Security at ZillaSoft
How we protect your account, your data, and the infrastructure that runs our products.
What we do to keep you safe
These practices are in place today, not planned for the future.
HTTPS everywhere
All traffic is served exclusively over HTTPS. HTTP requests are refused. HSTS is enforced with a one-year max-age to prevent protocol downgrade attacks.
Security headers
Every response includes X-Content-Type-Options, X-Frame-Options (DENY), Referrer-Policy (strict-origin-when-cross-origin), and a strict Content Security Policy (CSP) enforced at the CDN layer. XSS protection is handled by the CSP with a script-src 'self' policy rather than the deprecated X-XSS-Protection header.
Authentication via Auth0
All user authentication is handled by Auth0 using the PKCE flow with rotating refresh tokens. No passwords are ever stored by ZillaSoft. Session tokens are managed by the Auth0 SDK in your browser and cleared when you sign out.
Data encryption at rest
All Snipzilla snippet data is encrypted locally using AES-256-GCM. Access is protected by a personal passphrase, with a one-time recovery code as backup, and the encryption key is held in your device's OS keyring, never written to disk alongside your data. Your snippet files are unreadable at rest, even with direct access to the underlying storage.
Global CDN delivery
The ZillaSoft website is served from AWS CloudFront, a globally distributed CDN. Static assets are served from edge locations close to each visitor with no origin server exposed to the public internet.
Email authentication
All outbound email from zillasoft.io is protected by DKIM signing and DMARC policy enforcement. This prevents spoofing and ensures email integrity for transactional and notification messages.
Bot & spam protection
All public-facing forms use Cloudflare Turnstile to verify human submissions without invasive tracking. A secondary honeypot layer silently filters automated bots before any request reaches our backend.
API rate limiting
Our API enforces per-endpoint rate limits to prevent abuse and brute-force attempts. Requests that exceed thresholds are rejected before they reach application logic.
Your data stays on your device
Your content on the Standard plan (snippets and clips) is stored locally on your machine and never transmitted to ZillaSoft servers; only account, subscription, and feedback data you submit reaches our API. Cloud sync is included in Trial, Premium, and Enterprise plans and active by default. Synced data is end-to-end encrypted before it leaves your device.
Complete account deletion
Users can permanently delete their account directly from the dashboard at any time. Deletion cascades across all live systems: subscription is cancelled, all stored data is purged from our database, and the identity record is removed from our auth provider. Copies inside our encrypted nightly backups age out on the normal backup rotation schedule.
No advertising or cross-site tracking
The ZillaSoft website runs no advertising, cross-site tracking, or fingerprinting scripts. The third parties we do load are limited to Cloudflare Web Analytics (cookieless, no profiling), Sentry for error and performance monitoring (EU-hosted), Cloudflare Turnstile (bot protection on forms), and Stripe (checkout on store pages). Fonts are self-hosted, so no requests go to Google Fonts or similar services.
No keylogging, ever
Snipzilla requires a global keyboard hook to detect your configured trigger character as you type. That mechanism is the same one keyloggers use, so it is worth being direct: Snipzilla watches only for your trigger character. No keystrokes are recorded, stored, transmitted, or shared. The hook exists exclusively to detect expansion triggers and nothing else.
End-to-end encrypted sync
Cloud-synced data is end-to-end encrypted using AES-256-GCM. Encryption and decryption happen entirely on your device. The server stores only ciphertext it cannot read. A recovery code is generated on first sync; save it to restore access on a new device. All data is also secured in transit by HTTPS.
Local-only app integration
Snipzilla and Stashzilla talk to each other only over a local loopback connection (127.0.0.1) on your own device, and only when you trigger it (for example, to pick a clip or save one as a snippet). The clipboard items and snippets exchanged stay on your machine and are never sent to ZillaSoft through this integration.
Marketplace apps run on the host platform
Our Snipzilla Templates apps for Jira, Zendesk, and Freshdesk run entirely on the host platform's own app infrastructure, inside your account there. They make no outbound network calls (zero egress), so your templates and issue or ticket data never leave that platform or reach ZillaSoft. Each app requests only the minimum scopes it needs, personal libraries are readable only by the agent who created them where the platform enforces access rules, and every action runs with the signed-in user's own permissions. The same holds for any marketplace app we release in the future.
Browser extension, private by design
The Snipzilla browser extension for Chrome, Edge, and Firefox keeps your snippet library in your browser's extension storage and watches only for your typed shortcut in the page you are writing in: nothing is recorded before a shortcut matches, and only the name of the matched shortcut leaves the page. The clipboard is read solely when a snippet you expand uses the clipboard placeholder. Cloud sync uses the same end-to-end encryption as the desktop app, and the free tier keeps everything in your browser.
Responsible disclosure
Found a security issue? We want to know. Please report vulnerabilities privately before disclosure.
A security.txt file is available at /.well-known/security.txt with our contact details in the standard format for security researchers.
How to report
Submit your report via our secure contact form (select "Security" as the subject). Reports are routed to a private channel and are never publicly visible.
We will acknowledge your report within 2 business days and aim to provide a fix or mitigation within 30 days, depending on severity.
We ask that you give us time to address the issue before public disclosure. We will credit researchers who follow responsible disclosure practices.
Prefer email? You can also reach us directly at security@zillasoft.io. Either channel routes to the same private security inbox.
What's coming
macOS support
Snipzilla currently supports Windows and Linux. macOS support is on the roadmap and will be released once code signing and platform certification requirements are in place.
Third-party accessibility audit
An independent audit against WCAG 2.1 Level AA is planned to formally verify our accessibility commitments across all ZillaSoft products and web properties.
Changes to this page
We may update our security practices over time.
Related policies
Last reviewed: August 22, 2026