SECURITY AND PRIVACY

Security is part of how the platform is built.

Encryption, tenant separation, role-based access, and audit trails are part of the product from the start. Here is what we do today, and where we are still early.

OUR PRACTICES

Six security practices across our products.

Encryption in transit and at rest

Data is encrypted in transit using TLS 1.2 or higher, and encrypted at rest using AES-256 through our infrastructure providers (Vercel, Supabase, and AWS).

Role-based access control

Permissions are scoped to workspaces and roles. Each workspace is a separate tenant, and users can access only what their role permits. Changes to access are recorded in the audit log.

Tenant isolation

Customer data is separated between workspaces using Row Level Security in the database. Support access to customer workspaces is restricted and is granted only with your authorization.

Hosting and data location

Our application runs on Vercel. Our database and file storage run on Supabase, hosted in the United States (AWS us-east-1). Enterprise customers can ask us about other regions, subject to availability.

No training on customer data

We do not use customer data to train AI models. We send customer content to AI providers only to produce your outputs, under API terms that do not permit training on that content. Retention follows each provider’s published policy.

Audit log

Key actions in the platform, such as creating, editing, approving, and deleting records, are written to an audit trail with the user, timestamp, and record affected. Audit logs can be exported on request.

AI DATA PRINCIPLES

How we handle AI and your data.

AI outputs can be wrong. Here is how we limit what models see and how we keep you in control.

Reviewable output
AI-generated fields, quotes, specs, and summaries can be reviewed and edited before you use them. You are responsible for checking outputs before relying on them.
More than one provider
We can use more than one AI provider, with failover where configured, to reduce reliance on a single service.
Calculations in code
Totals and other business calculations are done in application code rather than by the AI model.
Limited context
We aim to send only the context a model needs to complete the task.
PLATFORM ARCHITECTURE

Five layers, one platform.

Interfaces
Web apps, APIs, and integrations your teams use. Traffic is sent over HTTPS using TLS 1.2 or higher.
Workflow layer
Product-specific automation for estimating, RFQs, project execution, and quality checks. Business logic runs per workspace.
Intelligence layer
AI models, retrieval, and extraction, chosen per task. Customer content is sent to providers only to generate your outputs.
Platform layer
Shared identity, permissions, audit, and data governance. Row Level Security is applied at the database.
Cloud infrastructure
Vercel for the application layer. Supabase on AWS us-east-1 for database, authentication, and file storage.
COMPLIANCE STATUS

Where we stand today.

Multi-tenant architecture
Each workspace is separated using Row Level Security at the database level.
SOC 2 status
We are not currently SOC 2 certified. Our controls are designed with the SOC 2 Trust Services Criteria in mind, and we have not yet completed a formal audit.
Privacy practices
We follow privacy principles in line with GDPR and support data access and deletion requests. This is not a legal certification.
Availability
We aim for high availability using Vercel and Supabase. This is a target, not a guarantee. Custom service terms can be discussed for Enterprise plans.
PROCUREMENT QUESTIONS

What buyers ask us before signing.

Where is my data stored?
The application runs on Vercel. Database and file storage run on Supabase, hosted in the United States (AWS us-east-1). Enterprise customers can ask about other regions.
Who can access my data?
Members of your workspace, based on their assigned role. Our team accesses customer data only when needed to provide support or keep the service running, and with your authorization for support sessions.
Do you use my data to train AI models?
No. We do not use customer data to train AI models. Content is sent to AI providers only to generate your outputs, under API terms that do not permit training on it. Retention follows each provider’s published policy.
What happens if I delete my account?
You can request deletion at any time. We delete workspace data and files within 30 days of a verified request, except where we must keep information for legal or regulatory reasons. Backups are removed on their normal cycle.
Do you support SSO and SAML?
SSO using SAML 2.0 is available for Enterprise customers on request. Contact us to discuss your identity provider.
What is your incident response process?
We maintain an incident response process. If a security incident affects your data, we will notify affected customers without undue delay and as required by applicable law.
Do you support data processing agreements (DPAs)?
Yes. Enterprise customers can request a DPA. It covers data processing, sub-processors, security obligations, and international transfers.
How do you handle regulatory compliance?
We are not currently certified under SOC 2 or any similar framework. Our practices are designed with SOC 2 and GDPR principles in mind. We can answer a security questionnaire from your procurement team on request.

This page describes our current practices and may change as the product evolves. It is for information only and is not a contract or warranty. Binding security and data commitments are set out in your agreement with Synlumex AI.

Found a security issue?
Please report it to us directly and give us reasonable time to fix it before sharing it publicly. We aim to review every report.
security@synlumexai.com

Need a security questionnaire?

Procurement, legal, and IT teams can talk to us. We can walk you through our architecture, discuss a DPA, and respond to your security questionnaire on request.

Talk to us Email security team
WhatsApp usEmail us