CyberNut Data Security and Privacy Plan

CyberNut Data Security & Privacy Plan

Updated November 1, 2026

Introduction

CyberNut is committed to upholding the highest standards of data security and privacy for all users. Our practices align with the NIST Cybersecurity Framework (v1.1) and evolving industry best practices. This document outlines our safeguards, training, breach-response mechanisms, and data-governance policies.

1. Implementation of Data Security & Privacy Requirements

CyberNut embeds data-privacy and security protocols throughout the entire service life-cycle, adhering to strict operational and compliance guidelines.

2. Safeguards to Protect Personally Identifiable Information (PII)

  • All PII is hashed and anonymized before internal use.
  • Data is encrypted at rest and in transit with industry-standard protocols.
  • Clients can request full data deletion at any time.
  • Default data-retention period is five years (client-configurable).

3. Employee & Sub-contractor Training

  • All employees complete training aligned with the NIST Risk Management Framework.
  • Training is refreshed periodically to cover evolving regulations and risks.
  • CyberNut does not use sub-contractors for data processing.

4. Contractual & Policy Commitments

  • Employees are bound by internal codes of conduct and data-use agreements.
  • A fair-use policy defines roles, access rights, and repercussions for violations.

5. Incident Response & Breach Management

  • AWS CloudWatch monitors logs and triggers incident-response protocols.
  • Affected parties are notified within 24 hours of breach confirmation.
  • Public statements ensure transparency and promote awareness.

6. Data Disposal & Secure Destruction

  • Upon client request, data is fully deleted from production and backups.
  • Secure destruction follows ISO/IEC 27001-aligned practices.

7. Alignment with Industry Policies

  • Internal policies reflect global standards (NIST, ISO 27001, CISA).
  • ISO 27001 certification targeted within 2 years; SOC 2 within 3 years.

8. Procedure for Initiating Data Deletion Requests

Authorized school or district representatives can request deletion of customer data at any time, and CyberNut completes deletion within 30 days of a verified request. Where a signed data privacy agreement (DPA) sets a different timeline or method, the DPA governs.

Who may submit a request

  • District or school administrators, or other authorized representatives named in the contract or DPA: submit directly to CyberNut using the steps below.
  • Staff members (teachers, employees): submit through their district administrator, who submits the request to CyberNut.
  • Students, parents, or guardians: submit through their school or district, which controls student records and submits the request to CyberNut on their behalf.

Step-by-step procedure

  1. Submit the request. Email hello@cybernut.com with the subject line “Data Deletion Request – [District name]”. Include the requester’s name, title, and district or school; the scope of deletion (all district data, specific users, or specific data categories); for individual users, the name and school email address of each user; and any required completion date or DPA reference.
  2. Acknowledgment. CyberNut acknowledges the request in writing within 2 business days and assigns a request reference number.
  3. Verification of authority. CyberNut confirms the requester is an authorized representative of the customer, using the contact on file or the contract or DPA. If authority cannot be confirmed, CyberNut contacts the district’s designated administrator before proceeding.
  4. Scope confirmation. CyberNut confirms the scope in writing, including any data the district wishes to export first. On request, CyberNut provides an export in CSV format before deletion.
  5. Deletion from production. CyberNut deletes the in-scope data from all production systems, including user records, training and simulation results, reported-email data, and associated logs.
  6. Deletion from backups. In-scope data is removed from backups so that it cannot be restored. Deletion from production and backups is completed within 30 days of verification.
  7. Confirmation and certificate of destruction. CyberNut confirms completion in writing to the requester. A signed certificate of data destruction is provided on request.

End of contract

When a customer’s contract ends without renewal, CyberNut deletes all customer data within 60 days of the contract end date unless the customer requests earlier deletion or an export, or the DPA specifies otherwise. Confirmation follows Step 7.

Integrations and the reporting plug-in

Removing the CyberNut Gmail Add-on or Microsoft 365 add-in, or revoking CyberNut’s API access from the customer’s admin console, immediately stops CyberNut’s access to customer email data. Any retained data is deleted under this procedure.

Exceptions

CyberNut may retain specific data only where required by law or a legal hold. In that case, CyberNut identifies the retained data and the reason in its written confirmation and deletes it once the obligation ends.

NIST Cybersecurity Framework v1.1 Alignment

IDENTIFY

  • Asset Management: Serverless architecture on AWS Lambda, EC2, and API Gateway with secure provisioning and regular backups.
  • Business Environment: Clearly defined mission, appointed DPO, streamlined communication and response protocols.
  • Governance: Compliant with all applicable laws and regulations.
  • Risk Assessment: Regular risk-appetite assessments and proactive mitigation.
  • Risk Management Strategy: Operational risk decisions aligned with tolerances.
  • Supply-Chain Risk Management: No reliance on third-party data processors.

PROTECT

  • Access Control: Role-based access, least-privilege, MFA enforced.
  • Training: Mandatory cybersecurity modules per employee role.
  • Data Security: Encryption, backup, and multi-AZ strategies.
  • Policies & Procedures: Based on NIST, ISO 27001, CISA guidance.
  • Protective Technology: AWS-managed physical infrastructure.

DETECT

  • Anomalies & Events: Continuous monitoring with AWS CloudWatch.
  • Continuous Monitoring: Automated log analysis and alerts.
  • Detection Processes: AWS-managed detection pipeline.

RESPOND

  • Response Planning: DPO-led procedures ensure rapid escalation and containment.
  • Communications: Built-in stakeholder and law-enforcement coordination.
  • Analysis & Mitigation: Root-cause analysis and containment strategies.
  • Improvements: Continuous improvement cycles post-incident.

RECOVER

  • Recovery Planning: Distributed cloud infrastructure with daily backups supports continuity.
  • Improvements: Lessons-learned phase integrated into recovery operations.
  • Communications: CSIRT engagement coordinated by the DPO.