Back to SynthAI

    Security

    How we protect your data and what to do if you find a vulnerability.

    Encryption everywhere

    All data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Connections to our database require SSL.

    Row-level security

    Our PostgreSQL database enforces row-level security (RLS) policies — every query is scoped to the authenticated user's data only. No cross-tenant data leakage is possible at the database layer.

    Hosted on Supabase (AWS us-west-1)

    All user data is stored in the United States on Supabase's managed infrastructure running on AWS. We do not self-host the database.

    Least-privilege access

    Internal team members access production data only when required for support, using time-limited service accounts. No broad admin access in day-to-day operations.

    Responsible disclosure

    If you discover a security vulnerability, please report it to team@getsynthai.com with "Security" in the subject. We aim to acknowledge reports within 48 hours and resolve critical issues within 7 days.

    Authentication

    User authentication is handled by Supabase Auth (built on GoTrue). Passwords are hashed with bcrypt and never stored in plaintext. We support email/password, Google OAuth, and LinkedIn OAuth. Magic link login is available for passwordless access.

    Payment security

    We never store credit card numbers. All payments are processed by Stripe, a PCI DSS Level 1 certified payment processor. We store only a Stripe customer ID and subscription status.

    AI data handling

    Prompts and responses are sent to Anthropic's Claude API over HTTPS. We do not share your business data across user accounts. Anthropic's API data handling policy governs how your prompts are processed — by default, Anthropic does not use API inputs to train its models.

    Incident response

    In the event of a data breach affecting personal data, we will notify affected users within 72 hours of discovery, as required under GDPR Article 33. Notifications will be sent to the email address on your account.

    Report a vulnerability

    Email team@getsynthai.com with subject line "Security Disclosure". Please include a description of the issue, steps to reproduce, and your contact details. We do not currently offer a bug bounty program but will acknowledge your responsible disclosure publicly if you wish.