Security
Your work, kept safe.
Every request is checked
Every server function verifies who you are, that you belong to the workspace and that your plan allows the action, and validates its input before doing anything.
Keys are encrypted
API keys you add for your own AI providers are encrypted before they are stored, or, if you prefer, kept only in your browser and never sent to us.
Files behind signed links
Uploads and exports live in private object storage. Your browser gets short-lived signed links, never public URLs.
Untrusted content stays untrusted
Uploaded SVGs are sanitised. Text and images inside designs are treated as data by the AI, never as instructions, with tool allowlists and step and cost caps on every run.
Encrypted in transit
Every connection to desyn.app and the app uses TLS. Sessions are handled by Better Auth with secure, HTTP-only cookies.
Limits and audit trail
Rate limits protect accounts from abuse, and security-relevant events, such as sign-ins, key changes and sharing, are written to an audit log.
Backups
The database and file storage are backed up every night to separate storage.
The source is public
Desyn is open source, so anyone can read how it handles data and report what they find.
Found a vulnerability?
Please email hello@desyn.app with “Security” in the subject, steps to reproduce and the impact you expect. Give us a reasonable time to fix it before you share it publicly, and do not access other people’s data or disrupt the service while testing. We read every report, reply as quickly as we can and credit you if you would like.
Your first design is a sentence away.
Start free in the browser. Upgrade when you want the AI.
Start designing — free