Security

Last updated: June 5, 2026

At SyncBridge, security is built into every layer of the platform. This page describes how we protect your data, our infrastructure, and what to do if you discover a vulnerability.

1. Data Encryption

In Transit: All communication between your browser, the SyncBridge API, and Supabase is encrypted via TLS 1.2+ (HTTPS). We enforce HSTS on all domains.
At Rest: Sensitive fields (OAuth tokens, secrets) are encrypted at the database level using AES-256. Database volumes are encrypted at the infrastructure level by Supabase.
Widget Communication: The chatbot widget communicates with our edge functions exclusively over HTTPS. No data is sent over plain HTTP.

2. Authentication & Access Control

  • Passwords are hashed using bcrypt; we never store plain-text passwords.
  • All dashboard sessions use signed JWTs with short expiry windows managed by Supabase Auth.
  • Row-Level Security (RLS) policies are enforced at the PostgreSQL level; every query is scoped to the authenticated user's data, even if application-layer checks fail.
  • Third-party integrations use OAuth 2.0. We never store or transmit your third-party passwords.
  • Multi-factor authentication (MFA) is available and recommended for all accounts.
  • Super admin and agent roles are strictly separated with least-privilege access controls.

3. Infrastructure Security

  • SyncBridge is hosted on Supabase (PostgreSQL database, Auth, Storage, Edge Functions) and served via Cloudflare/Vercel CDN with DDoS protection.
  • Edge Functions run in isolated Deno runtimes; they cannot access each other's memory or file system.
  • Database access is restricted to application service-role keys; direct public database access is disabled.
  • All infrastructure secrets and API keys are stored as environment variables, never committed to source control.
  • Automated vulnerability scanning is run on dependencies on every deployment.

4. Webhook Signature Verification

All incoming webhooks (Stripe payments, Facebook events) are verified using HMAC-SHA256 signature validation before any payload is processed. Requests with invalid or missing signatures are rejected immediately.

5. Operational Security

  • Production credentials are separate from development credentials.
  • All code changes go through review before deployment.
  • Edge function logs are monitored for anomalous activity.
  • Supabase backups are taken automatically with point-in-time recovery available.
  • We maintain an incident response procedure and will notify affected users within 72 hours of a confirmed data breach.

6. WordPress Plugin Security

  • The SyncBridge plugin transmits data only to the SyncBridge API over HTTPS.
  • The plugin uses a per-deployment API key for authentication. Keys are hashed in our database.
  • No user PII from your WordPress site is sent to SyncBridge beyond what is explicitly entered into the chat widget by the visitor.
  • Plugin zip files are SHA-256 verified before installation.

7. Responsible Disclosure

We take security reports seriously. If you discover a vulnerability in SyncBridge, please report it responsibly:

  • Email: info@xoryotech.com with subject "Security Vulnerability Report"
  • Include a description of the issue, steps to reproduce, and potential impact.
  • Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and address it.
  • We aim to acknowledge reports within 48 hours and provide an update within 7 days.

We appreciate the security community's efforts in keeping SyncBridge safe.

8. Contact Security Team

SyncBridge — Xoryo Technologies

info@xoryotech.com

https://www.sync-bridge.app