Security

A clear boundary around projects, assets, and accounts.

Last reviewed August 25, 2026. This page describes implemented controls and known limits in plain language.

What we store

Account identifiers and plan state needed to provide the service.
Private folders, published symbols, Builder project documents, and revision metadata.
PNG or SVG assets you intentionally import into a library or project.
Feedback and support information you choose to submit.

What stays on your device

Every Builder project keeps a crash-recovery copy in browser IndexedDB.
Local-only projects are not sent to cloud persistence unless you enable it.
The Builder workspace color theme remains browser-local and does not alter export colors.
Portable project packages are created only when you request an export.

What we do not need

PLC programs, live process values, runtime connections, or plant credentials.
Complete HMI project files unless you deliberately provide relevant material for support.
Card numbers or security codes; future payment details will be handled by Stripe.
Advertising profiles or third-party marketing analytics during the public beta.

Authentication and ownership

Production accounts use app-owned email/password identities with hashed passwords, required email verification, database-backed sessions, and rate limiting. Production configuration fails closed when authentication is unavailable. Project, project-asset, and library-asset routes require a signed-in account and verify library ownership before returning private content.

Uploads and project validation

Imports are size- and type-checked, SVG content is sanitized, external references are rejected, project packages use fixed validated paths, and project documents are checked against version and structural limits before cloud storage.

Autosave conflicts

Cloud projects use optimistic revisions. A save based on an older revision receives an explicit conflict response instead of silently overwriting newer project work. Local recovery remains available while a connection is interrupted.

Data control

Signed-in users can export account, project, and library metadata or request permanent account deletion from Account data. Privacy requests can also be sent to privacy@konnectsymbols.com.

Infrastructure responsibilities

Neon stores application and authentication data, Resend delivers transactional account email, and Vercel hosts the application and private asset storage. Stripe will appear in the active subprocessor list only when paid plans are enabled.

Certifications and limits

KonnectSymbols does not currently claim SOC 2, ISO 27001, PCI certification, formal penetration-test coverage, guaranteed backup recovery, guaranteed data residency, or a published uptime SLA. Provider certifications do not automatically certify KonnectSymbols.

Report a vulnerability

Email security@konnectsymbols.com with the affected URL, reproduction steps, and impact. Do not access data that is not yours, disrupt the service, or publicly disclose an unresolved issue.