---
title: "Security overview · Syba trust center"
description: "The technical and organizational security measures Syba runs in production, and how to report a vulnerability to the Syba security team."
canonical: https://sybainsurance.com/trust/security
---

Trust center

# How we run this in production.

Each measure below cites the file it is implemented in, so the claim can be checked against the code that ships, not a policy document that describes something else.

- ## Passwords

  Never stored in plain text. A scrypt hash with a 16-byte random salt per account, compared in constant time. Minimum 12 characters, a number and a symbol required.

  Source: `lib/auth.ts (hashPassword, verifyPassword, validatePasswordStrength)`
- ## Sessions

  HMAC-SHA256 signed cookies, httpOnly, secure, SameSite=Lax, 30-day expiry. The server refuses to start in production without a real signing secret: there is no fallback secret to fall back to.

  Source: `lib/auth.ts (setSession, SECRET resolver)`
- ## Transport

  HSTS with preload and includeSubDomains, X-Frame-Options DENY, X-Content-Type-Options nosniff, a Content-Security-Policy restricting script/style/connect sources to a named allowlist, Cross-Origin-Opener-Policy same-origin, and a Permissions-Policy that denies camera, microphone, geolocation and USB by default.

  Source: `lib/csp.ts, middleware.ts`
- ## GDPR data residency

  For EU actors, AI requests are never routed to a model provider whose home jurisdiction has no EU adequacy decision: enforced fail-closed in code from a single source of truth and covered by tests. This is a jurisdiction floor, not a full GDPR Chapter V transfer assessment for every provider still in scope.

  Source: `lib/llm-residency.ts, __tests__/eu-residency.test.ts`
- ## AI request boundaries

  Every agent request is rate-limited per IP, bounded to a fixed number of tool calls, and cut off by a hard wall clock under a minute. Untrusted content (an email body, a page an audit reads) is fenced with delimiters and the model is instructed to treat it as data, never instructions.

  Source: `app/api/agent/route.ts, app/api/extension/email-scan/route.ts`
- ## Document uploads

  Vault files are verified by reading each file’s actual leading bytes rather than trusting its declared type, capped per member at 50 documents and 250 MiB, 4.5 MB per file.

  Source: `lib/document-limits.ts, lib/documents.ts`
- ## Deletion

  A verified deletion request purges every store this repo tracks for that email: personal account rows and every org seat it ever held: listed in full at retention. Audit rows keep only a one-way hash of who acted, never the plaintext email.

  Source: `lib/data-stores.ts, lib/erase-user.ts, lib/org-deletion.ts`

## Report a vulnerability

We publish a disclosure file under RFC 9116 at [`/.well-known/security.txt`](https://sybainsurance.com/.well-known/security.txt). Reports go to [security@syba.io](mailto:security@syba.io) and are reviewed. Good-faith research within scope falls under our safe-harbor policy: no legal action for testing that avoids privacy violations and service interruption, touches only accounts you own, and gives us reasonable time to remediate before public disclosure.

Providers are listed on [subprocessors](https://sybainsurance.com/trust/subprocessors). What each tier sends off the device is on [data flow](https://sybainsurance.com/trust/data-flow). Enterprise customers can request a signed [Data Processing Addendum](https://sybainsurance.com/trust/dpa).

## More from the trust center

- [Trust center](https://sybainsurance.com/trust)
- [Data flow](https://sybainsurance.com/trust/data-flow)
- [Subprocessors](https://sybainsurance.com/trust/subprocessors)
- [Retention](https://sybainsurance.com/trust/retention)
- [DPA](https://sybainsurance.com/trust/dpa)