Architecture & Security
Trust is the foundation of client management. Zynclog is engineered with enterprise-grade security practices to ensure your data, and your clients' data, remains private, highly available, and strictly controlled.
Infrastructure
Zynclog is built on a modern, serverless edge architecture:
- Framework: Next.js (App Router) for edge-optimized rendering.
- Database: PostgreSQL managed via Drizzle ORM for absolute transactional integrity.
- Caching & Limits: Upstash Redis handles our strict rate-limiting and session caching.
- Telephony & Identity Security: Telnyx Verify API provides global SMS OTP verification to validate user phone numbers and prevent fraudulent account creation or unauthorized contract modifications.
Rate Limiting Policy
To guarantee 100% uptime and lightning-fast speeds for all users, we enforce rate limits on our API and Server Actions. If you exceed these limits, you will receive an HTTP 429 Too Many Requests response.
| Endpoint Category | Limit | Refresh Window |
|---|---|---|
| Authentication | 5 requests | per 5 minutes |
| Milestone Updates | 30 requests | per 10 seconds |
AI Generation Pro/Agency | 10 requests | per 1 minute |
Note: Agency tier accounts possess dedicated infrastructure routing, effectively doubling the standard operational rate limits.
Authorization & Access Boundaries
Zynclog enforces strict multi-tenant authorization controls across server actions and API endpoints:
- Project Ownership Verification: Every contract and invoice mutation verifies that the target project belongs to the authenticated freelancer's user ID. Attempting to assign or modify content for un-owned projects results in immediate rejection.
- Token-Gated Client Portals: Client workspace access is isolated by project slug and secure cryptographic tokens (
tokenClient). Clients can only view documents aligned to their specific workspace. - Automated Life-Cycle & Immutability: Due dates are continuously evaluated against current UTC timestamps. Overdue pending agreements automatically transition to Expired in the database, and finalized or expired records are strictly locked against unauthorized edits or deletions.
Data Integrity & Webhooks
We treat your database as the ultimate source of truth.
- Financial Security: All subscription state changes are handled via cryptographically verified Webhooks from Paddle. We do not rely on client-side requests to upgrade or downgrade accounts, making billing manipulation impossible.
- Audit Trails: Every state change (creating a project, updating a milestone, changing a title) is logged in an immutable
ActivityLogtable. This guarantees you always have a verifiable history of who did what, and when.
Responsible AI Usage
For users on our Pro and Agency tiers, Zynclog utilizes background AI agents to summarize milestones and detect scope creep.
- Zero Training Policy: The text you input into Zynclog is sent to our LLM providers strictly for processing. Your proprietary client data, code snippets, and updates are never used to train public foundational models.
Platform Scope & Legal Compliance
[!WARNING] Zynclog is a Direct-to-Consumer (D2C) client portal and project management platform. We provide tools for organizing your client relationships, not legal or financial services.
- Not an E-Signature Service: Zynclog does not offer legally binding e-signatures compliant with standards like the ESIGN Act or eIDAS. Any contracts hosted or tracked within Zynclog should be signed externally using verified providers (e.g., DocuSign, HelloSign) if legal enforceability is required.
- Not a Financial Institution: Invoices created in Zynclog are for organizational and presentational purposes. We are not a merchant of record, payment processor, or accounting firm. Always consult with a licensed professional for legal and tax compliance.