Version 1.1 · 22 October 2026
CyberStanding is operated by Cyber Assurance Group, Inc. In this consent, "CyberStanding" means Cyber Assurance Group, Inc., doing business as CyberStanding.
You consent for the business named on the Credential (the Holder), and you confirm you are authorized to do so. You also confirm that each person you add to the Credential's People list has agreed to be contacted as described below and, before their first voice check, to the voice check described in section 6.
You authorize CyberStanding to read, without changing anything, the security settings of the Holder's Microsoft 365 or Google Workspace tenant. For Microsoft 365 this is administrator consent to the CyberStanding Connector application with read-only permissions (security reports, device health, sign-in and multi-factor policy, mail settings), including read-only access to Exchange Online settings and the Global Reader role assigned to the Connector. For Google Workspace it is the read-only access an administrator authorizes in the Google Admin console. CyberStanding never reads the contents of mailboxes, files, documents, messages or passwords. An administrator can remove this access at any time in Microsoft Entra or the Google Admin console.
CyberStanding reads the Holder's public DNS records (for example SPF, DKIM, DMARC and MTA-STS) every day. These records are public; reading them needs no access to any system of the Holder's.
You authorize the Holder's endpoint detection and response (EDR) provider to send CyberStanding a daily report about the Holder's computers, and CyberStanding to read it: which devices are protected, their protection status and the date of each reading. No files, browsing or user activity are in the report.
CyberStanding, through its telephone provider Twilio, sends text messages and places calls to the mobile numbers on the Credential and on its People list: notices and reminders about the Credential; payment change requests and reminders to approvers; the approver's callback, which rings the approver and connects them to the vendor's number on file; and the incident notice call, which rings the holder and connects them to the insurer's claims line. Calls are not recorded. Message frequency varies. Message and data rates may apply. Reply STOP to stop texts and HELP for help. Consent to texts is not a condition of any purchase.
What is collected. Some steps ask the person doing them to read a short number code aloud: approving a payment change, signing the records of a procedure, declaring an incident. When a person sets up their voice check, they read three codes, and our voice verification provider, VSFT Holdings, Inc. (ValidSoft), creates a voiceprint from those recordings: a mathematical model of the person's voice. A voiceprint is a biometric identifier. CyberStanding, through ValidSoft, collects and stores it.
Purpose. The voiceprint is used for one purpose: to confirm, at each voice check, that the speaker is a live person (liveness) and is the person who set up the voice check. It is used for nothing else.
What is kept, and where. ValidSoft holds the voiceprint on CyberStanding's behalf. ValidSoft keeps each recording for up to two weeks for troubleshooting, then deletes it. CyberStanding keeps a reference to the voiceprint, the result of each check and a fingerprint (a one-way hash) of each recording. It does not keep the recordings or the voiceprint.
How long. A voiceprint is kept only while the person may be asked for a voice check. It is permanently destroyed within 30 days of the first of: the person's request; the person's removal from the Credential's People list; the Credential ending; or, at the latest, three years after the person's last voice check. The full schedule is the voiceprint retention and destruction policy.
Never sold. Voiceprints and recordings are never sold, leased, traded or otherwise used for profit. They are disclosed only to ValidSoft, to complete a step the person asked for, with the person's consent, or where the law requires it.
Written release. By clicking Accept, you give your written release for your own voiceprint to be collected, stored and used as described here. This notice is shown to you again before your first recording. Each other person gives their own written release on their own page before their voiceprint is made. A person does not have to give a voiceprint.
If an insurer asks whether the business holds voiceprints, the voiceprints described here are held by ValidSoft for CyberStanding, not by the business.
Periodically, CyberStanding publishes on a public ledger a single fingerprint (a one-way hash) covering every record it holds. It identifies no business; nothing about the Holder is published.
CyberStanding shares the Credential only with the people and firms you choose: through a code you create on the Credential, through the links the procedures send (to approvers, staff and the IT provider), and through the incident evidence package sent to the insurer and broker named in your incident response plan.
You can withdraw any part of this consent at any time from your Credential or by writing to registry@mycyberstanding.com. Withdrawing stops new readings, texts, calls and voice checks; records already made stay in the Credential's sealed record. Withdrawing the voice check also destroys the voiceprint, as section 6 describes.
When you click Accept, the version of this text, its fingerprint, the time, your email address and the network address are sealed into the Credential's record.
