Security & data handling

Information for users and business IT reviewers.

Effective September 29, 2026

Application purpose

SymLab Studio is a business engineering web application for packaging-line simulation, conveyor timing, and production concept analysis. Its intended classification is business/engineering software. Public descriptions and structured metadata describe this purpose; third-party security vendors determine their own categories.

Access controls

The Studio requires an invited account and an active membership check on the server. The branding suite and support inbox additionally require the owner role. Password authentication is handled by Supabase. Session cookies are Secure and HttpOnly. Cross-origin mutation requests are rejected, and sign-in and support submission rates are limited.

Network and browser behavior

The intended browser origin is https://www.symlab.studio. Account and support requests use same-origin HTTPS endpoints; server-side services communicate with the dedicated Supabase project. The application does not request microphone, camera, geolocation, or payment access. Engineering tools use JavaScript, canvas graphics, same-origin embedded pages, local browser storage, and user-initiated downloads and printing.

Data handling

Authentication and support data use the SymLab App project in the SymLab Studio Supabase organization. Database tables used for membership and support have row-level security enabled and are not directly readable by anonymous visitors or regular browser clients. Engineering scenarios in the current tools are stored locally on the user's device. See the Privacy Policy and Cookie Notice.

Security reports and access issues

Use Support Contact and select Security report or Business access / website classification. Include the affected URL, approximate time and timezone, and any displayed category or policy name. Do not submit passwords, invitation links, session cookies, or confidential project data. Submitting a report does not authorize intrusive testing.

Corporate browser-isolation and content-filtering policies may restrict editing, printing, or downloads. Support can review application behavior and provide product information; only the relevant provider or organization can change its classification or policy. No third-party security approval or certification is claimed.