Security Architecture & Data Protection
Zynocode Labs is engineered with a privacy-by-design, browser-first architecture. We minimize server data handling by executing file processing, image compression, PDF operations, and cryptographic operations directly in your browser sandbox.
1. Architectural Boundary: Browser vs Server
We draw a strict, auditable boundary between in-browser utility execution and server-side platform services:
Client-Side Tools (Default)
PDF compression/merge/split, image resizing, WebP conversion, text cleaning, Base64 encoding, JSON formatting, and hashing run 100% inside your browser device memory via WebAssembly, Web Crypto, and HTML5 Canvas. Your documents and sensitive strings are never sent over the network to our servers.
Server-Side API Services
The developer Tool API (/api/v2/tools/*), account authentication, and saved outputs run on serverless edge functions. Tool executions in the API process inputs ephemerally in RAM; payloads are not persisted to disk or retained after the HTTP response completes.
2. Transport & Edge Network Security
- HTTPS Enforced via TLS 1.3:All network communication is strictly encrypted in transit using TLS 1.3 and TLS 1.2 with perfect forward secrecy (PFS). Plaintext HTTP requests are automatically redirected to HTTPS.
- HTTP Strict Transport Security (HSTS):We send the
Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadheader to prevent SSL-stripping attacks. - Defensive Security Headers:Every page response serves
X-Content-Type-Options: nosniff,X-Frame-Options: SAMEORIGIN(with frame permissions restricted specifically to/embed/*for authorized tool widgets),Referrer-Policy: strict-origin-when-cross-origin, andPermissions-Policy: camera=(), microphone=(), geolocation=().
3. Authentication & Credential Protection
- Zero Plaintext API Keys:Developer API keys are generated using cryptographically secure random bytes (
crypto.randomBytes(32)). When saved, keys are hashed using industry-standard one-way cryptographic algorithms; raw tokens are shown only once upon generation and are never readable by our team or stored in plaintext database columns. - Encrypted Webhook Secrets:Customer webhook signing secrets are encrypted at rest using AES-256-GCM authenticated encryption with isolated encryption keys managed in runtime environment variables.
- Session Security:User dashboard sessions use secure, HttpOnly, SameSite cookies with JSON Web Tokens (JWT) signed using secret keys that rotate per deployment.
4. Input Validation & Rate Limiting
Every public API route and dashboard endpoint validates incoming JSON bodies using strict Zod schemas with strong type boundaries. Unrecognized fields are stripped, string lengths are strictly capped, and numerical bounds prevent memory exhaustion. Public API endpoints enforce a rate limit of 60 requests per minute per IP to protect availability.
5. Transparent Limitations
In accordance with our honesty standards, we do not overstate our security posture:
- Client-side tool memory is constrained by your local browser sandbox and available device RAM (typically 100MB–1GB depending on your browser).
- Zynocode Labs is an online utility platform and developer API service. We do not operate a classified government data enclave, HIPAA-covered entity environment, or PCI-cleared payment card vault (all payment card transactions are handled externally by Razorpay).
- Browser extensions installed on your personal device (such as script injectors or DOM inspectors) have access to your local browser DOM. For maximum security when handling sensitive documents, use Private / Incognito windows with extensions disabled.
6. Responsible Vulnerability Disclosure
We welcome responsible security research from developers and cybersecurity professionals. If you identify a potential security vulnerability affecting Zynocode Labs web services, API endpoints, or our open-source packages: