How your stuff stays your stuff.
We sync the configuration that makes your AI tooling yours. That means we’re inside the chain of trust between your editor and the model – we take that seriously. This page is the short version; the long version is the code.
TLS 1.3 only. HSTS preload. Perfect-forward-secrecy ciphers. Cloudflare-proxied origin with IP allowlists at the host firewall.
Per-account symmetric encryption keys, derived per-blob with AES-256-GCM. Object payloads are opaque to the storage layer.
API keys, OAuth refresh tokens, and Stripe IDs are kept in a separate KMS-backed table. They never appear in logs, request traces, or sync blobs.
Argon2id password hashing with sane parameters. Sanctum-issued device tokens. PKCE for desktop OAuth. Email-verification gated for sensitive actions.
Every machine pairs with its own scoped token. Revoking a device invalidates its token immediately – no replay window.
One MySQL schema, row-level scoping by account ULID. Redis namespaces per environment. Background jobs run in a separate user context.
What we store
- Your account email + Argon2id-hashed password.
- The skills, prompts, hooks and MCP-server manifests you choose to sync.
- Per-device pairing metadata (name, OS, last-seen).
- Stripe customer and subscription IDs (no card data ever touches our servers).
What we never store
- Your Anthropic / OpenAI / Google API keys. Those stay on the device that uses them.
- Conversation transcripts, model outputs, or anything you generate with the CLIs.
- Source code from your projects.
- Card numbers, CVVs, or expiry dates – Stripe is the system of record.
Reporting a vulnerability
Email security@harnesssync.com with a description and reproduction. We aim to acknowledge within one business day and ship a fix within seven. We don’t run a paid bounty yet – we will say thank you, publicly, and credit you in the changelog if you want.
Please don’t test against accounts that aren’t yours and don’t exfiltrate other people’s data. Stay within scope and we’ll work with you, not against you.
Subprocessors
- EDGE · Cloudflare – DNS, TLS, edge cache, AI bot policy.
- HOST · netcup GmbH (DE) – root-server hosting, EU jurisdiction.
- PAY · Stripe Payments Europe – billing + invoicing.
- MAIL · Postmark – transactional email (verification, reset).
- CI · GitHub Actions + GHCR – build & image registry.