Privacy Policy — Cybertis Platform
Last updated: 18 September 2026
1. Introduction and scope
1.1. This policy describes how Cybertis Ltd., company no. 36741742, 58 HaBanim Street, Herzliya, Israel ("Cybertis", "we") collects, uses, retains and protects information in the compliance management platform at platform.cybertis.co.il, including the client portal, the Trust Center, public forms and the applications used to connect third-party systems — among them "Cybertis Connectors" for Microsoft 365 / Entra ID, Google Workspace, GitHub and monday.com (the "Platform").
1.2. This policy supplements Cybertis's general privacy policy, published at www.cybertis.co.il/privacy-policy, which covers the marketing website and the company's contact channels. The principles are the same — data minimisation, transparency, no sale of data and security in line with the law — and this document details how they are applied in the Platform. For data processed in the Platform, this policy prevails in case of conflict.
1.3. Cybertis's Data Protection Officer (DPO): Rotem Shynes. Contact: privacy@cybertis.co.il · +972-3-3030151.
2. Our role: controller or processor
2.1. Client data. For data the Client enters into or connects to the Platform (details of employees, suppliers and data subjects, identities and permissions from connected systems, evidence and documents), the Client is the controller of the database and Cybertis acts as processor ("holder" under Israeli law) on its behalf, under its instructions and in accordance with the Services Agreement and the data processing agreement. Data subjects who wish to exercise rights over such data should contact the relevant organisation; a request that reaches us will be forwarded to the Client without delay.
2.2. Platform user data. For users' account details, activity and security logs and support requests, Cybertis is the controller.
3. Data we process
| Category | Details | Source |
|---|---|---|
| Account details | Name, email, phone (if provided), organisation, role and permissions, interface language, hashed password, encrypted two-factor secret | The user / client administrator / Cybertis |
| Security and usage logs | Sign-in times, IP address, browser type, actions performed (audit log), failed sign-in attempts | Collected automatically |
| Compliance content | Questionnaires and answers, risk assessments, asset and database inventories, procedures, evidence, tasks, findings, reports | The Client and Cybertis staff |
| Workforce data | Employee name, work email, department, role, manager, start and end dates, training status and onboarding/offboarding workflows | The Client (entry, file import or Connector) |
| Connector data | Identities and permissions from the systems the Client connected — see section 4 | The system provider, as approved by the Client's administrator |
| Public submissions | Data subject requests (DSAR), supplier answers to security questionnaires, Trust Center document access requests — including name, email and the content of the submission | The submitter |
| Communications | System notifications and emails sent, support requests | The user / the system |
We do not collect data in the Platform for advertising purposes, and we do not buy personal data from third parties.
4. Connectors to third-party systems
4.1. Principles. A connection is made only at the Client's initiative and with the approval of an administrator acting for the Client. Permissions are read-only, except for specific write capabilities the Client expressly enables. The sole purpose is an identity and access inventory, access reviews, security metrics and compliance evidence for that Client.
4.2. What Connectors do not read. Connectors do not access, in the Client's systems, the content of email messages, files and documents (OneDrive, SharePoint, Google Drive), chats, calendars or source-code repositories, and we do not receive or store end users' passwords.
