Security Policy

This Security Policy describes how Syntro Inc. (“Syntro,” “we,” “our,” or “us”) protects the confidentiality, integrity, and availability of customer data. Syntro handles sensitive procurement data — including purchase orders, supplier contracts, quotes, and pricing — on behalf of hardware teams. This policy applies to all Syntro systems, personnel, and sub-processors that access or process that data.

Questions about this policy may be directed to security@usesyntro.com.

1. Governance

Syntro's information security program is owned at the executive level by the Chief Operating Officer (COO), who serves as its policy owner, while the Chief Technology Officer (CTO) manages technical security operations. The program is reviewed at least annually. Our program is built on four foundational principles:

• Least privilege. Access to systems and data is granted only to personnel with a legitimate business need, at the minimum level required to perform their function.
• Defense in depth. Security controls are layered. No single control is treated as a sole means of protection.
• Consistency. Controls are applied uniformly across all systems and environments.
• Continuous improvement. We continuously improve the effectiveness, auditability, and usability of our controls.

1.1 Compliance Status

Syntro is SOC 2 Type II certified. If your organization requires specific certifications or additional documentation, please contact us at security@usesyntro.com.

2. Infrastructure and Data Protection

2.1 Cloud Infrastructure

Syntro's application and data infrastructure is hosted on Supabase, a managed cloud platform built on top of major U.S.-based cloud providers. All production environments are managed and monitored by Syntro's engineering team.

2.2 Encryption at Rest

All customer data, including structured procurement data extracted from emails (e.g., supplier names, PO numbers, pricing, delivery dates), is stored in Supabase-managed PostgreSQL databases encrypted at rest using AES-256.

2.3 Encryption in Transit

All data transmitted between customer systems and Syntro — including API calls, webhook payloads, and browser sessions — is encrypted using TLS 1.2 or higher. This applies to all connections, including integrations with Google Workspace and Microsoft 365.

2.4 Data Minimization and Retention

Syntro requests only the minimum permissions necessary to provide the Service. Raw email content is not retained beyond what is required for processing. Structured data extracted from emails is stored only as needed to support procurement workflows and reporting.

Upon termination of a customer agreement, customer data is available for export for a minimum of sixty (60) days, after which it is deleted from Syntro's systems except as required by law or standard backup retention policies.

2.5 Tenant Isolation

Each customer operates within a logically isolated environment. Customer data is never commingled with or accessible by another organization's account.

3. Access Controls

3.1 Multi-Factor Authentication

Multi-factor authentication (MFA) is enforced for all Syntro employees and contractors across all internal systems, including systems that access production environments and customer data.

3.2 Least Privilege Access

Access to production systems and customer data is restricted to personnel with a demonstrated business need. Permissions are granted at the minimum level required and are reviewed periodically.

3.3 Audit Logging

All access to customer data by Syntro personnel is logged. Logs are retained and reviewed as part of our compliance program.

3.4 Access Revocation

Access to internal systems and production environments is revoked within three (3) days of an employee's departure or role change, in accordance with company SLA guidelines.

3.5 Customer-Controlled Access

Authentication for email integrations is handled via Google OAuth 2.0 and Microsoft OAuth 2.0 (via Azure Active Directory). Customers may revoke Syntro's access at any time directly from their Google or Microsoft account security settings. Syntro does not send or modify emails on a user's behalf except where explicitly triggered by the user within the product.

4. AI and Third-Party LLM Usage

4.1 Providers

Syntro uses large language models (LLMs) for document parsing and structured data extraction. Our current LLM providers are OpenAI and Anthropic, both U.S.-based. Data processed by these providers does not leave U.S. infrastructure.

4.2 No Training on Customer Data

Syntro will not use customer data to train, fine-tune, develop, or improve any artificial intelligence or machine learning model, except in aggregated and de-identified form that cannot reasonably be associated with or used to identify a customer. Our LLM provider accounts are configured with data training disabled.

