Keep tokens out
of the agent runtime.
CybrLink separates user authorization from agent execution, so your agents can use tools without directly holding long-lived OAuth credentials.
Your AI agents need access to user apps. They do not need to hold user credentials.
- Private by design
- Use a credential layer you control instead of handing credentials to the agent runtime.
- Scoped access
- Connections are tied to users, integrations, and permissions so agents operate with explicit authorization.
- Revocation path
- Users can disconnect an app, and the system can revoke that connection instead of leaving stale access behind.
- Inspectable architecture
- CybrLink is built around auditable OAuth primitives, making the token path easier to reason about and operate.
Enterprise-grade security, audited to the standards your buyers ask for.
Security, availability, and confidentiality controls, independently audited.
A formal information-security management system across the platform.
EU data-protection and privacy rights, with data-processing agreements available.
- Tokens held in infrastructure you control — never in the model
- Encryption in transit and at rest
- Append-only, tamper-evident audit log
- Least-privilege, per-user scoped access
Architecture in one diagram
CybrLink coordinates authorization and connection state. Durable OAuth tokens stay inside the highlighted credential layer, where your team controls deployment, storage, and provider credentials.
Frequently asked
Who holds the OAuth tokens?+
Your controlled credential layer is the token store. CybrLink starts and manages the connect flow, but the long-lived OAuth tokens belong in infrastructure you control.
What's the blast radius if CybrLink is compromised?+
Durable tokens live in your credential layer and do not enter the model runtime. A compromise of CybrLink's control plane does not directly expose raw durable tokens already stored in your deployment, though connected-provider access should still be revoked and audited as part of incident response.
What does self-hosted mean here?+
It means token storage and provider credentials are handled by a credential service you deploy or control. CybrLink currently supports Nango for that layer and keeps required third-party notices on the legal page.
What goes into the audit log?+
Audit entries include the user, key, action, provider key, endpoint, method, status, outcome, failure reason, timestamp, and integrity metadata where available. CybrLink records metadata only, not request or response bodies.
Can users revoke access?+
Yes. Connections are visible per user and per integration, and disconnecting an app revokes that connection instead of leaving stale access behind.