Security Overview

This overview describes the security measures in SynCore today. Our public Security page has the same list in short form.

1. Encryption

• All traffic uses HTTPS (TLS 1.2 or 1.3), with HSTS. Plain HTTP is redirected.
• Files are stored with Cloudflare R2, which encrypts stored data.
• Database backups are encrypted with AES-256 before they leave the server.

2. Access

• Customer accounts can use authenticator-app two-step verification and can see and end their active sessions.
• Staff use a separate admin site with its own sign-in and must use two-step verification. Staff access is limited by role and department.
• Passwords are stored only as secure hashes. Sign-in attempts are rate-limited and sign-up and sign-in forms use a bot check.

3. Records

• Sign-ins, billing changes, file shares and staff actions are written to an append-only activity log that can’t be edited or deleted.
• Customers can read the log for their own organisation in their account.

4. Files and sharing

• Each cloud belongs to one organisation; only its signed-in members can open it.
• Share links are long random tokens, expire after at most 90 days, can need a password and can be revoked.
• Uploads go straight to storage over HTTPS using short-lived signed links.

5. Backups and recovery

The database is backed up every day, with an encrypted copy kept off the server.

6. Application protections

A strict Content Security Policy, protection against cross-site request forgery, host-only cookies and other browser protections are set on every page.

7. Reporting a problem

Write to support@syncoretech.net with "Security" in the subject. Please don’t access other people’s data or disrupt the service while testing. We reply within two working days.