Is mytos.bio safe to use as a vendor?

mytos.bio scored 88/100 on LynxRadar's security posture assessment. The domain meets baseline security requirements. 8 checks passed, 1 warnings, 1 critical issues across 10 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

What TLS version does mytos.bio use?

mytos.bio uses TLSv1.3 with TLS_AES_256_GCM_SHA384. TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Does mytos.bio have DMARC configured?

Yes. mytos.bio's DMARC policy is set to 'quarantine'. SPF record: yes. Strengths: DMARC policy set to quarantine; SPF record present with soft-fail (~all); DKIM configured (selectors: google, s1, s2).

Does mytos.bio have SPF configured?

Yes. SPF record: v=spf1 include:_spf.google.com ~all

Does mytos.bio have security headers configured?

mytos.bio has 2 of 5 recommended security headers. Present: CSP, X-Frame-Options. Missing: X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

Does mytos.bio use HSTS?

Yes. HSTS enabled: max-age=31536000. Missing includeSubDomains. Missing preload directive.

Has mytos.bio been involved in a data breach?

No known breaches found. No known breaches found in public disclosure databases.

Does mytos.bio have known CVE vulnerabilities?

No server software versions detected in HTTP response headers. This is good practice (version hiding) but means CVE exposure cannot be assessed from external signals alone.

Is mytos.bio's SSL certificate valid?

Yes. Strengths: Certificate valid, 81 days remaining; Issued by Let's Encrypt.

mytos.bio Security Report — Grade B+ (88/100)

Q: Does mytos.bio have DNSSEC enabled?

No. Strengths: 4 nameservers configured (ns-761.awsdns-31.net., ns-1512.awsdns-61.org., ns-1790.awsdns-31.co.uk., ns-72.awsdns-09.com.); 5 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.

B+

Pass · 88/100

Shows significant security gaps that need urgent attention. Positive signals: TLS Configuration, Known Breaches, and DMARC / Email Security all passed. 2 action items identified, including 0 critical. The issues point to real architectural gaps, not just configuration tweaks. A focused remediation effort of 1–2 days could address all findings.

Trust Score Trend

→ No change 1 scan · Last scanned February 18, 2026

Your rating Industry average

Score

100 75 50 25 0

B+

mytos.bio

88/100

Compliance & Certifications

Not yet verified

HIPAA

BAA not on file

Self-reported

Pro subscribers only

HITRUST

Certificate not on file

3rd party

Pro subscribers only

SOC 2 Type II

Audit report not on file

3rd party · AICPA

Pro subscribers only

Incident History

None in 12 months

March 2026

ChatGPT data exposure

1 source

Resolved

Pro subscribers only

April 2023 – Feb 2026

ChatGPT data exposure

1 source

Resolved

Pro subscribers only

Security Posture

2 items need attention

8 passed

Add 3 missing security headers

Security Headers

1–2 hours

This leaves visitors exposed to attacks like clickjacking and content-type sniffing. mytos.bio is missing 3 of the 5 security headers browsers use to protect visitors — for example, one stops your site being loaded inside a hidden frame on another site to trick people into clicking things (clickjacking). These are settings, not code changes, so they're usually quick to add.

PCI-DSS 4.0Req 6.4.1

Security headers are required application controls

OWASPSecure Headers

Recommended baseline for web applications

How to fix this

1Add these headers exactly as shown. You're using Cloudflare in front of this site — add it there, see https://developers.cloudflare.com/rules/transform/response-header-modification/create-dashboard/.

X-Content-Type-Options: nosniff

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy: camera=(), microphone=(), geolocation=()

2Confirm it worked: search "http header checker" and enter mytos.bio — check the headers below in the response.

Security headers guide

Report unlocked.

View all 8 passed checks

TLS Configuration

Known Breaches

DMARC / Email Security

MX Records & Mail Provider

CVE Exposure

HSTS Header

Certificate Hygiene

Subprocessors & Tech Stack

Company Signals

Claim profile →

Operational risk

Low

11 yrs operating. Well-funded

Lynxradar · Composite signal

Last funding

$40B

Series F · Mar 2025 · SoftBank-led

Crunchbase ↗

Employees

~3,000

+40% YoY growth

LinkedIn ↗

Trust Resources

Claim profile →

SafeBase Trust Center

trust.mytos.bio

Security page

mytos.bio/security ↗

mytos.bio/privacy ↗

DPA (Data Processing Agreement)

mytos.bio/dpa ↗

Updated recently

Subprocessors List

mytos.bio/policies/subprocessors ↗

Tech Stack Detected

Subprocessors

Cloudflare

Similar companies in Healthcare / Health Tech

Appears in

Claim profile →

SOC 2 Type II certified vendors

847 companies · Updated weekly by LynxRadar

Track

ISO 27001 certified SaaS

312 companies · Updated weekly by LynxRadar

Track

Top AI vendors by trust score

94 companies · LynxRadar ranking

Track

Enterprise-ready SaaS · Trust score A or above

203 companies · LynxRadar ranking

Track

Blocking Issues

2/5 present

Missing: X-Content-Type-Options, Referrer-Policy, Permissions-Policy

Likelihood: ★★★☆☆

Impact: ★★★☆☆

Medium Priority

Not enabled

Strengths: 4 nameservers configured (ns-761.awsdns-31.net., ns-1512.awsdns-61.org., ns-1790.awsdns-31.co.uk., ns-72.awsdns-09.com.); 5 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.

Likelihood: ★★☆☆☆

Impact: ★★★☆☆