Per-user isolated sandboxes, encrypted credentials and least-privilege access protect everything Cyrus does on your behalf.