Doc. CYL-LP-03 · Trust centre
Built to be checked, not just claimed
Where your data lives, who else touches it, how the encryption actually works, and where Cylockr stands on formal compliance. Every claim below is specific on purpose.
Data residency
What runs in Australia, and what does not
Cylockr's application infrastructure runs in Microsoft Azure's Australia East region, and identity runs on Auth0's Australian region tenant. That covers everything that holds locker content and the keys that protect it.
In Australia
- The database holding encrypted locker content and wrapped keys
- The compute running the API and the frontend
- HSM-backed key protection for the key-encryption key
- Identity and authentication (Auth0's Australian region tenant)
- Transactional email sending (Azure Communication Services, Australian data location), including the locker link or passphrase when you choose email delivery
What that does not cover
One sub-processor sits outside Australia today, and it never receives a locker's encrypted content: Stripe handles payment data. Email you choose to send is processed in the Australian data location of Cylockr's Azure Communication Services resource, then handed to the recipient's own mail provider, wherever that is; this is exactly why sending the link and passphrase through separate channels stays the safer default regardless.
Stripe
Billing and payment processing. Stripe has an Australian legal entity, but payment data is processed on Stripe-operated infrastructure, not an Australian region.
Sub-processor register
Every third party that touches customer data
Last reviewed 14 September 2026. We will update this register and its review date whenever a sub-processor is added, removed or replaced, and will email organisation administrators at least 30 days ahead of a new sub-processor beginning to process customer data, other than an emergency security or availability fix.
| Sub-processor | What it processes | Location | Purpose |
|---|---|---|---|
| Auth0 (Okta) | Account email address, authentication tokens, MFA enrolment | Australia (AU region tenant) | Sign-in and multi-factor authentication |
| Stripe | Payment method (tokenised by Stripe), invoices, subscription state | Outside Australia | Subscription billing and payment processing |
| Azure Communication Services (Microsoft) | Sender and recipient email address, notification email content and, where email delivery is chosen, the locker link and/or passphrase | Australia (resource data location) | Delivery of account and locker-notification emails; never a locker's encrypted content |
| Microsoft Azure | Encrypted locker content, wrapped keys, account and organisation metadata | Australia East (australiaeast) | Application hosting, database, key management and caching |
The crypto model
How the encryption actually works
No jargon required to follow this: four steps take a secret from your keyboard to permanently gone.
A fresh key for every locker
Each secret is encrypted with AES-256-GCM under a random data key generated for that locker alone. The secret itself is never encrypted with a shared or reused key.
Wrapped twice before it touches the database
The data key is wrapped first by a key derived from your passphrase (PBKDF2-HMAC-SHA-512), then wrapped again by an RSA-4096 key that lives inside a FIPS 140-3 Level 3 validated hardware security module and never leaves it.
Operator-blind by design
The passphrase itself is never stored. Without it, the keys Cylockr holds cannot unwrap the data key, so a breach of Cylockr's database alone yields ciphertext and nothing else. Once stored, Cylockr cannot read your secret.
One retrieval, then gone
The moment a locker is opened and the secret collected, the content is purged. A locker nobody opens expires, and is purged automatically; there is no recovery path either way.
Compliance roadmap
Where we stand, honestly
Cylockr is working toward alignment with the Australian Signals Directorate's Information Security Manual (ISM) for OFFICIAL: Sensitive and PROTECTED workloads.
Shipped
- Envelope encryption with an HSM-backed key-encryption key (one key per platform, not per locker)
- Passphrase handling moved to PBKDF2-HMAC-SHA-512
- Operator-blind design confirmed: the passphrase stays cryptographically required
In progress
- Running AES-GCM through a FIPS-validated cryptographic module end to end
- Hybrid post-quantum TLS (X25519MLKEM768) at the connection layer
- A written post-quantum transition plan
Cylockr does not hold SOC 2 or IRAP certification today. We will pursue formal certification once the ISM alignment work above is complete and customer demand justifies the audit cost. No committed date; this page will be the first place to reflect a change.
End of the trust centre
Checkable claims, not marketing copy
Australian data residency where it matters, a named sub-processor for everything else, and an encryption model that keeps Cylockr blind to your secret by design.