CyberPhone is built on a foundation of operational discretion. Our privacy architecture is designed to protect client identity, secure communications, and ensure zero data leakage across all operational touchpoints.
Last updated: June 2026
CyberPhone operates under a strict zero-identity policy. We do not require, store, or share personally identifiable information beyond what is strictly necessary to fulfil an order. All client interactions are handled through anonymised identifiers. We do not maintain logs of client names, addresses, or communication metadata beyond the minimum retention period required by applicable commercial law.
Clients are under no obligation to disclose their identity, affiliation, or intended deployment context beyond confirming lawful authorisation.
All communications with CyberPhone are encrypted end-to-end, using industry-standard TLS 1.3 encryption for web traffic and Signal Protocol-grade encryption for direct messaging. No unencrypted communications are processed or retained by our systems.
Device configuration data, firmware profiles, and operational parameters transmitted during device provisioning are encrypted at rest using AES-256 and in transit using TLS 1.3. Encryption keys are never stored alongside encrypted data and are rotated on a per-client basis.
We adhere to a strict data minimisation principle. Only data that is absolutely necessary for the fulfilment of your order and the provision of technical support is collected. No behavioural profiling, analytics tracking, or third-party data sharing is conducted on client data.
Order-related data is retained for a maximum of 90 days post-delivery, after which it is securely wiped using DoD 5220.22-M multi-pass overwrite standards.
CyberPhone does not sell, rent, lease, or otherwise disclose client data to any third party under any circumstances, except where compelled by a valid court order or equivalent legal instrument from a jurisdiction in which we operate.
We do not participate in data broker networks, advertising platforms, or cross-company analytics programmes. Our service providers (logistics, payment processors) operate under strict data processing agreements and are prohibited from using client data for any purpose other than the specific service rendered.
We understand that our clients operate in sensitive professional environments. All internal staff are subject to non-disclosure agreements and security-cleared access controls. Device provisioning and configuration workflows are conducted in air-gapped environments isolated from public internet infrastructure.
Client order details, device configurations, and deployment parameters are handled on a need-to-know basis within our organisation. No single employee has full visibility into all aspects of a client's order. This compartmentalisation is a deliberate OPSEC measure to protect client confidentiality.
Data collected by deployed devices is transmitted exclusively to client-controlled or client-designated Command & Control (C2) infrastructure. CyberPhone does not have access to, intercept, or retain any data collected by devices after delivery. We have no visibility into post-delivery device operations.
C2 server endpoints, encryption keys, and data routing configurations are provisioned uniquely per client and are not shared across deployments. This architecture ensures complete data isolation between clients.
We operate in compliance with the General Data Protection Regulation (GDPR) and applicable data-protection law. You have the right to access, rectify, erase, restrict, or port any personal data we hold about you.
To exercise any of these rights, you may submit a request to our Data Protection Officer. We will respond within 30 days. You also have the right to lodge a complaint with the supervisory authority in your jurisdiction.
All products and services provided by CyberPhone are conditional upon lawful use. Clients are solely responsible for ensuring their deployment of our products complies with all applicable laws, including but not limited to applicable interception, computer-misuse, and privacy legislation in the client's jurisdiction.
CyberPhone reserves the right to refuse service or terminate an agreement if we have reasonable grounds to believe our products are being used in violation of applicable law. This policy does not constitute legal advice. Clients are encouraged to seek independent legal counsel before deployment.
CyberPhone hardware-modified devices are sold exclusively to vetted corporate, investigative, and compliance professionals for lawful monitoring of devices the purchaser is legally authorized to monitor. Use requires legal authority under the applicable jurisdiction. We do not sell for stalking, unlawful interception, or surveillance without consent where required by law. Every request is reviewed before procurement, and all sales are conditional on acceptance of our Legal Notice.