Current product stage
Syncdingo is preparing for private beta, and hosted nodes are not generally available yet. Service infrastructure, operational controls, processing locations, and product-data retention details will be published before beta access opens.
Security model
A participant must trust and protect their own devices, Syncthing configuration, device identity, and folder passwords. A hosted node and the infrastructure around it should be treated as observable and capable of being compromised rather than as a place that automatically deserves access to plaintext data.
Data and credentials that matter
- Plaintext file contents and file metadata on trusted devices.
- Syncthing folder passwords, folder IDs, device identities, and configuration.
- Future account credentials and tenant configuration.
- Operational credentials used by infrastructure providers.
Syncthing encrypted-device mode
Syncthing lets a trusted device set a folder password when sharing a folder with an untrusted device. Data sent to that device is encrypted using the password and folder ID. Syncthing currently labels this feature beta/testing only.
Syncthing documents file data, file metadata including names, times and hashes, and directory structure as protected on the untrusted device. It explicitly documents the folder ID, folder label, and file sizes as not protected.
Encryption on the hosted device does not hide every network-level fact. Depending on configuration, discovery and relay services or network observers can learn information such as device IDs, addresses, connection relationships, and traffic characteristics.
Transport security in Syncthing
Syncthing documents device-to-device traffic as protected by TLS. A device’s certificate fingerprint is represented as its Device ID and checked against configured devices when a connection is established. Discovery and relay features have separate metadata implications that are described in the upstream security documentation.
Trust boundaries
| Component | Role | Trust consideration |
|---|---|---|
| Your trusted devices | Hold plaintext and Syncthing secrets | You secure them and decide which devices and folders are trusted. |
| Syncthing encrypted-device mode | Transforms data sent to an untrusted device | Upstream feature currently documented by Syncthing as beta/testing only. |
| Syncdingo managed node | Always-on peer for selected folders | Product hosting and operator controls will be published before beta access. |
| Website | Publishes public information | Collects email addresses only when visitors subscribe to the newsletter via Outseta. |
Website security
- Static Astro pages with no server-side execution or database.
- No analytics, tracking cookies, or local-storage identifiers.
- A restrictive Content Security Policy delivered via HTML meta tag.
- One third-party script (Outseta) for newsletter subscription; no third-party fonts.
The site uses a strict Content Security Policy (CSP) delivered via HTML meta tag.
Product account security
Visiting this website does not create a Syncdingo product account. Before account-based beta access opens, Syncdingo will publish the applicable authentication, recovery, administrator-access, tenant-isolation, logging, and incident-response controls.
Product infrastructure
Exact hosted-node providers, locations, subprocessors, operator-access controls, storage protection, redundancy, and retention are not yet published. Those details will be documented when beta access opens.
Report a security issue
Security reports can be sent to legal_ye9foh@parsimonit.com. Please avoid including sensitive production data unless it is necessary to explain the issue.
Known limitations
- The managed Syncdingo node is not generally available.
- Syncthing encrypted-device mode is currently documented upstream as beta/testing only.
- An independent Syncdingo security audit or certification has not been completed.
- The current private-beta scope does not include Syncdingo snapshots, immutable retention, point-in-time restore, or a service-level guarantee.
- Exact product hosting and processing details will be published before private-beta access.