Security
Secure by default
Security has been part of Zync since the first line of code and is reviewed in every release. Here is what we do — no vague promises.
Your account
Stored with the algorithm recommended by OWASP. They cannot be reversed, not even by us.
The session token is encrypted by the system (DPAPI), never reaches the app interface and is replaced on every renewal.
Sign-in and sign-up are rate-limited against password guessing.
The app on your computer
The interface runs isolated, with no access to Node.js or your files.
Every call between the interface and the app is validated and checks its origin.
The app only talks to usezync.com; no third-party scripts.
On the server
Automatic certificates and HSTS. Real-time connections are encrypted too (wss).
Every action is checked on the server against roles and channel permissions, not just in the app.
Attachments only open through temporary links. File types are checked by content and photos lose their GPS data.
The server never reaches internal addresses when generating previews (SSRF protection).
The database, cache and API are not exposed to the internet; only the HTTPS edge is.
Database and files backed up daily and kept for 14 days.
Found a vulnerability?
Thank you for helping. Write to contato@usezync.com with the subject Security, telling us:
- what you found and where (app, site or API);
- the steps to reproduce it;
- the impact you expect.
Our commitments: reply within 5 business days, keep you updated until it is fixed and credit you, if you want. We ask that you do not access other people’s data, do not degrade the service and wait for the fix before disclosing.
Also published at /.well-known/security.txt (RFC 9116).
What is still coming
We are in beta and transparent about what is missing:
- Code signing for the installer (today Windows warns on first run)
- Two-step verification (2FA)
- Backup copies outside the main server
- End-to-end encryption for direct messages