PUBLIC · ASSESSMENT PREPARATION
Public Security Statement
This public statement describes product security principles and preparation scope. It does not assert that Cuvena has completed a SOC 2 examination or obtained ISO/IEC 27001 certification.
SOC 2 preparationISO/IEC 27001 preparation
Purpose and scope
Cuvena coordinates script automation through customer-connected agents. Our core assessment preparation covers Security, Availability and Confidentiality for SOC 2, and an information security management system for ISO/IEC 27001. Final independent assessment scope and outcomes are subject to the appointed assessor.
Product security approach
| Area | Approach and responsibilities |
|---|---|
| Identity and access | Separate platform and customer responsibilities, scoped permissions and authenticator protection. Customers are responsible for their authorized users and execution-account privileges. |
| Credentials | Login passwords are hashed. Recoverable application secrets use authenticated encryption. Safe deployment also requires protected encryption keys and tested recovery procedures. |
| Execution and agents | Agents receive authorized work and connect to permitted targets. Privileged scripts retain the authority of their execution accounts. Signed release metadata protects agent update verification. |
| Verification | Software tests, infrastructure checks, recovery exercises and independent assessments establish different evidence. An AWS assurance report does not certify Cuvena’s application or operations. |
Assessment and privacy status
Independent testing and audit outcomes will be described only when substantiated. Privacy and regional obligations are evaluated separately; this statement is not a blanket declaration of compliance with every law, government programme or customer requirement.
Customer due diligence
Request information through Cuvena’s General enquiries page. Send a short non-sensitive description first. Do not submit passwords, private keys, personal records or exploit payloads through a general enquiry form. Detailed evidence and restricted architecture information require a controlled disclosure process.
Public disclosure boundaries
Public documentation excludes secrets, internal identifiers, vulnerability details, privileged configuration and customer information. Framework names describe preparation objectives only and do not indicate endorsement by a standards body or auditor.
Website: Cuvena Security & Trust · Company: Arynox
Organisation support access in v54
Authorised staff use their own platform identity. Platform owners have full support access without mandatory authenticator enrollment; other support staff use an authenticator to open a separate organisation support workspace. Standard support is read-only by default and normally requires customer approval. Explicitly authorised privileged staff can access an organisation without individual customer approval; this mode is identified and remains subject to normal session controls.
The main organisation and Admin audit logs record support access and activity, including who initiated the session, who approved it when applicable, timestamps and linked request/session references. Original approval evidence is retained after revocation. Session history is an additional convenient view. Admin audit delivery uses a durable retry mechanism when temporarily unavailable.
Support sessions remain separate from Admin and normal customer logins. Customer administrators can review and end sessions. Ending a privileged session does not remove the staff member's underlying permission to start another. No customer password or hidden customer account is needed.
Read the public support-access guide. The release describes product capabilities; deployment verification and independent assessment remain necessary.