Security

Syllavo does not ask for, receive, or store your Canvas credentials. The Chrome extension runs inside your own Canvas tab and reads course data using the session you are already signed in to. There is no place in the product where a Canvas password could be typed, because there is no code that would accept one.

This is also why the extension is required and why setup has to happen in the browser where you use Canvas — nothing on our servers can reach Canvas on your behalf.

Every connection between your browser, the extension and our backend uses HTTPS with TLS. There is no plaintext channel to fall back to.

Syllavo passwords are stored as bcrypt hashes and never in readable form — we cannot see your password, which is also why we cannot recite it back to you. New passwords are checked against a minimum length and a list of the most-guessed passwords before an account is created, and sign-in and registration are rate-limited.

You can also sign in with Google, in which case Syllavo never handles a password at all.

The extension is scoped to Canvas pages and to Syllavo's own domains. It has no permission to read your banking, your email, or any other site, and that limit is enforced by Chrome from the manifest, not by our good intentions.

The optional lecture recorder captures audio from one browser tab that you pick, only after you click to start it. It is off by default, it never starts on its own, and Chrome shows a recording indicator for the entire time it runs.

Every request to the Syllavo backend carries a signed token, and every query for your data is scoped to your user ID on the server — not filtered in the browser. Requesting another student's material returns nothing, not someone else's notes.

Course files that are shared by nature — a lecture PDF several students in the same class have synced — are stored once and deduplicated by content hash. Your personal material, notes, decks and grades are never shared this way.

You can download a full JSON export of everything stored about you from Settings → Privacy & data, and delete your account from the same screen. Deletion is a hard delete and takes effect immediately — there is no recovery window, which is the point.

The full detail of what is kept, for how long, and your rights under GDPR is in the Privacy Policy. The steps are on the support page.

If you find a security problem, email syllavohelp@gmail.com with enough detail to reproduce it. We will confirm receipt, and we will not pursue anyone who reports a genuine issue in good faith and does not access, alter or retain other people's data while finding it.

Syllavo is a young product built by a small team. We do not hold a formal security certification, and saying otherwise would be the first thing worth not trusting. What we can tell you is what is written above, all of which is checkable in the product.