Does Cyber Crucible comply with GDPR?
Short answer: Yes, by design rather than by policy. Content, credentials, encryption keys, and session tokens are never collected; analysis happens on the endpoint; Cyber Crucible acts as processor under a written DPA; and deployment options keep personal data inside the EU — or inside your own building.
Mapping to GDPR principles
- Data minimization (Art. 5) — the excluded-data list is enumerated, not described in generalities. Telemetry is limited to what threat detection requires and is configurable.
- Integrity and confidentiality (Art. 5, 32) — TLS 1.3 in transit, per-agent JWE payload encryption, encryption at rest, role-based access control, key rotation, audit logging.
- Processor obligations (Art. 28) — written DPA specifying scope; processing only on documented instructions; sub-processors bound to equivalent terms.
- Transfers (Chapter V) — EU regional staging, or air-gapped deployment that eliminates transfer entirely.
- Data protection by design (Art. 25) — the strongest claim available: the highest-risk categories are not protected by policy, they are never collected.
Pseudonymization
Where behavioural telemetry could indirectly identify an individual, identifiers are pseudonymized or masked — a safeguard GDPR explicitly recognizes.
What this does not do
It does not make your organization GDPR compliant. Your obligations depend on your own processing purposes, lawful bases, notices, and records. What it removes is a common difficulty: a security vendor continuously exporting personal data to a third country.