Security at ZillaSoft
How we protect your account, your data, and the infrastructure that runs our products.
What we do to keep you safe
These practices are in place today, not planned for the future.
HTTPS everywhere
All traffic is served exclusively over HTTPS. HTTP requests are refused. HSTS is enforced with a one-year max-age to prevent protocol downgrade attacks.
Security headers
Every response includes X-Content-Type-Options, X-Frame-Options (DENY), Referrer-Policy (strict-origin-when-cross-origin), and a strict Content Security Policy (CSP) enforced at the CDN layer. XSS protection is handled by the CSP with a script-src 'self' policy rather than the deprecated X-XSS-Protection header.
Authentication via Auth0
All user authentication is handled by Auth0 using the PKCE flow with rotating refresh tokens. No passwords are ever stored by ZillaSoft. Session tokens are managed by the Auth0 SDK in your browser and cleared when you sign out.
Data encryption at rest
All Snipzilla snippet data is encrypted locally using AES-256-GCM. Access is protected by a personal passphrase, with a one-time recovery code as backup, and the encryption key is held in your device's OS keyring, never written to disk alongside your data. Your snippet files are unreadable at rest, even with direct access to the underlying storage.
Global CDN delivery
The ZillaSoft website is served from AWS CloudFront, a globally distributed CDN. Static assets are served from edge locations close to each visitor with no origin server exposed to the public internet.
Email authentication
All outbound email from zillasoft.io is protected by DKIM signing and DMARC policy enforcement. This prevents spoofing and ensures email integrity for transactional and notification messages.
Bot & spam protection
All public-facing forms use Cloudflare Turnstile to verify human submissions without invasive tracking. A secondary honeypot layer silently filters automated bots before any request reaches our backend.
API rate limiting
Our API enforces per-endpoint rate limits to prevent abuse and brute-force attempts. Requests that exceed thresholds are rejected before they reach application logic.
Your data stays on your device
Data for Standard plan users is stored locally on your machine and never transmitted to ZillaSoft servers. Cloud sync is included in Trial, Premium, and Enterprise plans and active by default. Synced data is end-to-end encrypted before it leaves your device.
Complete account deletion
Users can permanently delete their account directly from the dashboard at any time. Deletion cascades across all systems: subscription is cancelled, all stored data is purged from our database, and the identity record is removed from our auth provider. Nothing lingers.
No advertising or cross-site tracking
The ZillaSoft website runs no advertising, cross-site tracking, or fingerprinting scripts. The third parties we do load are limited to Cloudflare Web Analytics (cookieless, no profiling), Sentry for error and performance monitoring (EU-hosted), Cloudflare Turnstile (bot protection on forms), and Stripe (checkout on store pages). Fonts are self-hosted, so no requests go to Google Fonts or similar services.
No keylogging, ever
Snipzilla requires a global keyboard hook to detect your configured trigger character as you type. That mechanism is the same one keyloggers use, so it is worth being direct: Snipzilla watches only for your trigger character. No keystrokes are recorded, stored, transmitted, or shared. The hook exists exclusively to detect expansion triggers and nothing else.
End-to-end encrypted sync
Cloud-synced data is end-to-end encrypted using AES-256-GCM. Encryption and decryption happen entirely on your device. The server stores only ciphertext it cannot read. A recovery code is generated on first sync; save it to restore access on a new device. All data is also secured in transit by HTTPS.
Local-only app integration
Snipzilla and Stashzilla talk to each other only over a local loopback connection (127.0.0.1) on your own device, and only when you trigger it (for example, to pick a clip or save one as a snippet). The clipboard items and snippets exchanged stay on your machine and are never sent to ZillaSoft through this integration.
Runs on Atlassian (Jira app)
Snipzilla Templates for Jira runs entirely on Atlassian's Forge platform. It makes no outbound network calls (zero egress), so your templates and issue data never leave Atlassian's infrastructure or reach ZillaSoft. It requests only the minimum Jira scopes it needs, and every action runs with the signed-in user's own permissions.
Responsible disclosure
Found a security issue? We want to know. Please report vulnerabilities privately before disclosure.
A security.txt file is available at /.well-known/security.txt with our contact details in the standard format for security researchers.
How to report
Submit your report via our secure contact form (select "Security" as the subject). Reports are routed to a private channel and are never publicly visible.
We will acknowledge your report within 2 business days and aim to provide a fix or mitigation within 30 days, depending on severity.
We ask that you give us time to address the issue before public disclosure. We will credit researchers who follow responsible disclosure practices.
Prefer email? You can also reach us directly at security@zillasoft.io. Either channel routes to the same private security inbox.
What's coming
SOC 2 Type II audit
Planned for after our initial product launch. The audit period will begin once we have a stable user base that justifies the process and cost.
Third party security verifications
Independent security assessments will be scheduled as part of the enterprise readiness roadmap.
macOS support
Snipzilla currently supports Windows and Linux. macOS support is on the roadmap and will be released once code signing and platform certification requirements are in place.
Third-party accessibility audit
An independent audit against WCAG 2.1 Level AA is planned to formally verify our accessibility commitments across all ZillaSoft products and web properties.
Stashzilla clipboard manager
A privacy-first desktop clipboard manager for Windows and Linux, currently in development. Features a global search overlay, AI-powered clip tagging, and deep Snipzilla integration.
Changes to this page
We may update our security practices over time.
Related policies
Last reviewed: July 21, 2026