Skip to main content
Syntropy AI Global
Security & Trust Center

Defense-in-depth security controls built into every architectural layer.

We engineer Syntropy AI Global to protect multi-store retail operations, payment processor boundaries, and enterprise CRM records with verifiable technical controls.

Syntropy AI Global does not currently claim SOC 2, PCI DSS, or ISO/IEC 27001 certification. The compliance section below describes the controls we operate today and the frameworks on our roadmap — not third-party attestations.
Section 01

Infrastructure & Hosting

Syntropy AI Global cloud services run on enterprise cloud infrastructure engineered for high availability, network isolation, and multi-tenant data separation.

  • Hosted in tier-1 cloud data centers with logically isolated Virtual Private Clouds (VPCs); hosting regions are confirmed per customer agreement.
  • Production databases and application compute nodes run in private subnets inaccessible from the public internet, fronted by Web Application Firewalls (WAF) and DDoS mitigation.
  • Strict separation between development, staging, and production environments; production customer data is never used in non-production test environments.
  • Strict logical tenant isolation enforced at both the API authentication middleware layer and database row/schema scope.
Section 02

Encryption (In Transit & At Rest)

All customer data, inventory ledgers, and API payloads are encrypted both over the wire and on disk across cloud and local edge devices.

Encryption in Transit (TLS 1.2 / TLS 1.3)

  • All HTTP, webhook, and WebSocket traffic between web browsers, iOS/Android apps, Windows/macOS POS terminals, and Syntropy APIs is encrypted using TLS 1.2 / TLS 1.3 with modern cipher suites.
  • Strict HSTS (HTTP Strict Transport Security) headers enforced across all application domains.

Encryption at Rest (AES-256 Cloud & Edge)

  • Primary relational databases, read replicas, object storage buckets, and automated backups are encrypted at rest using AES-256.
  • Local offline POS databases and handheld barcode shift caches on Windows, macOS, iOS, and Android devices are encrypted at rest using OS-keychain-backed AES-256 encryption.
  • Cryptographic keys, webhook signing secrets, and third-party OAuth tokens are managed via dedicated Key Management Service (KMS) vaults with automatic rotation.
Section 03

Identity, Access Control & Audit Logging

Granular permission boundaries ensure store cashiers, regional managers, sales reps, and corporate administrators only access the minimum data required for their role.

  • Role-Based Access Control (RBAC) scoped by Organization → Region → Store Location → Register / Pipeline.
  • Support for Multi-Factor Authentication (MFA) and Enterprise Single Sign-On (SAML 2.0 / OIDC with Okta, Microsoft Entra ID, and Google Workspace).
  • Immutable, append-only audit logs record pack activations, shift scans, POS overrides, CRM exports, and permission changes with actor ID, IP, and timestamp.
  • Internal Syntropy engineering access follows strict least-privilege IAM, zero standing production database access, and mandatory hardware MFA.
Section 04

Backups & Disaster Recovery

Resilient backup schedules and offline-first client architecture protect store continuity even during regional network or cloud disruptions.

  • Automated daily encrypted database snapshots with continuous write-ahead log archiving enabling Point-in-Time Recovery (PITR).
  • Backups are replicated across geographically separate availability zones and tested regularly via automated restoration drills.
  • Recovery Point Objective (RPO) and Recovery Time Objective (RTO) targets are documented per service tier and defined in each customer agreement.
  • Resilience: Store-facing systems are designed to recover cleanly from network interruptions and resynchronise once connectivity returns.
Section 05

Incident Response Management

Our engineering and security teams maintain a documented incident response runbook covering detection, triage, containment, eradication, and customer communication.

1. Detection & Alerting

Automated anomaly monitoring, WAF alerts, and infrastructure health checks page our on-call systems engineering rotation 24/7.

2. Triage & Containment

Incidents are classified by severity (SEV-1 to SEV-3). Affected credentials, tokens, or network routes are isolated immediately to prevent lateral impact.

3. Customer Notification

In the event of a confirmed personal data or security breach affecting Customer Data, we notify impacted customers without undue delay in accordance with our Data Processing Agreement (DPA) and applicable law.

4. Post-Incident Root Cause Analysis (RCA)

We publish a transparent post-mortem detailing timeline, root cause, and preventative engineering remediations.

Section 06

Compliance Alignment & Roadmap

Syntropy AI Global does not claim formal third-party certifications until independent audits are complete. The items below describe our current controls and the frameworks we are aligning to:

Roadmap · No attestation claimed

SOC 2 (AICPA Trust Services Criteria)

Security, availability, and confidentiality controls designed with reference to the AICPA Trust Services Criteria. No SOC 2 report is claimed until a formal CPA attestation is issued.

Processor tokenization · P2PE terminals

Payment Security & Certified Processor Boundary

Syntropy POS processes card payments via certified payment processors and hardware pin pads so raw cardholder data (PAN/CVV) never enters Syntropy cloud storage.

Future roadmap · ISMS alignment

ISO/IEC 27001

Information Security Management System (ISMS) policies, asset registers, and risk treatment workflows modeled for future certification.

DPA, Sub-processor List & Opt-Out Controls Active

GDPR / UK GDPR / CCPA Privacy Readiness

Includes our standard Data Processing Agreement (DPA), granular cookie consent gating, and data subject access/deletion workflows.

07. Vendor & Sub-processor Transparency

Authorized Sub-processors & DPA

We maintain a transparent directory of third-party infrastructure, database, and communication sub-processors, along with our standard Data Processing Agreement (DPA).

View Sub-processors ListView DPA Summary
08. Responsible Disclosure

How to Report a Security Vulnerability

If you discover a potential security issue in any Syntropy AI Global service, please report it directly to our security team at security@syntropyaiglobal.com with reproduction steps and affected endpoints.

Email security@syntropyaiglobal.comResponsible Disclosure Policy