Trust center
Security, privacy and integrity — by design.
01Commitments
Four promises we build to.
- Security by designEvery new surface is threat-modeled before it ships. Least privilege, secrets outside code, and coordinated disclosure with a three-business-day response.Learn more →
- Privacy by defaultWe collect only what a feature needs, never sell or share personal information, and honor Global Privacy Control.Learn more →
- Integrity in competitionResults that matter are computed and verified on our servers. Money can never buy rank, and latency never touches a score.Learn more →
- Accessible to everyoneWe build to WCAG 2.2 AA, test with keyboards and screen readers, and keep motion optional.Learn more →
02Security
Security practices.
The controls behind syrosin.com today. Product-specific practices are published with each product.
Encrypted everywhere
HTTPS only, with HTTP Strict Transport Security on the domain and its subdomains.
Locked-down pages
A strict content security policy allows our own code and two named measurement services — nothing else.
Nothing to breach
syrosin.com is prerendered: no accounts, no forms, no database. One stateless function answers a one-bit region check.
Secrets out of code
Credentials live in platform secret stores, never in source or configuration files, and are rotated when exposed.
Threat-modeled surfaces
Every endpoint, webhook and form is threat-modeled before it ships, and security review is part of done.
Disclosure with a clock
Researchers get a named contact, a safe harbor, and an acknowledgment within three business days.
03 Privacy
Less data, by design.
The full details are in the Privacy Policy. TYPEMUSE publishes its own at typemuse.com/privacy.
- No advertising, no cross-site tracking and no sale or sharing of personal information.
- Cookieless measurement for everyone; Google Analytics only outside the EEA, the UK and Switzerland.
- Global Privacy Control honored, and a one-click analytics opt-out on the privacy page.
- Personal information limited to what you choose to send us by email.
04Sub-processors
Who processes data for syrosin.com.
We update this list before adding a company to it.
| Company | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery, security, cookieless web analytics and email routing | United States; global edge network |
| Google LLC | Google Analytics (outside the EEA, the UK and Switzerland only) and email service | United States; global |
05Frameworks
The rules we build to.
Syrosin does not yet hold third-party certifications such as SOC 2 or ISO 27001. We will publish attestations here as we obtain them.
- GDPR and UK GDPR
- Legal bases, rights and transfers documented in the privacy policy; visitors in the EEA and UK are never sent to Google.
- CCPA/CPRA and US state privacy laws
- No sale or sharing of personal information, and Global Privacy Control honored as an opt-out.
- WCAG 2.2 AA
- The accessibility standard every page is built and tested to.
- RFC 9116
- A published, expiring security.txt with our disclosure contact and policy.
06Effective September 26, 2026