Security

This page describes how Syniq is built and operated today. It isn't a compliance certification — we're an early-access product — but everything below reflects the actual system, not aspirational claims.

Authentication & access

• Accounts are managed by Supabase Auth. Passwords are never stored or handled by Syniq's own servers.
• Every API request is authenticated with a bearer token, verified server-side on each call.
• Signup is currently invite-code gated while we're in private beta.
• Admin functionality (knowledge base management) is restricted to a single allow-listed account.

Data isolation

• Row-Level Security is enabled on our database, so a user can only ever query their own conversations, messages, and feedback — enforced by the database, not just application code.
• The one exception is our backend's internal service role, which needs broader access to do things like save a message on your behalf. That key never leaves our servers.
• Each conversation gets its own isolated vector store for any files you upload. It's deleted the moment you delete the conversation.

Connecting your own equipment

The Syniq site agent (used to stream PLC tag data into Syniq) is designed so nothing ever opens a port on your network:

• The agent only makes outbound HTTPS requests from inside your network to Syniq — it never listens for inbound connections.
• Site tokens are hashed before storage (SHA-256) — Syniq itself can't recover a token you've lost, only reissue a new one.
• Tokens can be revoked or rotated at any time from your dashboard, and revocation is enforced immediately on the next reading the agent tries to send.
• Every ingest request is rate-limited per token, independent of your normal chat usage limits.

Transport & infrastructure

• All traffic between your browser, the Syniq backend, and our infrastructure providers is encrypted in transit (HTTPS/TLS).
• The application is hosted on Vercel (frontend) and Railway (backend), with Supabase providing our database and authentication.
• Payment processing is handled entirely by Stripe — Syniq never sees or stores your card details.

What we send to language models

Your questions and any documents you upload are sent to our LLM providers to generate a response. We don't use conversation content to train third-party foundation models, and we choose providers that offer the same commitment on their end for API traffic.

Reporting a vulnerability

If you believe you've found a security issue, email hello@syniq.cowith details. We don't yet have a formal bug bounty program, but we take reports seriously and will respond directly.