Security.
How accounts, money and files are protected, and how to tell us about a problem.
1. Accounts
- Passwords are at least 10 characters, and they’re stored as hashes, never as the password itself.
- The number of sign-in and sign-up attempts from one address is limited, and so is how fast one person can act, so a script can’t guess its way in.
- A session lasts 14 days, renewed on each day you use Synthicate.
- Resetting a password signs you out of every browser, and we email you that it changed.
- A new email address is confirmed at that address before it takes over, and the old address is told.
Not built yet: two-step sign-in, and requiring a confirmed email address before you can use the app (we send the confirmation, but don’t yet wait for it).
2. Who sees what
Every request checks who’s asking before anything is shown or changed. A studio can’t open a brand’s pages, and a brand can’t open a studio’s. A deal’s thread, drafts and money are seen only by its two sides, and a studio sees a whole product pack only once one of its deals on that version is agreed. The Privacy policy, section 4, lists who sees what.
3. Money
- A brand’s card is taken on the payment provider’s own page. Synthicate never sees or keeps card numbers.
- The payment provider holds a deal’s money until it’s released or refunded. Money moves only when the deal’s rules allow the move, through one part of the code, and every movement is a line on the deal’s record that both sides see.
- Nothing money touched is deleted: deals, their money lines and their messages stay on the record.
- Payments run in a sandbox for now. No real money moves yet.
4. Files
- A file’s type is read from its own contents, never from its name.
- Each kind has a size limit: 8 MB for a product photo or a creator’s picture, 2 MB for a logo, 40 MB for a draft.
- Files are served only to signed-in people the product pack, the deal or the creator allows. A link to a stored file works for an hour.
5. Your social accounts
Synthicate never asks for a social account’s password, and never posts, schedules or automates anything on it. When a studio sends a live link, the post is checked through the platform’s public page about it, and nothing else.
6. Synthicate staff
A small number of Synthicate staff accounts, granted and removed by hand, settle problems on deals. Every settlement is written on the deal with its reason, and every staff action is kept in a log.
7. Reporting a vulnerability
If you find a security problem, write to [SECURITY EMAIL], with what you found and how to see it again. We’ll reply within [TIME TO REPLY: Adam to set].
Please:
- don’t look at, change or keep anyone else’s data;
- don’t slow the service down or try to take it offline;
- give us time to fix it before you tell anyone else.
There’s no bug bounty yet.
8. If something goes wrong
No system is perfectly safe. If a data breach is likely to cause serious harm, we’ll tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires (Privacy policy, section 10).