Security

What we do

• Everything travels over HTTPS, and the site tells browsers to insist on it.
• No passwords. Sign-in uses a single-use code emailed to you. Codes are limited in how many can be requested and tried, and the same message comes back whether or not an address already has an account.
• The browser connects to Sancy AI's own servers and to only two kinds of outside service, both named on the Subprocessors page: the speech-to-text service your voice goes to while you hold the talk button, and Cloudflare Turnstile, the human check before a sign-in code is sent. A strict content policy blocks every other site's scripts, fonts and connections, and the site cannot be framed by other sites.
• Our database blocks direct access from the public internet. Only our server can read or write usage events, and it checks you are signed in first.
• The AI key stays on the server. Requests are size-checked and limited per account and per network.
• Deleting your account deletes its server-side records, as described on the Your data and deleting it page.

What you can do

• Use an email account you protect with a strong password and two-step verification, since it receives your sign-in codes.
• Sign out on shared computers. Sign-in lasts until you sign out or it expires.

Report a vulnerability

Email support@sancyai.com with what you found and how to reproduce it. Please give us a reasonable time to fix it before sharing it, and do not access other people's data, disrupt the service or test with automated floods. If you follow those rules we will not take action against you, we will credit you if you like, and we will tell you when it is fixed. We cannot offer a paid bounty at this time.

Contact for security

The same address, support@sancyai.com. A machine-readable copy of this contact is at /.well-known/security.txt.