Built to read files, not to collect them.

Where the work happens

Syft's file analysis (metadata, privacy, structure, provenance, writing analysis, and the Compare, Clean, Extract and Search tools) opens the file where it already is; the file itself is not uploaded. Syft Detect runs on Syft's own servers: the text needed for detection is sent once over an encrypted connection, analysed, and deleted shortly after the result reaches the Syft workspace. It is never used to train a model or shared with anyone.

Only what an operation needs

A few operations need more than a browser can do: deeper metadata inspection, and producing a clean copy of a PDF. Each one sends the file or the text that operation needs and nothing else, for that one request, and only when you ask for it.

Third-party boundaries

Where an operation relies on a service outside Syft, it sends the minimum that operation needs, scoped to that one request. Every such service is named in the privacy policy, and in the product at the point of use.

Encrypted transport

Everything between your browser and Syft, and between Syft and any service Syft relies on, travels over TLS.

Authentication & isolation

Accounts are authenticated server-side, sessions are validated on every request, and everything Syft holds for you on the server is scoped to your account. Your local library belongs to the browser profile it was created in. It stays there when you sign out, and can be cleared from Settings. Entitlement decisions are made on the server, never trusted from the browser.

Responsible disclosure

Found a vulnerability? Email security@usesyft.com. We read that inbox with priority, and we'd rather hear about it twice than not at all.

The full detail of every operation, the services behind it, and the terms lives in the privacy policy. Questions: security@usesyft.com.