Trust
How access, data and change work.
These are the facts behind the product. Anything we cannot yet prove is not claimed here.
The facts.
Each of these is true of the product today. Nothing here is a certification we have not earned.
You decide what Syncio can do
Each server has an access level — Observe, Operate, Console or Agent — and you can lower it at any time. There is also a switch on the server itself, so a change here never overrides a decision made there.
Read-only by default
The Runtime reads unless you tell it otherwise. Anything that changes something needs your approval, runs with a snapshot and a verification step, and leaves a receipt you can undo.
You can see what would leave your server
Before you connect a server, you can preview exactly what would be sent. Secrets are redacted before anything leaves the machine, and you can stay in local mode where nothing leaves at all.
Your data is yours
Data is encrypted in transit and at rest. You can export it or delete it at any time, and a tamper-evident audit log records who did what.
Your assistant is read-only by default
A connection for your own AI assistant can read project data. Anything it asks to change becomes a request a person approves in the app.
Reporting a vulnerability
Tell us at [[SECURITY_CONTACT_EMAIL]] and we will acknowledge it, keep you posted, and credit you if you would like. Please do not test against other people's accounts.
Your controls, in one place.
Every promise above has a control behind it. These are the ones you hold directly.
- Access per server
- Set the level for each server and lower it whenever you want. A switch on the server itself can also refuse remote control.
- Data egress
- Preview what a server would send before you connect it, redact secrets before they leave, or stay in local mode entirely.
- Approvals
- Every change waits for a person. You see what it will do, it runs against a snapshot, and it is verified afterwards.
- Undo
- Each approved change keeps a receipt and a way back. Nothing is a one-way door.
- Assistant scope
- A connection for your own assistant is read-only by default and can be revoked at any time.
- Export and delete
- Take your data out or remove it. A tamper-evident audit log records who did what.
Service providers
We use a small set of providers to run the service. This list is published once the owner has approved it.
- [[APPROVED_PROVIDER_LIST]]
What is collected, and what is not.
The Runtime reads a defined set of things and nothing else. This is the whole list, so a security review does not have to take our word for it.
- Always collected
- Health signals: availability, resource use, service state, certificate and backup status, and the change events that explain them.
- Never collected
- File contents, database rows, request bodies, environment secrets and credentials. They are not read, so they cannot be sent.
- Redacted before sending
- Anything that looks like a secret — keys, tokens, passwords — is stripped on the server before a payload leaves the machine.
- Kept only while you want it
- History is retained for the window your plan sets. Delete a server or an organization and its data goes with it.
- Where it is stored
- Encrypted in transit and at rest, in the region the account is created in. The exact providers are published once approved.
If something goes wrong on our side.
A platform that watches your uptime owes you a straight account of its own.
- You are told
- A status page and an email reach affected accounts. The same timeline you get for your own incidents applies to ours.
- You are told what it meant
- The note says what happened, what it affected, and what changed to stop it recurring — not a reassuring paragraph with no facts.
- Your data stays yours
- An incident on our side never widens access to your servers. The access levels and approvals you set keep working throughout.
Straight answers.
The questions a security review tends to ask, answered without a marketing sentence in front of them.
Does the Runtime need to run as root?
No. It installs as a normal service and asks for the least privilege it needs. Anything that would need more is surfaced as a request, not done quietly.
Can a change happen without my approval?
No. A write only runs after a person approves it in the app. The access level decides what is offered, and approval decides what runs.
What leaves my server by default?
Nothing, in local mode. Once you connect a server you can preview exactly what it would send before anything is transmitted.
Can I remove it cleanly?
Yes. The Runtime uninstalls with the package manager that installed it, and removing a server from the dashboard ends its connection.
Do you have a certification yet?
Not one we can point to. We say what is true of the product and we do not display a badge we have not earned.
How do I report a vulnerability?
Write to the security contact and we will acknowledge it, keep you posted, and credit you if you would like.
Questions about security?
We publish a responsible-disclosure process and answer security reviews in writing.