Security, privacy, and compliance
How we handle operational data, where the boundaries are, and what enterprise IT and procurement teams should know before engaging.
- Data residency stays with the operator
On-device inference by default. Imagery and sensor data don't round-trip to the cloud unless configured. No cross-customer aggregation.
- Encryption in transit + at rest
Command-and-control links encrypted (RTK + 4G/5G with TLS). Mission data encrypted at rest. Customer-controlled keys available under MSA.
- On-device LLM inference
Mission-AI agent runs on-device. Cloud sync is opt-in, not default.
- Anti-interference flight control
Adaptive flight control hardened against EMI and RF interference. For critical-infrastructure inspection and patrol where link integrity matters.
- Civilian / industrial scope
Inspection, mapping, agriculture, security & patrol, emergency response. Defense and weaponized use out of scope. End-use screened at sales.
- Export controls
We comply with applicable export-control regimes (HK / CN / destination). Specific approvals may be required. Compliance terms in the customer agreement.
- Airspace regulation
Customers operate per local rules (CAAC, FAA, EASA, MOT). Platform documentation supports BVLOS waivers, flight-plan filings, auditor requirements.
- Dual-use security stance
Scoped to civilian critical-infrastructure protection — industrial parks, chemical plants, fire/SAR. We decline engagements outside this scope.
For this website (cyronai.ai), data is processed by
- HostingWeb hosting, CDN, image optimizationGlobal edge / US primary
- Transactional emailAuto-replies and internal notifications from contact formUS
- Anti-bot serviceContact-form bot protection (server-side validation)Global edge
- AnalyticsAnonymized site usage (cookieless)US
Data-processing terms with each provider, available under NDA. Operational data flowing through Cyron drone fleets is not co-mingled with website analytics.
- Vulnerability handling
Report security concerns to security@cyronai.ai. We acknowledge within 2 business days and triage within 5. Coordinated disclosure preferred.
- Incident response
Security incidents tracked through customer success engineers. Notification completed within MSA-defined timeframes.
- Audit access
Enterprise / government procurement: SOC-2 readiness brief, data-flow diagrams, SOW-level security commitments — under NDA.