Your computational data never leaves your device.
Not a policy, an architecture. Computation runs in your browser through WebAssembly, so there is nothing on our side to breach, subpoena or leak.
VaultSync cannot access, recover or produce your computational data, because we do not possess it. Here is every category, and where each one lives.
| Data | Where it lives |
|---|---|
| Inputs, parameters, configurations | Your device only |
| Results, charts, datasets, trust verdicts, downloadable bundles | Your device onlyGenerated client-side, saved to your local storage |
| Your API keys for arXiv or your own services | Your browser's local storageRead at the moment of the outbound request, and sent only to that destination |
| Account data: name, email, affiliation, tier, login timestamps | Our servers, in the United StatesEncrypted in transit and at rest, access restricted by role. Used for licence administration and authentication |
| Card and bank details | Stripe, under PCI-DSSWe never receive them |
| The documented API endpoints and the in-app support ticket | Sent to us to return a resultServices the request, and is not retained after the session ends |
| Everything else | Stays on your device |
We do not sell, share, rent or trade user data, to anyone, for any purpose. We do not use your data, inputs or results to train any AI, machine-learning or language model.
Because computation is client-side, the data surface a SOC 2 audit examines, customer data held on the vendor's systems, does not exist here.
That is an explanation, not a substitute. If your procurement requires a formal attestation, write to legal@getvaultsync.com and we will discuss what you need.
In-app ticket and email, initial response within one business day. Pro and HPC tiers get priority handling.
Because computation runs locally, GDBS keeps working on your device through a server-side interruption.