Security
Last updated: 26 September 2026
Security is foundational to how CypraEdge is built, not a layer added afterward. Below is a summary of the practices in place today. For a detailed security review as part of a procurement process, please reach out through your account administrator.
Encryption
Traffic to and from the platform is encrypted in transit via TLS. Sensitive third-party credentials (publishing, email-sending, and data-source tokens) are encrypted at rest before being stored.
Authentication
Access uses short-lived JWT access tokens with rotating refresh tokens. Sessions expire automatically, and enterprise SSO is supported for organizations that require it.
Role-Based Access Control
Every account has a role (e.g. admin, analyst, viewer) that gates which actions are available — write actions like budget changes or publishing credentials are restricted to appropriate roles.
Multi-Tenant Isolation
Every request is scoped to the requesting user's organization at the data layer, so one organization's data, campaigns, and connected accounts are never visible to another.
Audit Logging
Sensitive actions — such as bulk campaign changes and credential connections — are recorded with who performed them and when, so your team can review activity history.
Least-Privilege Integrations
Third-party integrations (Google, Meta, WordPress, Blogger, email providers) request only the OAuth scopes needed for the feature you connect, and can be disconnected at any time from Settings.
Responsible Disclosure
If you believe you have found a security vulnerability in CypraEdge, please report it through your account administrator so it can be routed to our security team. We ask that you avoid accessing or modifying data that isn't your own while investigating, and give us a reasonable window to remediate before public disclosure.
Related Policies
See our Privacy Policy for how data is collected and used, and our Terms & Conditions for the terms governing use of the platform.