Security & data

Your product data and images are part of your business. Here's how we look after them.

Accounts

• Passwords are hashed with scrypt, a memory-hard algorithm, and never stored in readable form.
• Sign-in links work once and expire quickly. Repeated failed sign-ins are slowed down.
• Optional sign-in with Google.
• Resetting your password signs you out of every other device.

Data

• All traffic is encrypted with HTTPS.
• Each workspace's jobs, images and usage are kept separate and only available to that workspace.
• Images are stored with Amazon Web Services in Canada (Central).
• We don't sell your data or use your content to train AI models.
• You can ask us to delete your account and data at any time.

Payments

Payments are handled by Stripe, a PCI DSS Level 1 certified payment processor. Card details go directly to Stripe; we never see or store full card numbers.

API keys

API keys are shown once when created and stored only as a hash. You can revoke a key at any time from the API keys page.

Providers

We rely on established infrastructure and AI providers, listed in our Privacy Policy.

Report a vulnerability

If you think you've found a security issue, email studio@synckart.com with details. Please don't access other customers' data or disrupt the service while testing. We'll respond promptly and keep you updated.