4.3 Data in Transit to LLMs

All data submitted to LLM providers is encrypted in transit via TLS. Only the minimum data required for a given extraction task is included in any prompt or request.

4.4 Sub-processors

A current list of Syntro's sub-processors, including LLM providers, infrastructure vendors, and error-monitoring and product-analytics providers, is available to customers upon written request to security@usesyntro.com. All sub-processors are subject to data protection obligations no less protective than those Syntro applies. As set out in our Data Processing Addendum, we give customers advance written notice before engaging a new sub-processor that will process personal data, with an opportunity to object.

4.5 Product Analytics

Syntro uses a product analytics provider, hosted in the United States, to understand how buyers move through the procurement workflow. It is deliberately constrained: no session recording, no automatic click or keystroke capture, no cookies or browser storage, and IP addresses discarded on receipt. Only a reviewed list of workflow events is transmitted, carrying counts and status values — never supplier names, prices, part numbers, quote contents, or message text. Web addresses are reduced to a generic page pattern before transmission so record identifiers and shared-link tokens are never included. Customers may request that it be disabled for their organisation.

5. Product Security

5.1 Penetration Testing

Syntro engages a third-party security firm for penetration testing at least annually. All areas of the Syntro application and infrastructure are in scope. Findings are tracked and remediated according to severity. Summary results are available to customers upon written request.

5.2 Vulnerability and Dependency Scanning

Syntro uses automated tooling to continuously monitor software dependencies for known vulnerabilities (CVEs). Alerts are triaged and patched according to severity: Critical and High-severity vulnerabilities are remediated within thirty (30) days, Medium-severity within sixty (60) days, and Low-severity within ninety (90) days.

5.3 Secure Development Lifecycle

Security review is a standard part of Syntro's code review process. Engineers are trained on secure coding practices and common vulnerability classes. Security considerations are addressed throughout the development lifecycle, not only at release.

6. Incident Response and Breach Notification

6.1 Incident Response Plan

Syntro maintains a formal, documented Incident Response Plan owned by the Chief Technology Officer. The plan covers detection, triage, containment, eradication, recovery, and post-mortem analysis. It is reviewed and formally tested at least annually.

6.2 Severity Classification

Security incidents are classified into four severity tiers:

• P0 – Critical. Active exploitation or threat of physical harm. Requires immediate notification to the CTO and executive management.
• P1 – High. Active exploitation likely or adversarial persistence suspected. Requires immediate escalation and documented response.
• P2/P3 – Medium/Low. Suspicious activity or unverified events requiring investigation. Tracked and assigned for response.

6.3 Breach Notification

In the event of a confirmed security incident involving unauthorized access to, acquisition of, or disclosure of customer data, Syntro will notify affected customers without undue delay and in any event within seventy-two (72) hours of confirmation, in alignment with our internal Incident Response Plan. Notifications will describe, to the extent then known: the nature and scope of the incident, the categories of data affected, steps being taken to contain and remediate, and a point of contact for further information.

Breach determinations are made by the COO in coordination with legal counsel. No external disclosure regarding an incident may be made without approval from legal and executive management.

6.4 Root Cause Analysis

All P0 and P1 incidents require a formal root cause analysis (RCA). Findings are documented, reviewed by the CTO, and used to drive long-term improvements to controls and detection capabilities.

7. Privacy

Syntro's approach to data privacy is governed by our Privacy Policy at usesyntro.com/privacy. Key commitments include:

• We do not sell personal information.
• California residents have rights under the CCPA to access, delete, and opt out of the sale of their personal information.
• Customer data is processed only as directed by the customer, under the terms of our agreement.
• Data subject access, correction, and deletion requests may be submitted to security@usesyntro.com.

8. Contact

Security and compliance inquiries, including requests for penetration test summaries, sub-processor lists, or additional documentation, may be directed to:

Syntro Inc.
Attn: Security
28 Geary St, Suite 650 #317
San Francisco, CA 94108
security@usesyntro.com