Security at CueSync
Layered controls protect your account, your licence, your show data and your production information. This page lists each one.
Account protection
Strong authentication and account controls keep your subscription, licence and devices in your hands.
- Strong password protection, signed-in sessions that are safeguarded against misuse, and temporary blocking of repeated failed sign-in attempts.
- Two-factor authentication with any standard authenticator app — for example 1Password, Authy, Google Authenticator or Yubico Authenticator — plus one-time recovery codes issued when you turn it on.
- Sensitive actions, including changing your sign-in details, managing your plan and turning off two-factor authentication, ask you to confirm again.
Data protection
Connections are encrypted, stored data is protected appropriately, and card details never reach CueSync.
- Connections to cuesync.live and our account services are encrypted (HTTPS).
- Stored account data is protected with safeguards appropriate to its sensitivity, and passwords are never stored in readable form.
- We design our logging to leave out credentials, card data and licence keys; what we do record is inventoried in the Privacy Policy.
- Payments are handled by our payment provider, Paddle, the merchant of record — we never handle your card details.
Licence protection
Licence integrity and secure device activation keep your subscription yours, without putting your show at the mercy of the venue network.
- CueSync includes safeguards against licence tampering and misuse, and licences are activated securely on the devices you register.
- You manage your registered devices from your account dashboard; deactivating one frees its slot straight away.
- Shows keep running without internet — licence validation happens periodically online, with a 7-day offline grace period (30 days on a lifetime licence).
Privacy
We collect only what we need, optional cookies follow your consent, and your data is yours to export or delete.
- We collect what running your account, licence and billing needs, plus error diagnostics and optional product analytics you can decline. The Privacy Policy lists everything we record and why.
- Optional cookies and storage stay off until you accept. A small number of items load before you choose, and the Cookie Policy lists each one.
- You can export your account data from your account dashboard or on request via contact@cuesync.live, and you can delete your account. Billing records are kept only as long as the law requires.
Security updates
Security improvements are continuously incorporated into CueSync releases.
- By default the app checks for updates on launch and while it runs. Ordinary updates install only when you choose; CueSync holds an install back while it can see a show running, and a rare critical fix installs itself once CueSync can see that no show is running.
- Downloaded updates are verified before they are installed.
Responsible disclosure
We want to hear from security researchers. Our policy is published as security.txt per RFC 9116.
- Contact: contact@cuesync.live
- Expected acknowledgement window: 72 hours.
- No safe-harbor paperwork required for good-faith research on production infrastructure.
- See /.well-known/security.txt for the canonical disclosure record.
Found something concerning? Email contact@cuesync.live — we read every report and acknowledge it within 72 hours. Policy: security.txt.