PRIVACY

Privacy

Last updated 1 November 2026.

Who controls your data

Synlace, a company registered in England and Wales (company number 16274543, registered address 40 Hemlock Way, Chandler's Ford, Eastleigh, England, SO53 4LT), is the controller of the personal data described here. Contact: aidan@synlace.ai.

Where it is stored

Threat Strata runs on a server located in Germany. Processing stays within the UK and the EEA; no data is transferred outside those areas. (UK↔EEA transfers are covered by the UK's adequacy regulations for the EEA.)

What we store

• Your username.
• A hash of your authentication key, produced with scrypt (N=16384, r=8, p=1). We cannot reverse it.
• Your workspace blob — encrypted in your browser before it is sent.
• Threat models you publish — ciphertext only.
• Timestamps and a revision number for each model, so concurrent edits can be rejected instead of silently overwriting each other.
• Short-lived counters derived from your IP address, used only for rate limiting.

What we never store

• The plaintext of any threat model.
• Your password or the key that decrypts your workspace.
• Your email address — we do not ask for one.

Lawful basis

We rely on two bases. Performance of a contract covers creating and operating your account and storing what you upload. Legitimate interests covers the short-lived rate-limiting counters and the request logs described below, which exist to prevent abuse and keep the service available. We do not rely on consent: we send no marketing and set no advertising or analytics cookies.

Cookies

One cookie, set only after you sign in. It is signed, HttpOnly, Secure, and expires after 7 days. There are no advertising or analytics cookies.

Third parties

None. The site loads no external scripts, fonts, or images, and sends no telemetry. Everything is served from this server.

Logs

The server keeps request logs for abuse prevention, which can include IP addresses and requested paths. They are not joined to your account for any other purpose.

Deletion

Deleting your account deletes your workspace blob and every model you published. Backups are kept for 14 days and then expire; deleted content is not restored from them.

Your rights

You can ask for a copy of your data, its correction, deletion, or restriction, and you can object to processing carried out on the basis of legitimate interests. Because we hold no email address, we can only act on a request we can tie to an account, so name the account when you write. Most of what we hold is ciphertext we cannot read, and we cannot recover a lost password or workspace key.

If you believe we have handled your data unlawfully, you can complain to the UK Information Commissioner's Office at ico.org.uk. We would rather you contacted us first so we can try to put it right.

Contact

aidan@synlace.ai