Data & security

Last updated: July 22, 2026

SyncApp.AI holds real names, emails, and room schedules for our office, so we build it to keep that data private. Here is how we protect it.

Connections are encrypted

Everything runs over HTTPS. Traffic between your device and SyncApp.AI is encrypted in transit.

Door codes and links are signed

The QR code on each door and the manage link in your confirmation email carry a cryptographically signed token (HMAC). Only our server can produce a valid one, so a guessed or altered link cannot book, check in, or cancel on your behalf.

The database denies by default

Our database uses row-level security set to deny by default. Nothing is readable through the public keys that ship in a browser. All data access happens on our server, behind the gate and admin checks, using a server-only key that never reaches the client.

Abuse and bot protection

Booking actions are rate limited to prevent flooding, and the web booking form is protected by a Cloudflare Turnstile check that keeps bots out without making you solve a puzzle.

Error monitoring, scrubbed

We monitor errors with Sentry so we can fix problems quickly. Reports are scrubbed of personal data and of the signed tokens in our links before they are sent, and we do not record session replays.

Secrets stay on the server

API keys, signing secrets, and database credentials live only in the server environment. They are never bundled into the code that runs in your browser.

Reporting a problem

If you believe you have found a security issue, please tell us before sharing it anywhere else. Email hello@syncapp.ai and we will respond.