4.3. Details by provider:
| Provider | Connection method | Permissions | Data read |
|---|---|---|---|
| Microsoft 365 / Entra ID — "Cybertis Connectors" application | Admin consent by a Global Administrator; Microsoft Graph application permissions | User.Read.All, Group.Read.All, Organization.Read.All, RoleManagement.Read.Directory, AuditLog.Read.All, UserAuthenticationMethod.Read.All, Reports.Read.All, Policy.Read.All, IdentityRiskyUser.Read.All | Users and guests (name, UPN/email, type, status), groups, admin roles, licences, MFA registration status and types of authentication methods (not the method details themselves), last sign-in time, Conditional Access policies, risky users, organisation details and subscriptions |
| Google Workspace | OAuth 2.0 by a Workspace administrator (or the Client's own service account) | openid, email, admin.directory.user.readonly, admin.directory.group.readonly, admin.directory.orgunit.readonly; with separate approval: admin.reports.audit.readonly, admin.directory.device.mobile.readonly | The approving administrator's email address (to verify it is a Workspace account); users, groups, organisational units, admin status and 2-Step Verification status; with separate approval — audit logs and mobile devices |
| GitHub — "Cybertis Connectors" GitHub App | Installation by an organisation Owner | Read: Metadata, Administration, Members, Organization administration, Copilot Business, Actions, Dependabot alerts, Checks. Read and write: Issues | Organisation members, roles and 2FA status; repository list, visibility and branch protection; Copilot seats; workflow runs, Dependabot alerts and checks; for Clients using the SSDLC module — security-scan reports stored as workflow-run artifacts (these reports may include short code snippets flagged by the scanner, and are stored after secret redaction); opening and closing remediation issues. No Contents permission — the repositories and the source code themselves are not read |
| monday.com | OAuth 2.0 | me:read, users:read, account:read; with separate approval: boards:read, boards:write, updates:write | Account users and their roles; with separate approval — creating task items for findings |
| Other systems (Okta, Jira, GitLab, Zendesk, OpenAI, Anthropic, Base44, Cloudflare, Vercel and others) | API key supplied by the Client, or file import | As granted by the key the Client issued; a read-only key is recommended | User list, roles, MFA status where available, and relevant configuration metrics |
4.4. Storage of tokens and keys. OAuth tokens and API keys are stored encrypted (AES-256-GCM) with a separate, rotatable key, and are never displayed again after saving. For Microsoft 365 and GitHub connections we store no Client secret at all; access uses short-lived tokens.
4.5. Disconnecting. When a Connector is disconnected we revoke the grant with the provider where possible, delete the tokens and keys, and mark the imported identities as deleted. Snapshots, synchronisation history and findings are retained as audit evidence for the Client until deleted under section 8. For complete removal the Client should also remove the application on the provider's side (Enterprise applications in Entra ID; Installed GitHub Apps; third-party app access in Google).
4.6. Data from Google APIs. Cybertis Platform's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This information is used solely to present the identity inventory and security metrics to the Client that connected the account; it is not used for advertising, is not sold, and is not used to develop, improve or train generalised artificial-intelligence models.
4.7. Data from Microsoft Graph and GitHub is used in the same way and under the same restrictions: solely for the benefit of the Client that approved the access, with no advertising use, no sale and no model training.
5. Purposes and legal basis
5.1. Purposes: providing the Platform and the CISO, DPO and consulting services to the Client; authentication and access management; producing reports, evidence and alerts; handling data subject requests and supplier questionnaires on the Client's behalf; securing the Platform, preventing abuse and investigating incidents; support; complying with legal obligations.
5.2. Legal basis: performance of the engagement with the Client and its instructions (as processor); the administrator's consent when connecting a Connector; legitimate interest in securing the Platform; and legal obligation. For public submissions — the submitter's consent and the need to handle the request.
5.3. We do not make automated decisions with legal effect on individuals. Findings and alerts (for example "a departed employee still holds access") are presented to a person at the Client for review and decision.
6. Artificial intelligence
6.1. AI features are enabled per Client. A Client may disable them or restrict the permitted providers, in which case no data is sent to the AI provider.
6.2. Before text is sent to an AI provider, an automatic redaction mechanism removes identifiers — national ID numbers, phone numbers, email addresses, payment card and bank account numbers, API keys and secrets. The mechanism is best-effort and is not an absolute guarantee; sensitive information that is not needed should therefore not be entered into free-text fields.
6.3. Every AI call is recorded in a dedicated log (provider, purpose, categories redacted). AI providers act as sub-processors under commercial terms under which the data is not used to train their models.
