Security

Reporting a vulnerability

Email security@tincograph.com. Include enough to reproduce it. You do not need to ask permission first, and you will not hear from a lawyer.

What we promise:

• An acknowledgement within three working days, from a person.
• An honest assessment — including "we already knew" or "we do not think this is a problem", with the reasoning.
• Credit on this page if you want it, and no credit if you do not.
• No legal action against anyone who follows the boundaries below, and no request that you keep it quiet indefinitely.

What we ask:

• Use your own account. Do not access, modify or delete anyone else's data.
• No denial of service, no spam, no social engineering of us or anyone using Tincograph.
• Give us a reasonable chance to fix it before publishing. Ninety days is generous; if it is actively being exploited, tell us and publish as soon as it is fixed.

There is no bug bounty. We are one person and a set of apps that do not take money yet — offering a reward we could not reliably pay would be worse than saying so.

What protects an account today

• Passwords are hashed with bcrypt by our identity provider. Nobody here can read one.
• Two-factor authentication is available on every plan, including free, with recovery codes. See the help centre.
• Every row of your data is protected by database-level row security, not by application code remembering to check. A query for someone else's data returns nothing, even if the application asks for it.
• Administrative actions are audited by construction: the check, the change and the audit record are one database transaction, so an action cannot happen without a record of who did it and why.
• Devices can be revoked individually from your account page, and a revoked device stops syncing immediately.
• Error reports are redacted before they are stored — tokens, API keys, email addresses and IP addresses are stripped on arrival, not on display.
• Transport is HTTPS everywhere, with HSTS, a strict content security policy and no third-party scripts.

What does not protect an account yet

Stating these is the point of the page. Each is a real gap, not a hypothetical:

• There is no limit on failed sign-in attempts. Our identity provider's hook for this is a paid feature; the code that uses it is written and tested but cannot be switched on until the plan changes. Two-factor authentication is the mitigation available to you today, and it is a good one.
• No independent security audit has been done. When one has, it will be named here with its date.
• No formal certification — no SOC 2, no ISO 27001. If you need one, Tincograph is not ready for you yet, and we would rather say so than imply otherwise.

Data

Where your data lives and who can see it is on thesubprocessors page; what we collect and why is in theprivacy policy. You can export everything or delete your account from the account page at any time, without asking anyone.

Questions that are not a vulnerability report:legal@tincograph.com.