Information Security Policy

Synclarion ("we", "us") takes the security of your data seriously. This policy describes how we protect the confidentiality, integrity, and availability of customer data on the platform, and where we are honest about our current limits as an early-stage product. It complements our Privacy Policy and Terms of Service.

1. Data we protect

The platform handles transaction data (parties, deadlines, notes, documents), contact and CRM records, Claire conversations, the sign-in tokens for your connected Google account, and the usage telemetry needed to keep the product running. All of it is treated as confidential and remains owned by you.

2. Encryption

All connections to Synclarion are TLS 1.2 or higher — the entire site, every API endpoint, every page. Data at rest is encrypted by Supabase using AES-256, including database backups. Passwords are never stored in plaintext; authentication is delegated to Supabase Auth, which uses bcrypt.

3. Access controls and data isolation

Every table is protected so you only see your own data and what your team role allows. General reference information, like standard form lists, is shared by everyone. We look at account data only when we need to: to help when you ask, to fix a problem, or to keep Synclarion secure. We never browse it or sell it.

Your Google sign-in tokens are encrypted before they are saved, with a key kept outside the database, in a table only your account can read. Disconnecting Google withdraws Synclarion's access at Google and deletes the stored tokens.

You're signed out after 14 days without using Synclarion. After repeated wrong passwords, sign-in pauses before it accepts another try, and reset emails and authenticator codes are limited the same way.

4. Third-party integrations

When you connect Google, Synclarion asks for access to your Gmail and your Google Calendar, and to Google Drive only for the folders and files Synclarion itself creates. You can see and remove this access in your Google account at any time.

We use established providers and list every one in our Privacy Policy, under "Third-party services." When we add or change one, we update that list.

5. Incident response

If we learn of a security incident that affects your data, we'll email you as soon as possible, and no later than 72 hours after we confirm it, with what happened and what we're doing about it.

6. Vulnerability management

Every change is type-checked and built automatically before it goes live, and our automated test suite runs on every update. We rely on established frameworks (Next.js, TypeScript, Supabase) rather than custom security code.

7. Backups and continuity

The database is backed up daily, and backups are kept for 7 days. Documents and pictures you upload are copied every hour to a separate backup with Cloudflare. A deleted or replaced file can be recovered for at least 4 days, and is gone from the backup within 7.

8. Data retention and deletion

We keep your account data while your account is open. To delete your account and data, go to Account → Security → Delete my account. Your account is locked right away and deleted 7 days later; you can cancel until then. Backups are kept for 7 days, after which deleted data is gone from them too. Full retention details are in the Privacy Policy under "Data retention."

9. Where we're honest about our limits

Synclarion is in private beta. We do not have a SOC 2 audit yet; that is on the roadmap and will be completed before we serve enterprise customers. We do not yet offer custom data residency, signed BAAs, or contractual SLAs — those are roadmap items as well. If your organization needs any of these today, talk to us about timing.

10. Your role

You are responsible for safeguarding your account credentials, reviewing the permissions you grant to integrated services, notifying us of suspected unauthorized access, and complying with applicable laws when using Synclarion to process data about your own clients (including real-estate licensing rules and fair-housing laws).

11. Changes

If we make a meaningful change to how we handle your data, we'll email you before it takes effect and update the date at the top of this page.

12. Contact

Security questions, concerns, or incident reports: security@synclarion.ai