Security

Sutyr is built for billing reliability, and the same discipline applies to how we protect data. This page summarizes the security of the public sutyr.com surface and links to the documents that hold the detail. It describes what is deployed today and what is planned; present-tense statements are live, and anything forthcoming is dated. It makes no certification claim.

Infrastructure & data protection

Traffic to sutyr.com is encrypted in transit with TLS 1.3, and the certificate is issued by Let’s Encrypt with automated rotation. The site runs on infrastructure operated by providers that hold their own independent security certifications:

• Vercel: hosting and edge delivery (SOC 2 Type II).
• Cloudflare: DNS, WAF, TLS termination, and DDoS mitigation (SOC 2 Type II, ISO 27001).
• Amazon Web Services: primary platform infrastructure (SOC 2 Type II, ISO 27001, PCI-DSS).
• Stripe: payment processing (PCI-DSS Level 1). Sutyr never stores raw payment instrument data.

The Sutyr platform is designed for multi-tenant isolation: authentication and organization scoping run through Stytch, and billing workflows are isolated per tenant on Temporal Cloud. The full sub-processor inventory, with each provider’s purpose and data categories, is published in our Sub-processor Disclosure.

Application security

Every response from sutyr.com ships a strict set of HTTP security headers: HSTS with preload, a Content-Security-Policy with violation reporting, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, a constrained Permissions-Policy, and a strict Referrer-Policy. CSP violations are reported to a first-party endpoint.

• Secure delivery pipeline: every change runs through a continuous-integration pipeline (lint, unit tests, end-to-end tests, and a production build) before it can ship.
• Automated dependency monitoring: third-party dependencies are scanned against the GitHub advisory database, with update pull requests opened automatically.
• Form abuse protection: the application form is protected by Cloudflare Turnstile; submissions are validated server-side.
• Privacy-preserving error monitoring: runtime errors are captured with all submitted form values masked and email addresses hashed before they leave Sutyr’s infrastructure.

Compliance posture

Sutyr has no SOC 2 report yet. The audit is planned. Until then, the answers on this page, and the reports of Sutyr’s infrastructure providers, which are theirs. Sutyr tracks NIST FIPS 203 / 204 / 205, NIST IR 8547, and CNSA 2.0 as the cryptographic references.

Privacy governance

The person in charge of the protection of personal information is Sutyr’s Privacy Officer, a role currently held by Sutyr’s founder. The role is named by title so that it continues if the person changes. Write to privacy@sutyr.com, or by mail to the Privacy Officer, Sutyr Inc., 3240 Avenue de Kent, Montréal, Québec H3S 1N1, Canada.

• Two roles: Sutyr is the controller for the information it collects for its own purposes, such as the website and requests for a check or a call. When a business connects its Stripe account, Sutyr processes that business’s customer information on its behalf and only on its instructions.
• Use: Sutyr never sells personal information, never uses it for advertising, and never uses customer data to train artificial intelligence models.
• Where data is stored: the Service runs on Amazon Web Services in the United States, in us-east-1 with backup copies in us-west-2.
• Sub-processors: every provider that may process customer personal data is listed in Sub-processors. A new one is announced at least 10 business days before it processes customer personal information, and a customer may object within 30 days.
• Your rights: Sutyr answers requests about your information within 30 days, or sooner where the law requires.
• Incidents: if a confidentiality incident creates a risk of serious injury, Sutyr notifies the people affected and the regulators as the law requires, and keeps a register of incidents.
• Data Processing Addendum: available on request at legal@sutyr.com.

The complete detail is in the Privacy Policy. Use of the website is governed by the Website Terms of Use.

Cryptography & post-quantum

Connections use TLS 1.3 with forward secrecy and hybrid post-quantum key agreement: post-quantum capable clients negotiate X25519MLKEM768 (classical X25519 combined with ML-KEM-768, FIPS 203), so the confidentiality of the key exchange resists a future quantum computer. DNSSEC is enabled, so DNS responses for sutyr.com are authenticated. A machine-readable inventory of this cryptography is published in OWASP CycloneDX format at /.well-known/cbom.

Reporting a vulnerability

Report a suspected vulnerability in sutyr.com, lab.sutyr.com or the Service by email to security@sutyr.com, in English or French. The same contact is published per RFC 9116 at /.well-known/security.txt.

Include what you can of the following:

• the affected URL, page or feature;
• the steps to reproduce the issue;
• what you observed, and the impact you expect;
• how to reach you with questions.

Test only against your own account and data. Don’t access or change other people’s data, bypass approvals or permissions, or overload the Sites or the Service. The Website Terms of Use and the Acceptable Use Policy set these limits. Misuse of the Service is reported to the same address.

Ownership & review

This posture is owned by Toufic Jrab, founder, Sutyr Inc. It is reviewed at least annually, and whenever the deployed security controls or the applicable standards materially change. Next scheduled review: June 19, 2027.