Trust, Privacy & Security Commitments.
Last updated: October 2026 · Everything you need to know about customer data ownership, our Zero-Training commitment, and compliance terms.
Master Terms of Service
Effective Date: October 1, 2026 · Version 3.4
1. Subscription & Authorized Access
By subscribing to Synthora Technologies, Inc. ("Synthora", "we", "us"), Customer ("you", "Company") agrees to these Terms. Synthora grants Company a non-exclusive, worldwide right to configure, deploy, and execute autonomous AI playbooks and connectors subject to the terms of your agreed Order Form.
2. Customer Data Ownership & Zero-Training Guarantee
Customer exclusively owns all right, title, and interest in and to all data, records, invoices, customer messages, ERP credentials, and transaction histories ingested or produced through the Service ("Customer Data").
Strict Zero-Training Commitment
Synthora shall NEVER use Customer Data or prompts to train, fine-tune, or calibrate public or proprietary foundational artificial intelligence models. Your corporate data remains strictly isolated within your tenant.
3. Service Level Agreement (SLA) & Uptime
Synthora guarantees an annual Service availability uptime of 99.95% for Growth tier customers and 99.99% for Enterprise tier customers, excluding scheduled maintenance communicated at least 72 hours in advance. Failure to meet these commitments triggers prorated service credits in accordance with our Enterprise SLA Schedule.
4. Point-in-Time Rollback & Liability
Synthora provides compensating reverse API transactions ("Rollback Engine") to facilitate state restoration. While Synthora uses commercial best efforts to maintain idempotent reverse scripts across third-party APIs (NetSuite, Salesforce, Stripe), Customer retains ultimate administrative responsibility for establishing approval threshold parameters suitable for their regulatory obligations.
Global Privacy Policy
Compliance: GDPR, CCPA, CPRA, LGPD · Version 2.8
1. Information We Collect
We collect personal information necessary to deliver and authenticate the Service:
- Account Identity: Work email, user name, role, and SSO identity attributes provided via Okta or Azure AD.
- Execution Telemetry: Timestamp, policy evaluation outcomes, human approver signatures, and transaction delta logs.
- Audit Signoffs: Cryptographic record of the approver's Slack or web interaction and IP address.
2. How We Store & Protect Personal Data
All data processed by Synthora is encrypted in transit using Transport Layer Security (TLS 1.3) and encrypted at rest using AES-256 with customer-managed keys (CMK) available on Enterprise tiers. Multi-tenant database rows are separated via cryptographic tenant IDs enforced at the Postgres engine level.
3. International Data Transfers & Data Residency
Customers may select their primary data residency region upon provisioning: United States (us-east-1, us-west-2), European Union (eu-west-1 Dublin, eu-central-1 Frankfurt), or Asia-Pacific (ap-southeast-1 Singapore). All cross-border transfers comply with standard contractual clauses (SCCs).
Security & Compliance Whitepaper
SOC 2 Type II Certified · ISO/IEC 27001 Aligned
1. Independent Auditing & SOC 2 Type II
Synthora undergoes an annual SOC 2 Type II examination conducted by an independent AICPA-accredited CPA firm. The audit attests to the operational effectiveness of our Security, Availability, and Confidentiality controls across a continuous 12-month observation window.
2. Key Management & Credential Vault
Third-party OAuth tokens (e.g. NetSuite SuiteTalk credentials, Salesforce Bearer tokens) are never stored in plaintext. They are sealed using envelope encryption powered by AWS Key Management Service (KMS) with automated 90-day key rotation.
3. Vulnerability Disclosure & Bug Bounty
We run a private vulnerability bounty program and engage external CREST-certified penetration testers biannually. To report a potential vulnerability, please email our security triage desk at security@synthora.ai with PGP encryption.
Data Processing Addendum (DPA)
Incorporating European Commission Standard Contractual Clauses (SCCs)
1. Scope & Processing Roles
This DPA governs the processing of Personal Data in connection with Customer's use of the Synthora Platform. In this context, Customer acts as the Data Controller and Synthora acts as the Data Processor under the EU General Data Protection Regulation (Regulation 2016/679).
2. Authorized Subprocessors
Synthora maintains a strict, vetted list of infrastructure subprocessors (e.g. Amazon Web Services, Cloudflare, Datadog). Customers are notified at least 30 days prior to the engagement of any new subprocessor with the right to object on reasonable data protection grounds.
3. Data Subject Rights & Erasure
Synthora provides automated APIs and console controls enabling Customers to fulfill data subject requests (access, rectification, portability, and erasure / "Right to be Forgotten") within 24 hours.
Security you can verify. Controls you can trust.
Need our security packet or a custom enterprise agreement? We respond within 2 hours.