai.com
Product: processprint.cybersavvyai.com

Last updated: 2026-07-30 · Cybersavvy AI