Security

Your clients trust you with their logos. You need to know where those files live and who can see them. This page covers both in plain terms. For the legal detail, see our Data Processing Agreement and Privacy Policy.

Where your data lives

Your logos, files and account data are stored in the EU, in Supabase’s Stockholm (Sweden) region. That includes the database, file storage and sign-in. The web app is served by Vercel’s global edge network, so pages load fast wherever your team is.

Sinqlo is run by iFRAME OE, a company registered in Greece. We work under the GDPR, and the Hellenic Data Protection Authority is our supervisory authority.

Encryption

• Every connection to Sinqlo uses HTTPS/TLS.
• Your files and database are encrypted at rest.
• API keys for AI tools are stored only in hashed form. We can’t read them back, and neither can anyone who gets into the database.

Your files are never used to train AI

We don’t use your logos, brand assets or anything else you upload to train AI models. The AI Assistant runs on our own systems and doesn’t send your files to outside AI providers.

If you connect an AI tool through the Sinqlo MCP, such as Claude or Cursor, that connection is read-only. The tool can read your brand kits but can’t change or delete anything. Logo download links it gets expire after one hour, and you can revoke a key at any time in Settings → API Keys.

Who can see what

• Account isolation. Database access rules keep each account’s data separate from every other account.
• Access Codes. Protect a Brand Link with a code, so only people you give it to can open the Brand Kit Sharing Page.
• Team Mode roles. Invite teammates and set what each one can do.
• Our staff. Only authorized staff can access production systems.

Monitoring and backups

• Rate limiting and bot protection (Google reCAPTCHA Enterprise) on sign-up, sign-in and forms.
• Security logs of sign-in and access attempts, kept for 90 days and then deleted automatically.
• Automatic database backups, kept for 7 days.

If something goes wrong

If a breach affects your personal data, we’ll tell you without undue delay, and within 72 hours of finding out. We’ll explain what happened, what it means for you and what we’re doing about it. The full commitment is in section 8 of the DPA.

Subprocessors

We use a small number of providers to run Sinqlo. The full list, with what each one does and where, is in our Privacy Policy and DPA. We email account owners at least 30 days before adding or replacing a subprocessor.

Connectors you turn on yourself, like Notion, Slack, Google Drive or Figma, receive only the assets you choose to send them.

Report a security issue

Found a vulnerability or have a security question? Email info@sinqlo.com with “Security” in the subject line. We read every report.