# Integration Guides {#integration-guides} ### LangChain Wrap your chain with a Cyphrex check before calling the LLM or tools. Use a custom callback or middleware that invokes `cyphrex.check()` with `actionType: 'llm_response'` or `'tool_use'` and the relevant payload. ### CrewAI Add a pre-step to each task that calls Cyphrex with the task type and target (for example a URL or tool name). Block task execution if `result.allowed === false`. ### OpenAI Assistants Use the Assistants API run lifecycle: before executing a tool call or message, call `cyphrex.check()` with the tool name and arguments. Cancel the run if the check fails. ### AutoGPT Integrate in the action execution layer: before running any command or API call, pass the action to Cyphrex. Only proceed when `allowed` is true. ### Custom agent frameworks Call `check()` at the point where your agent is about to perform an action. Map your internal action types to Cyphrex `actionType` and include `url` and `payload` as needed. Enforce `allowed` before proceeding. ## Security Best Practices {#security-best-practices} ### What Cyphrex stores Cyphrex records action metadata: agent, action type, URL, result, violation details, spend and timestamp. Action payloads are not retained by default. The payload field is evaluated in memory for prompt injection and policy matching, then discarded. Payload retention can be enabled per agent for debugging, in which case up to 2048 characters are stored for the duration of your log retention window. Structured violation summaries generated by Cyphrex are always retained, as they contain no caller-supplied content. ### API key security API keys are shown once at generation or rotation and never again. The dashboard displays only the last 4 characters. Store your key immediately in a secrets manager or environment variable. If you lose it, rotate from **API Keys** in the dashboard. Never expose keys client-side. Keys must only be used in server-side or backend environments. Never commit them to version control. Rotate keys regularly. Revoke compromised keys immediately from the dashboard. ### Behavior profiles Set the minimum required permissions for each agent. Restrict URLs to known domains. Restrict action types to what the agent actually needs. Never use a wildcard allowlist in production. ### Monitor and alert Configure P1 alerts for critical violations. Review the audit log weekly for unexpected patterns. Use the **MCP Threats** page to monitor tool call security. ### Team access Use the **Viewer** role for anyone who only needs to read reports. Use **Member** for engineers who need to manage agents. Reserve **Admin** for founders and leads only. ### Platform security Cyphrex enforces rate limiting on all auth endpoints. Login attempts are limited to 5 per 15 minutes per IP. All API responses use security headers including `Strict-Transport-Security`, `X-Content-Type-Options`, and `X-Frame-Options`. All resource access is account-scoped. Team members can only access resources belonging to their company account. ## Plans and limits {#pricing-limits} ### Plan comparison | Plan | Price | Agents | Enforced actions | Log retention | Blockchain SSN | Gas covered | Merkle anchoring | Signed reports | Support | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Free trial | $0, 14 days | One | 25,000 enforced and 100,000 recorded | 30 days | Optional, self-custody | Yes | Not included | Day-14 risk report | No priority | | Paid | Usage rates, $1,000 a month minimum | Unlimited | The volume you buy | 1, 3, or 7 years | Optional, self-custody | Yes | Daily included. Hourly, every 5 minutes, and real-time are options | Included | Standard. A priority support add-on has a 4-hour response | | Design partner | Sign by Oct 31: 3 months free, then year one at 40% off action usage ($800 a month floor), yearly prepay, price locked 24 months | Unlimited | The volume you buy, at the design partner rate | 1, 3, or 7 years | Optional, self-custody | Yes | Daily included. Hourly, every 5 minutes, and real-time are options | Included | High | Paid accounts buy usage. The first framework pack is included. Extra packs, a named DPA, and a signed BAA are add-ons on the [plans](/plans) page. Design partners use the same usage quote at the offer above. You agree to let us measure your action counts. ### Rate limits Paid usage is not blocked or throttled for volume. You are warned at 75, 80, 90, and 100 percent of what you bought. See the dashboard for current usage. ### Overage Usage above what you bought is billed through Stripe at the overage rate for the band your purchase ends in. Yearly prepays give a monthly allowance, and that overage is billed monthly. While a free trial is active, enforcement stops at 25,000 actions. The shown recorded count pauses at 100,000, and actions are still stored. ### Moving between plans Paid checkout starts from the Estimated Bill. See [Plans](/plans). ## Incident Response {#incident-response} ### What constitutes a security incident Any unauthorized access to customer agent data, audit logs, compliance reports, API keys, or behavior profiles. Any breach of Cyphrex platform infrastructure. ### Detection Sentry monitors all API errors and exceptions in real time. Railway provides infrastructure-level alerting. Supabase provides database access logs. ### Response timeframes - Detection to internal assessment: 1 hour - Customer notification of confirmed breach: within 24 hours - HIPAA-covered customers: written notification within 48 hours - Full incident report to affected customers: within 7 days of resolution ### Notification Affected customers are notified directly by email to the account owner from hello@cyphrex.io with a description of what was accessed, when, what was done to contain it, and what remediation steps were taken. ### Containment steps - Immediately revoke all affected API keys - Rotate affected infrastructure credentials - Isolate affected accounts - Preserve all logs for forensic analysis - Patch the vulnerability before restoring service ### Subprocessors Supabase (database and auth), Railway (compute), Resend (email), Sentry (error monitoring), Solana (blockchain anchoring). Each maintains their own security programs and incident response procedures. ### Contact Report security issues to hello@cyphrex.io. Platform status at [status.cyphrex.io](https://status.cyphrex.io). ## Platform Security {#security} ### Infrastructure Cyphrex runs on Railway (compute) and Supabase (database and auth). All data is stored in the United States. Tenant isolation is enforced in the API layer: every route is account-scoped and ownership is checked before any resource is returned. Row-level security policies are additionally enabled on customer tables. ### Authentication Existing users log in with email and password, Google, or GitHub. There is no open sign-up. New accounts come from paid checkout on the plans page, or from the free 2-week trial form, which emails a login link. The 14 days start when that link is opened. Passwords are handled by Supabase Auth and are never stored by Cyphrex in plaintext. JWT tokens use the ES256 algorithm. Tokens presenting insecure algorithms such as alg: none are rejected at the API layer. ### API keys API keys are hashed with SHA-256 before storage. The plaintext key is shown once at generation and never again. Comparison uses constant-time equality to prevent timing attacks. Keys can be rotated at any time from the dashboard by an account admin. ### Rate limiting All auth endpoints are rate limited. Login attempts are capped at 5 per 15 minutes per IP. API key rotation is capped at 3 per hour per account. Global API rate limiting applies to all routes. ### Transport security All traffic is served over HTTPS with HSTS enabled. Security headers including X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, and Referrer-Policy are set on all responses. ### Data isolation Every API route enforces account-scoped access. Team members can only access resources belonging to their company account. Administrative actions including API key rotation, billing and team management are restricted to account admins. ### Status Platform uptime is monitored and published at [status.cyphrex.io](https://status.cyphrex.io).