Security

Every record in Synapse belongs to exactly one company. Isolation is enforced in the database itself with row-level security tied to your verified session, not in application code that could be bypassed by calling the API directly. A request carrying a valid session for one company cannot read, write or reference another company's rows.

Company membership can only be created by our servers after validating an invitation addressed to your own verified email. Users cannot add themselves to an organization.

• Administrator status, subscription plan and billing state are writable only by our servers — never by a browser session, even a modified one.
• Plan entitlements are evaluated on the server from trusted database state before any gated feature runs, so a client-side change unlocks nothing.
• Role changes within a company require a CEO or general manager, and nobody can change their own role.
• Subscription state is set exclusively by signature-verified Stripe webhooks.

Before any question reaches an AI model, Synapse retrieves candidate knowledge through the asking user's own permissions. Records they cannot see are filtered out at the database layer and are never placed in the prompt — the model cannot leak what it was never given. Answers cite the specific records they were drawn from, so every claim is traceable.

Prompts are wrapped with injection guards that instruct the model to treat retrieved document text as untrusted data rather than as instructions.

• TLS 1.2+ for all traffic, with HTTPS enforced on the application domain.
• AES-256 encryption at rest for the database, file storage and backups.
• Passwords stored as salted bcrypt hashes; we never see or store plaintext passwords.
• Secrets and API keys held in encrypted server-side configuration, never shipped to the browser bundle.

Original uploads are preserved byte-for-byte in private storage. Downloads are served through short-lived signed URLs scoped to the requesting user; the raw storage path is not publicly reachable, and a signed link generated for one company's user does not resolve for anyone else.

AI generation and embeddings run through OpenAI's API. All calls are made server-side — the API key never reaches the browser. Under OpenAI's API terms, content submitted through the API is not used to train their models.

• Application hosted on Cloudflare's edge network with DDoS protection.
• Database, authentication and storage on Supabase, running in managed cloud infrastructure with automated encrypted backups and point-in-time recovery.
• Payments handled entirely by Stripe; card data never reaches Synapse servers.

• Least-privilege access to production, restricted to personnel who need it.
• Changes are reviewed and deployed through an auditable pipeline.
• Dependencies are monitored for known vulnerabilities and patched promptly.
• Authentication events and administrative actions are logged.

We welcome coordinated disclosure. Email security@mysynapseai.com with steps to reproduce and we will acknowledge within two business days. Please do not access or modify data belonging to others, degrade the service, or publicly disclose before we have had a reasonable opportunity to fix the issue. We will not pursue legal action against researchers who follow these guidelines.

Synapse is built to GDPR and UK GDPR principles and supports data subject requests, export and deletion. We are not currently SOC 2 or ISO 27001 certified, and we will state so plainly rather than imply otherwise. Enterprise customers can request a security review, a data processing agreement and our current sub-processor list at security@mysynapseai.com.