1. Shared responsibility
Phasoric combines local browser storage, user-selected providers, and optional hosted services. We protect the systems we operate; users protect their devices, browser profiles, credentials, recovery channels, exported files, provider accounts, and sharing choices. Security also depends on keeping devices and browsers updated and reviewing connected access.
2. Local storage boundary
The browser's same-origin controls isolate Phasoric storage from ordinary access by unrelated websites. That is an access boundary, not encryption supplied by Phasoric. Scripts executing in the Phasoric origin, a compromised browser profile, malicious extensions with sufficient permission, local malware, a shared device user, or device loss may expose local data. Optional encryption protects only the data and paths for which it is explicitly enabled. Maintain an independent export or backup appropriate to the value of the data.
3. Hosted safeguards
- Hosted traffic uses encrypted transport.
- Passwords are one-way hashed, hosted secrets are encrypted at rest, and sensitive credentials are not returned after connection.
- Sessions, developer tokens, capture tokens, public shares, connection grants, workspace membership, and data access are scoped and revocable.
- Tenant authorization, bounded inputs, rate limits, audit records, private object access, database controls, dependency checks, and release gates reduce cross-account and supply-chain risk.
- Account deletion revokes access before durable content cleanup and retries failed storage deletion instead of silently declaring success.
4. Intelligence, automation, and untrusted content
Hosted intelligence receives only the bounded context authorized for a request. Source content is treated as untrusted evidence rather than a system instruction. Generated changes and consequential automation remain proposed until the applicable human-review control is satisfied. No model or automated control eliminates the need to review important output.
5. Vulnerability reporting
Send suspected vulnerabilities to security@phasoric.com with the affected component, reproduction steps, impact, and a safe contact method. Do not include unrelated personal data or publicly disclose an unresolved issue before coordinated remediation. We will acknowledge credible reports, investigate, communicate a remediation plan based on severity, and will not pursue good-faith research that follows the authorized boundaries in SECURITY.md.
6. Incidents
We investigate suspected unauthorized access, preserve relevant evidence, contain and remediate confirmed incidents, and notify affected customers or authorities when required by law or contract. Security questions may be sent to security@phasoric.com.