7. Sub-processors and transfers outside Israel
| Provider | Role | Processing location |
|---|---|---|
| Vercel | Application hosting, file storage (Blob), infrastructure logs | European Union (Frankfurt) and global network |
| Neon | Managed PostgreSQL database | United States |
| Upstash | Redis — rate limiting and job queues | European Union / United States |
| Resend | Sending system email | United States |
| Cloudflare | Bot protection on public forms (Turnstile) | Global |
| Anthropic, OpenAI | Language models — only for Clients with the feature enabled | United States |
| Microsoft, Google, GitHub, monday.com and others | Source of Connector data — as chosen by the Client | Per provider |
Transfers outside Israel are made in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, and subject to the providers' contractual security and confidentiality commitments. An up-to-date list of sub-processors is available to Clients on request, and material changes will be published in this policy.
We do not sell or rent personal data. Data is disclosed to any other third party only on the Client's instruction, or where required by law or by order of a competent authority — in which case we will notify the Client to the extent the law allows.
8. Retention and deletion
| Data type | Retention period |
|---|---|
| Client Content and Connector data | For the term of the engagement. After it ends — returned or deleted within 90 days, unless the Services Agreement provides otherwise or the law requires retention |
| Connector tokens and keys | Until the Connector is disconnected — deleted immediately on disconnection |
| Snapshots, synchronisation history and audit log | As audit evidence for the term of the engagement, and thereafter as above |
| User account details | Until the user is removed, and thereafter for the period needed for security and record-keeping |
| Backups | Rolling backup cycle; deleted data leaves the backups at the end of the cycle |
| Accounting and contractual records | 7 years, as required by law |
Deletion in the Platform is first performed as a logical deletion (the record is hidden and inaccessible); final deletion is carried out according to the retention policy or at the Client's request.
9. Security
We implement security measures in line with the Privacy Protection (Data Security) Regulations, 5777-2017, and ISO 27001 principles, including: logical separation between clients at every application layer; role-based access and need-to-know; two-factor authentication; encryption in transit (TLS) and encryption of secrets and keys at rest; an audit log of every data change; rate limiting and abuse protection; a secure development lifecycle including code, secret and dependency scanning and periodic security testing; backups and a recovery plan. More information is available in the Trust Center: trust.cybertis.co.il.
No system is completely immune. In the event of a severe security incident we will act as the law requires, including notifying the Client without delay and, where required, the Privacy Protection Authority and the data subjects.
10. Data subject rights
10.1. Under the Israeli Privacy Protection Law, 5741-1981 (including Amendment 13), every person may access the data held about them, request correction or deletion of data that is inaccurate, out of date or unlawfully held, and withdraw consent. Persons to whom the GDPR applies also have the rights to data portability, restriction of processing and objection.
10.2. Platform users should contact privacy@cybertis.co.il. We will respond within 30 days after verifying identity.
10.3. Employees, suppliers and data subjects of a Client should contact the organisation that is the controller of the data. We will assist the Client in handling the request.
10.4. A complaint may be lodged with the Privacy Protection Authority at the Israeli Ministry of Justice.
11. Cookies
The Platform uses essential cookies only: a secure session cookie, language preference and request-forgery protection. The Platform has no third-party advertising or tracking cookies. Blocking the essential cookies will prevent sign-in.
12. Minors
The Platform is intended for organisations and professionals and not for persons under 18. We do not knowingly collect data about minors.
13. Changes to this policy
We update this policy when the service, the Connectors, the providers or the law change. The date of the last update appears at the top; we will notify Clients in the Platform or by email of material changes, including the addition of a permission to an existing Connector. Adding a permission to a Connector in any case requires renewed approval by the Client's administrator with the provider.
14. Language and contact
This policy is published in Hebrew and English; if the versions differ, the Hebrew version prevails.
Cybertis Ltd., 58 HaBanim Street, Herzliya 4672558, Israel · Data Protection Officer: Rotem Shynes · privacy@cybertis.co.il · +972-3-3030151