Start with the client’s question
Before you open the record, read what the client asked. Which Macs? Which period? A setting that is on today and a setting that has been on all year are two different answers.
| The client asks | What answers it |
|---|---|
| “Is disk encryption on?” | Today’s state of each Mac. |
| “Has it been on this year?” | The since date for each control, and the days Cybee observed. |
| “Are all your laptops protected?” | The number of Macs assessed, next to your own list of Macs. |
Map each question to its evidence
What exactly is a Trust Passport?
The Trust Passport.
The Trust Passport is a dated record of how your Macs are protected. Your client or insurer opens it through one link and sees what holds, since when, and what Cybee could not see. It is not a certification or an audit, and it does not answer for your policies, your people or your cloud. It says so on the page.
Sealed means the record carries a fingerprint, a short code made from its content. Your client can compare it with the copy Cybee sealed and see whether anything was changed afterwards. That shows the record was not edited. It does not check the facts a second time.
Make one
- 1
Ask your AI assistant for the device record.
Name the period the client asked about. Ask to see the Macs assessed, the days not observed and any open findings before anything is shared.
Ask your AI assistant
Prepare the device record for this period. Show the Macs assessed, the days not observed and the open findings before I share it.
Select the question, then press Command and C.
- 2
Fix what you can first.
If a setting is off, fix it before you seal. The owner of that Mac says yes, and the record keeps the time.
- 3
Seal it, then send the link.
Sealing gives the page its fingerprint and a link you can send. What you send stays exactly as it was sent.
four Macs, one morning26.09.2026
- 09:41
Cybee reads 4 of 4 Macs. 117 of 118 checks hold.Screen lock is off on Mira’s MacBook Air.
- 09:42
Mira says yes. Screen lock is on.118 of 118 checks hold.
- 09:45
The Trust Passport is sealed.sha256 9f3c…b71e · ready to send
Read it line by line
This is what the client receives. Read it the way they will, from the top.
26.09.2026 09:45 · prepared for a client questionnaire
Four Macs. Every check holds. One day not observed.
- Macs protected
- 4 of 4
- Checks holding
- 118 of 118
| Control | Since |
|---|---|
| Disk encryption | since 12.03.2026 |
| Behavioural protection | since 12.03.2026 |
| Screen lock | since 26.09.2026 09:42 |
- Not observed: one Mac on 21.09.2026, offline.
- Not covered: your policies, your people, your cloud. Not a certification.
Cybee chat card, example data. Asked: make a Trust Passport. 1 gap on the record. Covers 90 days. Sealed just now. One Mac not observed on 21.09.2026. The Mac was offline that day. Covers: the 4 Macs enrolled in Cybee, as reported by the Cybee agent on each Mac. Does not cover: backups, passwords and MFA, email and cloud accounts, written policies. Phones and other computers are outside it. It is a record of device settings, not a certification. Sealed just now. Whoever opens the link sees the full sealed report, read only, gaps included. Its fingerprint shows the page is unchanged since Cybee sealed it. It does not check the facts a second time. Open it Write the email for me
| On the page | What it tells your client |
|---|---|
| The date and the reason | When the record was sealed, and what it was prepared for. |
| Each number with its total | 4 of 4 Macs, not just 4. A number without its total can hide the Macs that were never checked. |
| The row of days | One square per day. A hollow square is a day Cybee did not observe a Mac. |
| The since dates | How long each control has held, such as disk encryption since 12.03.2026. |
| The gaps | What Cybee could not see, and what the record does not cover. |
| The fingerprint | The code the reader uses to check that the page has not changed since you sealed it. |
What it answers on a client form
On a typical form, the Trust Passport answers the questions about your Macs, with dates. The rest you answer by hand.
answers with dates
- Is disk encryption on, on every Mac? For each listed Mac, yes. FileVault, with the date first seen and the date last checked.
- Is there endpoint protection, and since when? For each listed Mac, yes. Protected since a date.
- Are the applications patched? Application patch status for each listed Mac, with dates.
- Screen lock and password on wake? Yes. Part of the hardening score on the record.
- Which browser extensions, startup items and AI tools are installed? Yes. Listed for each Mac.
you answer by hand
- Is MFA enforced? You answer by hand. Account checks are coming soon.
- Who has admin rights? You answer by hand.
- Are backups taken and tested? You answer by hand. Cybee is not a backup tool.
- Is there an incident plan? You answer by hand.
- Does the person who left still have access? You answer by hand.
- Is the fleet monitored around the clock? You answer by hand.
- Policies, risk assessment, vendor reviews, penetration tests? You answer by hand.
When a Mac is missing
Say it plainly. A client who asks about eight laptops and gets an answer about seven will notice.
“Are all eight project laptops encrypted?”fictional
- Seven Macs assesseddisk encryptionOn, with dates
- The eighth Macnot assessedUnknown
your answerYes for seven, with the dates. The eighth was not assessed, and here is why.
What it covers, and what it does not
-
covered
The Macs listed on it.
- Protection, and since when
- Disk encryption and screen lock
- App updates
- Browser extensions
- AI tools installed
-
not covered
Everything else.
- Your policies, your people, your code
- Backups and suppliers
- Training completion and incident plans
- Any Mac not listed
- Accounts and online services
It is not a certification or an audit opinion. The person who receives it decides whether it is enough for what they need.
Is it a SOC 2 or ISO 27001 report?
No. It is the technical part.
A SOC 2 or ISO 27001 programme needs evidence about your devices. The Trust Passport gives that part, from your Macs, with dates. Cybee checks each Mac against the CIS Benchmark, a public, industry maintained list of the safest settings for macOS that almost every compliance framework builds on.
Policies, risk, suppliers, people and the audit itself stay with you and your auditor.
118 checks. 10 frameworks, technical controls only.
What the seal proves
Sealed means locked with a cryptographic fingerprint, so nothing on the page can change afterwards. The reader can compare the page with Cybee’s sealed copy and see that it is the one you sent.
Before you ask a client to check a page, email [email protected] for the steps to check it, so you can pass them on.
What is a cryptographic fingerprint?
A short code made from the page.
It is computed from everything on the page. Change one character and the code comes out different. That is how a reader can tell that the page in front of them is the page you sealed.
In the sample above: sha256 9f3c…b71e.