Security at Simbo
Your words are private by design. Here's how we protect your account, and how to tell us if you find a problem.
Private by design
Spelling and grammar run on your device. Text sent to AI features isn't stored. We keep only what's needed to run your account.
Locked-down access
Staff need two-step sign-in, see only what their role allows, and every change they make is logged.
Hardened website
A strict content security policy, HTTPS everywhere, bot protection on every form, and rate limits on sign-up, sign-in and codes.
How we protect your account
- Passwords are stored only as secure one-way hashes; we never see them.
- Optional two-step sign-in with an authenticator app, in your account.
- Every connection is encrypted with HTTPS (TLS). Data at rest is encrypted by our infrastructure providers.
- Database rules make sure each person can only ever read their own records.
- Payments are handled by Stripe, which is certified to PCI DSS Level 1. Card numbers never touch Simbo's systems.
- Desktop updates are cryptographically signed, so your app only installs genuine Simbo updates.
- Accounts that never confirm their email are removed automatically, and old applications and support conversations are deleted on schedule.
Report a vulnerability
If you believe you've found a security issue in Simbo, email security@simbotech.com with the details and steps to reproduce it. We'll acknowledge your report within three business days and keep you updated.
We won't take legal action against you for research done in good faith that follows these rules: don't access or change other people's data, don't disrupt the Services (no denial-of-service, spam or social engineering), give us reasonable time to fix the issue before sharing it, and use only accounts you own or have permission to test. Our security.txt file has the same contact details.