Privacy

Roles

Syncanix operates as a data processor for the customer-content data flowing through the product (chat conversations, document content, retrieval embeddings, tool-call payloads) and as a data controller for dashboard account data (operator email, role, MFA status, audit logs of operator actions). The split is reflected in the DPA and in the per-data-type retention table below.

Privacy by design defaults

• EU data residency for everything stored, and for default AI inference. Production runs in the EU (Frankfurt), and all stored customer data stays there unless you explicitly choose another region. Default AI inference runs in the EU as well — Claude on Amazon Bedrock — so a normal conversation is processed end to end in-region. See “No training on your data” below.
• No training of foundation models on customer data. We never train AI models on your data. Default inference runs on Claude via Amazon Bedrock in the EU (eu-central-1), under the AWS data-processing terms — your content is not retained and not used for training. If we ever fail over to a provider outside the EU (Anthropic or OpenAI), their API terms already exclude API traffic from training, and we are finalizing Zero Data Retention (ZDR) agreements with both. Retrieval embeddings and reranking also run on Amazon Bedrock in the EU.
• Defaults tuned for minimisation. 30-day default retention on chat content; opt-in (not opt-out) for cross-customer analytics; opt-out by default for A/B prompt testing on a per-customer basis.

Retention (per tier)

Retention defaults apply automatically per tier. Customers can request shorter retention at any time (dashboard self-serve retention controls are on the roadmap); Enterprise customers can extend retention to support legal-hold or regulatory obligations.

GDPR rights

Every GDPR right is honoured end-to-end, with specific implementations per Article:

• Article 15 (Access). End users can view their conversation history in the chat widget. Admin requests for a single user's full history run through the documented DSAR intake process, with machine-readable JSON export delivered within the 30-day SLA.
• Article 16 (Rectification). Rectification requests are fulfilled through the documented DSAR intake process, within the same response windows.
• Article 17 (Erasure). Erasure removes your conversation messages, insights, handoffs, conversation-ownership records, and feedback, delivered within the 30-day SLA.
• Article 20 (Portability). Export delivered as machine-readable JSON for portability to another vendor; human-readable copies are available on request.
• Article 22 (Automated decisioning). Syncanix stays out by design — no solely-automated decisions with legal or significant effect. Every high-impact tool call has a human-in-the-loop toggle and step-up authentication gates.
• Article 25 (Privacy by design). Defaults: 30-day retention, EU residency for all stored data, no training on customer data.
• Article 32 (Security). AES-256 at rest; TLS 1.3 in transit; least-privilege access; SOC 2 Type I targeted for Q3 2026, with evidence collection beginning in the first months post-launch.
• Article 33 / 34 (Breach notification). Customers are notified within 24 hours of confirmation of a personal-data breach. End-user notification obligations remain with the customer (controller).

PII handling

PII is treated as load-bearing data. Syncanix handles it at three points — catalog fields at discovery, the assistant’s replies before delivery, and transcripts in the operator review view:

• Field-level (catalog). At discovery, the enrichment LLM flags fields likely to contain PII (email, phone, SSN, credit card, IP). Operators confirm or reject. The renderer redacts based on the viewer’s pii:read scope.
• Free-text (chat messages). Chat messages are stored as the end user wrote them — Syncanix does not silently rewrite their words — encrypted at rest and tenant-scoped. The assistant’s replies pass a secrets scan, so credentials it might echo ([api-key], [token]) are stripped before they reach the screen. Keeping special-category data out of the chat is the customer’s (controller’s) responsibility under the DPA.
• Storage layer. Free-text is retained encrypted at rest (AES-256 / KMS), tenant-scoped, and purged on your plan’s retention window — it is not redacted before storage. When an operator opens a transcript, detected identifiers are masked ([email], [phone]) and the access is written to the audit log.

Source-code privacy

Syncanix’s customer-side discovery CLI runs in the customer’s own environment. Only structured catalog metadata leaves the customer’s network — source files never upload. Per-endpoint handler text (≤2 KB) sent to Anthropic is processed and discarded; under Anthropic’s API terms this traffic is excluded from training, and a Zero Data Retention (ZDR) agreement is being finalized.

Syncanix never indexes source code server-side. Discovery is event-driven and stateless; the customer’s repository content stays in the customer’s repository.

BYOK (bring-your-own-key). Customers on any plan can supply their own Anthropic, OpenAI, or Bedrock keys; the LLM provider never sees Syncanix as an intermediary. .syncanixignore excludes paths from discovery by default ( (*.env, secrets/**, fixtures/**, __tests__/**, vendored/**, node_modules/**).

US privacy laws

The product is implemented to a GDPR + CCPA superset that maps to the 19+ state-level privacy laws in force (CA CCPA / CPRA, VA VCDPA, CO CPA, CT CTDPA, UT UCPA, TX TDPSA, FL FDBR, OR OCPA, MT MCDPA, IA ICDPA, TN TIPA, IN ICDPA, DE DPDPA, NH SB 255, NJ SB 332, MN MCDPA, MD MODPA). Syncanix does not sell or share personal information as those terms are defined by the CCPA / CPRA; California residents can exercise their rights to opt out, access, correct, or delete through the data subject request form →. CPPA ADMT rules (effective 1 Jan 2026) are handled by the same Article 22 posture above.

MENA and Israel

UAE Federal Decree-Law 45/2021 (PDPL) + DIFC + ADGM; KSA PDPL (full enforcement since 14 Sep 2024) with 72-hour breach notice to SDAIA and local-representative provisioning when revenue thresholds trigger; Israel Privacy Protection Law + Amendment 13 (effective 15 Aug 2025) with mandatory Privacy Protection Officer + fines up to 5% turnover; Egypt Law 151/2020; Qatar Law 13/2016; Bahrain PDPL 30/2018; Oman Royal Decree 6/2022; Jordan PDPL 24/2023. Data residency in a Saudi region (Riyadh) lights up when a paying KSA customer requires it.

Multi-tenant isolation

Tenant boundaries are enforced at every layer: application-level scoping on every query, database row-level security as defence-in-depth, and per-tenant access scoping on the LLM and storage paths. Nightly synthetic probes exercise the boundaries — Synthetic User A in tenant A asks for User B’s data; expected outcome is refusal; any failure triggers a critical alert and deploy pause.

DSAR procedure

Data subject access requests (Articles 15 / 16 / 17 / 20 / 21) are acknowledged within 24 hours and fulfilled within 30 days, in line with GDPR Article 12. The supported request types are access, erasure, portability, rectification, and objection. Use the self-service DSAR form → or email admin@syncanix.com directly — the same SLAs apply either way.

Related

• Subprocessor list → — the entities Syncanix relies on, with per-row purpose + transfer mechanism.
• Security overview → — encryption, IAM, headers, incident response.
• Compliance status → — SOC 2 / ISO 27001 / EU AI Act / GDPR / CCPA status.