Transparency
Which outside services SyFly relies on and what each one receives, where your data is stored, how many requests for user data we have received, and any security incidents. Your vault is encrypted on your device before any of these services could see it.
Services that process data for us
None of these services can read your passwords, notes or files: those leave your device only in encrypted form.
Organizations that use single sign-on connect their own identity provider, which they choose and run themselves.
- Google Cloud: What it does for SyFly: Runs our servers and database; What it receives: Your encrypted vault and your account details
- Upstash: What it does for SyFly: Shared limits that stop password guessing across our servers; What it receives: Short-lived counters that never hold your email in readable form
- Stripe: What it does for SyFly: Payments for paid plans; What it receives: Your billing details; your card number goes to Stripe, never to SyFly
- Google (Gmail): What it does for SyFly: Sends our emails: sign-in codes, alerts and invitations; What it receives: Your email address and the message
- Twilio: What it does for SyFly: Sends sign-in codes by text message, if you choose SMS; What it receives: Your phone number and the code
- Google and Apple: What it does for SyFly: Sign in with Google or Apple, if you use it; What it receives: What you allow them to share with us, such as your name and email
- Google reCAPTCHA: What it does for SyFly: The human check shown when traffic looks automated; What it receives: The signals Google collects from your browser for that check
- Have I Been Pwned: What it does for SyFly: The free Password Health tool on our website; What it receives: The first 5 characters of a one-way hash of the password checked, sent from your browser; nothing that identifies you
- Google Tag Manager and Analytics: What it does for SyFly: Visit statistics on our marketing pages only, never in the app or on these security pages; What it receives: The pages you visit and your browser
Where your data is stored
Our servers and database run on Google Cloud in Iowa, in the United States. This includes the encrypted copies of your vault, for users in every country, including the European Union.
What we store there is locked on your device first, with keys we don't have. Even where data is stored, we can't read your vault.
Requests for user data
As of 10 November 2026 we have received 0 requests for user data from governments, police or courts, and handed over nothing.
If we receive one, we can only hand over what we hold: your account details and encrypted data that we can't read. We tell the user concerned unless the law forbids it, and we update the number on this page.
Security incidents
There have been no security incidents affecting users.
If one happens, we tell the users affected without delay, and we publish here what happened, what it affected and what we changed.