Security
Security
How to reach us about a security problem, how to check that a release came from us, and what leaves your machines.
Report a vulnerability
Email support@synauson.com. Please write in English.
On every plan, including the Free plan, we publish security fixes for the current minor release and the one before it. The support policy has the details. Our contact and policy are also published in machine-readable form at /.well-known/security.txt.
Signed releases
We sign synauson’s release artifacts, the server image and the natives jars, with cosign. The public key that verifies them is published here, at synauson.com/cosign.pub. Fetch it from this site and use cosign to check an artifact against it before you deploy it.
What leaves your machines
synauson runs on your own servers, and audio, transcripts, synthesized speech and everything else your calls carry stay there. To keep your license current, each instance sends Synauson a small usage report about every 30 seconds and renews its license about once a day, and it downloads the models it uses from us. How licensing works lists exactly what those requests contain, how long we keep it and who handles it.