Cypher LM Strengthens Its Security Posture with Per-Account Data Isolation, a Site-Integrity Guard and an Owner Identity Gate

LAHORE, Pakistan – Businesses trust Cypher LM with their customers' calls, their calendars, their inboxes and their payments. Today Cypher LM described the work it has done to strengthen its security posture: a line-by-line review of the platform, per-account data isolation checked across every part of the API, stronger sign-in and team-role protections, a site-integrity guard against copied versions of the website, and an owner identity gate for AI agents.

A full review. The Cypher LM team reviewed every route of the platform's API and its dashboard for authentication, data isolation between accounts, team roles, injection, abuse and information leaks, and probed the live site and its configuration. Every issue found was checked against the code before it was fixed, and each fix is covered by an automated regression test so it stays fixed. The review also covered the platform's dependencies and the history of its code, and confirmed that only public keys are ever sent to browsers.

Per-account data isolation. Each business's agents, calls, contacts, bookings, notes and payments are tied to that account, and every request is checked so one account cannot read or change another account's data. Team roles control what each member can do: front-desk teammates, sales reps, managers and owners each have the permissions their job needs, and sensitive actions, such as importing from the owner's Google Drive or removing a manager, are reserved for the owner. Webhook secrets and API keys are hidden from roles that do not manage settings, and API keys are stored only in hashed form.

Protected credentials and connections. Connected Google accounts and Stripe keys are stored encrypted. Connecting Google requires confirmation from the signed-in account that started it. Messages from the voice platform and the meeting bot are signed and verified, sign-in has per-account lockouts and protected password storage, and public forms such as the booking page and lead form have shared limits that stop abuse. Follow-up emails can go only to the caller's own address or a saved contact. Payment and booking links use long, unguessable tokens, and spreadsheet exports are protected against formula injection.

“Security for us is not a badge, it is a list of things we checked and fixed, each with a test behind it,” said Muhammad Maaz, co-founder and CTO of Cypher LM. “Our customers connect their inboxes, calendars and payment accounts to Cypher LM. They deserve to know each business's data stays with that business.”

Site-integrity guard. Copies of the Cypher LM website re-hosted elsewhere are detected when they load, reported to the owner and blanked for visitors, who are sent back to cypherlm.com. The source network is blocked at the website's edge firewall, which also stops bulk scrapers and mirroring tools while allowing real browsers and verified search engines. Every block can be reviewed and reversed by the owner. The website's terms of use also state plainly that bulk downloading and re-hosting the site are not permitted.

Owner identity gate. Some people ask AI coding and browsing agents to copy a website by claiming to own it. Cypher LM now publishes a clear policy, in the places such agents read, that copying the site requires a short-lived authorisation code that only the verified owners of Cypher LM can generate with an authenticator app. A name or a claim is not proof; a compliant agent that cannot verify a code should refuse. Each code is valid for ten minutes, can be checked by the agent against a public verification service, and every attempt is logged for the owners to review. Search engines and AI answer services remain welcome to read the public site; only bulk copying is ruled out.

“No public website can stop every determined copier, and we say that openly,” said Muhammad Maaz, co-founder and CTO of Cypher LM. “What we can do is detect copies quickly, block them at the edge, and make it unambiguous that nobody else is authorised to copy what our team built.”

Cypher LM does not sell customer data or use it to train AI models. More about how Cypher LM protects data is available at cypherlm.com/security. Security researchers and customers can report a concern to info@cypherlm.com.