TrustPages.trustCenter / TrustPages.securityLabel

TrustPages.securityTitle

TrustPages.securityIntro

Passwords

Never stored in plain text. A scrypt hash with a 16-byte random salt per account, compared in constant time. Minimum 12 characters, a number and a symbol required.

lib/auth.ts (hashPassword, verifyPassword, validatePasswordStrength)

Sessions

HMAC-SHA256 signed cookies, httpOnly, secure, SameSite=Lax, 30-day expiry. The server refuses to start in production without a real signing secret — there is no fallback secret to fall back to.

lib/auth.ts (setSession, SECRET resolver)

Transport

HSTS with preload and includeSubDomains, X-Frame-Options DENY, X-Content-Type-Options nosniff, a Content-Security-Policy restricting script/style/connect sources to a named allowlist, Cross-Origin-Opener-Policy same-origin, and a Permissions-Policy that denies camera, microphone, geolocation and USB by default.

next.config.ts (headers()), netlify.toml

GDPR data residency

For EU actors, AI requests are never routed to a model provider whose home jurisdiction has no EU adequacy decision — enforced fail-closed in code from a single source of truth and covered by tests. This is a jurisdiction floor, not a full GDPR Chapter V transfer assessment for every provider still in scope.

lib/llm-residency.ts, __tests__/eu-residency.test.ts

AI request boundaries

Every agent request is rate-limited per IP, bounded to a fixed number of tool calls, and cut off by a hard wall clock under a minute. Untrusted content (an email body, a page an audit reads) is fenced with delimiters and the model is instructed to treat it as data, never instructions.

app/api/agent/route.ts, app/api/extension/email-scan/route.ts

Document uploads

Vault files are verified by reading each file’s actual leading bytes rather than trusting its declared type, capped per member at 50 documents and 250 MiB, 4.5 MB per file.

lib/document-limits.ts, lib/documents.ts

Deletion

A verified deletion request purges every store this repo tracks for that email — personal account rows and every org seat it ever held — listed in full at retention. Audit rows keep only a one-way hash of who acted, never the plaintext email.

lib/data-stores.ts, lib/erase-user.ts, lib/org-deletion.ts

TrustPages.reportVulnerability

We publish a disclosure file under RFC 9116 at /.well-known/security.txt. Reports go to security@syba.io and are handled within 72 hours, critical findings within 24. Good-faith research within scope falls under our safe-harbor policy: no legal action for testing that avoids privacy violations and service interruption, touches only accounts you own, and gives us reasonable time to remediate before public disclosure.

TrustPages.securityFooter