Security

Security principles

SyncString is being designed for data that deserves careful handling. Its current security model emphasizes least-privilege provider authorization, source-aware managed copies, explicit previews, and confirmation before high-impact changes.

Current hosted-portal safeguards

• Authenticated routes enforce membership and role checks again on the server; interface visibility is not treated as an authorization boundary.
• User records are scoped by normalized account identity, while tenant, policy, people, and audit records are scoped by organization.
• Google and Microsoft authorization requires an existing user-owned connection, verifies the returned provider identity, requests only selected contact or calendar scopes, and binds saved tokens to the exact provider account.
• OAuth token payloads are encrypted before database storage using a server-held encryption secret. OAuth state cookies are HTTP-only, secure, short-lived, and cleared after the callback flow.
• Provider connection tests retain counts and redacted outcomes rather than provider response bodies, contact names, or event titles.
• Administrative capabilities are separated between billing and IT roles, with additional checks around role escalation and tenant-scoped records.
• Security headers limit framing, content-type confusion, referrer detail, and access to camera, microphone, and location.

What is not live yet

iCloud credential handling, background provider sync workers, payment processing, and provider-side policy enforcement are not active in this hosted release. SCIM endpoints remain disabled unless an organization-specific bearer token and organization boundary are configured as protected hosting values; creating assignment rules alone does not activate Entra provisioning. Portal actions for unconfigured external services save configuration or queue a request; they do not claim that external work completed. Supported Apple app builds may use platform Keychain storage when that client capability is introduced.

Beta status

SyncString remains in beta hardening. This page describes current controls and design principles, not a certification, audit result, or guarantee that every planned production control is complete. Privacy, retention, incident response, subprocessors, and enterprise security terms will continue to mature before general availability.

Report a vulnerability

Please report suspected vulnerabilities privately to security@qualystudios.com. Include the affected component, reproduction steps, impact, and any supporting material. Do not access other users’ data, disrupt services, or publicly disclose an unresolved issue. We will acknowledge good-faith reports and coordinate next steps.