Security

Every record in Synapta belongs to an organization. Agents, knowledge sources, embeddings, conversations and business records are all scoped to a single tenant, and that scope is enforced at the data access layer rather than being left to individual queries to remember.

Permissions are also evaluated per organization, so a person who belongs to two workspaces holds the rights of each one separately.

Access is role-based: Owner, Admin and Member, each with a distinct permission set. Sensitive operations — managing members, deleting an organization — are permission-checked on the server, not merely hidden in the interface.

An organization must always retain at least one Owner, which prevents a workspace from being orphaned.

The widget is the only part of the platform an anonymous visitor can reach. It is addressed by a per-agent UUID that grants nothing except the ability to converse with that one agent, and only while the agent is Active. Public endpoints are rate limited per IP.

A draft agent is not reachable publicly even if its widget is already embedded.

All traffic is served over TLS. Passwords are stored as salted hashes and are never recoverable. API access uses bearer tokens that you can revoke by signing out.

Agent actions that reach external systems can be configured to require human approval, so a model is never the last checkpoint before a consequential change.

Answers are grounded in your own knowledge base, which narrows — but does not eliminate — the risk of a confidently wrong answer. Treat agent output as a capable draft rather than an authority, and put approval gates in front of anything that moves money or changes a record of record.

Your content is not used to train foundation models.

If you believe you have found a security issue, tell us before telling anyone else. Send the details — what you found, how to reproduce it, and what you were able to reach — through the contact form, marking it as a security report.

We will acknowledge within three working days and keep you updated until it is resolved. We will not pursue action against researchers who report in good faith, stay within their own test workspace, avoid accessing other customers' data, and give us reasonable time to fix the issue.

We do not currently hold SOC 2, ISO 27001 or equivalent third-party certification, and we would rather say so plainly than imply otherwise. If your procurement process requires formal attestation, talk to us about what your timeline needs — we will tell you honestly whether we can meet it.