- Home
- Trust and security
A tool that watches the wire has to be defensible itself.
Nothing goes on your endpoints and nothing inspects packets. There is no SPAN port, mirror or inline tap. This page is the one-screen version of what a security review asks for, and every line on it describes what ships today.
What we hold, and what we do not.
Controls are mapped to the AICPA Trust Services Criteria and reviewed quarterly. We do not hold a SOC 2 Type II report. The control mapping is shared under NDA.
Six of the eight products run only inside your environment. RoomIQ and SpacesIQ can also be hosted by us; a federal deployment that needs FedRAMP runs them on its own hardware instead.
Covered vendors are identified by their signature. Relabeling a device does not hide it.
Against the platform and the management plane. The summary is in the package below.
Nothing is installed on your devices. Here is what you install instead.
- CrossScan, CrossCheck, CrossRoom, CrossTrust
- A desktop app on one Windows or macOS machine, started with a double click. Each binds to 127.0.0.1, so only that machine can reach it. Requirements per product.
- CrossConnect
- A server product on your Linux host, installed with one command using Docker. It stays inside your walls.
- CrossVenue
- A script on the building's operations machine, usually the Windows PC already in the plant room. It binds to 127.0.0.1:3000.
- RoomIQ and SpacesIQ
- Two parts. A scan engine: a small Linux virtual machine, roughly 2 vCPU, 4 GB memory and 40 GB disk, installed by your team on hardware you own, reading each managed switch with read-only credentials your network team issues. And a main instance, where identity resolution happens: hosted by us in the region you pick, or installed on your own hardware when the posture requires it (on-premise, air-gapped, DMZ-isolated, or where data residency prohibits egress). When hosted, the scan engine talks to it over SSL, outbound on 443 only. It needs no VPN or vendor tunnel, and no inbound firewall rule.
- Backing out
- Minutes. Stop the software and the switches are exactly as they were, because nothing was changed on them.
What it looks at.
- Link negotiation, power draw and class, MAC OUI, LLDP and CDP announcements, port statistics, and the VLAN and topology context the switch already records.
- Switch model, port identifier, port state, neighbor information, and the network path around each identified device.
- A timestamped record every time a device's fingerprint diverges from its known signature, holding the value before and the value after.
What it cannot see.
- Application payloads. Nothing captures, stores or inspects packet contents.
- People. It identifies devices. There is no user account model, no behavioral telemetry and no session identifier.
- Audio, video or meeting content. There is no path into the media stream, even while identifying the endpoint carrying it.
Handling and residency.
Signatures, drift events and evidence packs live in the control plane you chose at deployment. The six Cross products keep everything on the machine they run on. RoomIQ and SpacesIQ keep it in their main instance: when we host it, in the region agreed during scoping; when you do, on your own infrastructure.
Encryption in transit and at rest is on by default in every deployment shape. Retention is yours to set, and the default covers the longest audit-evidence window across the frameworks on the glossary. Our people reach customer data only through a named, audited support workflow tied to a specific ticket.
The evaluation package.
- The SOC 2 control mapping, under NDA.
- An architecture diagram with data flows and trust boundaries marked.
- The most recent penetration test summary.
- Vendor-risk questionnaire responses: CAIQ, SIG-Lite, or your own.
- A sample data processing agreement, and a business associate agreement where one applies.
Ask at contact_us@cybriq.io. Most packages go out within one working day.