Security & Trust
Your customers trust you. Your systems should earn that trust.
How Syncon One protects what your customers tell you, described as it works today, so your security team can check every line.
How your data is protected
Data protection
Your conversations, customer records and files belong to your workspace, and you can take them out or remove them.
- Conversations, people, companies, leads and files are stored against one workspace.
- Records can be exported as CSV by people whose role allows it.
- A person, visitor, conversation or the whole workspace can be deleted on request.
- Every conversation is kept in full, agent and teammates together, so you can see exactly what a customer was told.
How deletion runs
A deletion request names one subject: a person, a visitor, a conversation or the workspace. A background worker carries it out after a 24-hour grace period, so a mistaken request can be withdrawn the same day.
Authentication and permissions
People sign in to their own accounts, can add a second step, and see only what their role allows.
- Two-step sign-in with an authenticator app, with backup codes stored encrypted.
- Sign-in, sign-up and password reset are rate limited for each IP address.
- Five roles in every workspace: Owner, Admin, Manager, Teammate and Viewer.
- Custom roles with field-level permissions on Pro and Enterprise.
- Permissions are checked on the server for every action, never by hiding a button.
Sign-in limits
In production, sign-in is limited to 8 attempts a minute, sign-up to 5 every five minutes and password reset to 3 every five minutes. The counters are kept in the database, so every server instance shares them.
Workspace isolation
Each business is its own workspace, and one workspace cannot read another's conversations or records.
- Every query for workspace data is scoped to the workspace on the server.
- The workspace is taken from the signed-in session, not from anything the browser sends.
- Public API keys belong to one workspace and reach only that workspace's data.
AI data handling
The agent answers from material you give it, records where each answer came from, and sends conversation text to a model provider to write its replies.
- Conversation text and the relevant passages from your material are sent to the AI model provider to produce each reply.
- On Free, and on Enterprise if you choose, the AI runs on your own provider key (OpenAI, Anthropic, Google or Groq), under your own contract with that provider.
- The source of each answer is recorded with it, so anything the agent said can be checked against what you published.
- Questions it could not answer are collected for your team rather than improvised.
- Agent policy sets subjects that always go to a person and things it may never promise.
Encryption
Everything travels over TLS, and the secrets we hold for you are encrypted before they are stored.
- All traffic between visitors, your site, your team and the platform uses HTTPS.
- Browsers are told to use HTTPS only (HSTS, two years, including subdomains).
- Provider keys, calendar and mailbox tokens, channel credentials and webhook secrets are encrypted with AES-256-GCM before they reach the database.
- Public API keys are stored only as a hash; the full key is shown once, when it is created.
What is and is not encrypted by the application
Secrets are encrypted in the application with AES-256-GCM, a fresh random IV for each value, and an authentication tag checked on every read. Conversation text and customer records are protected by access control and transport encryption; we do not describe them as application-level encrypted, because they are not.
Integrations and credentials
Connections use each provider's own sign-in, and what they hand back is stored encrypted.
- Google and Microsoft calendars and mailboxes connect through OAuth; we never see the account password.
- The OAuth state is signed and checked on return, so a connection cannot be completed by someone else's link.
- Outgoing webhooks are signed with HMAC-SHA256 over a timestamp and the body, so receivers can reject forged or replayed deliveries.
Verifying a webhook
Each delivery carries an x-syncon-signature header of the form t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body">. Reject a delivery whose timestamp is more than 300 seconds old or whose signature does not match, compared in constant time.
Data retention and deletion
You choose how long closed conversations and uploads are kept; by default they are kept until you remove them.
- Closed conversations can be removed automatically after 30, 90, 180, 365 or 730 days.
- Uploaded files can be removed on their own schedule, from the same choices.
- Workspace exports are stored for seven days and then removed.
- Deletion requests run after a 24-hour grace period.
Where this is set
Settings → Data in the workspace. A policy is two numbers of days, or nothing, which means keep, and the worker applies it every hour. Anything outside 30 to 3,650 days is clamped into that range.
Infrastructure and hosting
The application and its database run on servers SynconAI operates; files are kept in private object storage.
- The web application, background worker and PostgreSQL database run in containers on servers SynconAI operates.
- The database is backed up daily.
- Uploaded files and exports are stored in private Cloudflare R2 buckets with no public access.
- Email is sent through Resend; payments are taken by Creem, our merchant of record.
- A hosting region cannot be chosen per workspace today.
Auditability and governance
Consequential actions are recorded with who did them and when, and every answer can be traced to its source.
- Changes to connections, channels, knowledge, teammates and conversation ownership are written to an audit record with the person, the time, and the IP address and browser.
- Every handover to a person carries the reason and a brief.
- Changes to the agent are published deliberately rather than edited live in front of visitors.
- A browsable audit log in the workspace is not available today; records can be provided on request.
Operational security
The site and the widget are hardened against the common web attacks, and input is checked at every boundary.
- A content security policy with a fresh nonce on every request.
- Pages cannot be framed by other sites, and browsers are told not to guess content types.
- The website widget renders inside a shadow root, so it cannot read or restyle your page.
- Everything that arrives from outside, from forms to the public API, is validated before it is used.
Plainly
What we do not offer today.
A review is quicker when the gaps are on the page. If yours needs one of these, tell us and we will give you a straight answer.
- Single sign-on (SAML or OIDC)
- SCIM user provisioning
- A browsable audit log in the workspace
- A choice of hosting region
- SOC 2, ISO 27001 or other third-party certification of Syncon One
- A contractual uptime commitment
Policies and people
Read the policies, or ask us.
The legal terms are SynconAI's, the company that builds and runs Syncon One.
Services we rely on
- OpenAI
- Writes the agent's replies, unless you bring your own provider key.
- Cloudflare R2
- Stores uploaded files and exports, in private buckets.
- Resend
- Sends the platform's email.
- Creem
- Takes payment, as merchant of record.
Their certifications are their own and do not extend to Syncon One.