Security summary.

Encryption

• All traffic to the service is HTTPS, TLS 1.2 or 1.3 only; plain HTTP redirects to HTTPS and browsers are told to insist on it (HSTS, two years).
• Storage volumes, database files and backups are encrypted at rest with AES-256 (AWS-managed keys).
• Conversation text, case details, customer records, contact details and their change history are also encrypted field by field in the database with AES-256-GCM, so a copy of the database alone does not reveal them.
• Secrets and keys are held in AWS Systems Manager Parameter Store, never in source code.

Access to your data

• Every organisation's data is separated by an organisation identifier on every query. Automated tests try to read one organisation's records from another's session on every change, and fail the build if they can.
• Every endpoint must declare who may call it; a test walks the whole application and fails the build if one does not.
• Staff sign-in uses salted bcrypt password hashes, multi-factor authentication with an authenticator app, and account lockout after repeated failures. Organisations can require multi-factor authentication for all their staff and agents; it is always required for our own administrators.
• Agent desktops can sign in through your own identity provider, so your joiners and leavers process applies.
• You decide which customer details agents and suppliers see: each item in your data dictionary is marked visible to agents or not, and editable by them or not. Fields that are not visible are never sent to the agent desktop or the supplier portal.
• Sign-in, conversation and upload endpoints are rate limited.
• The chat widget's public key can only start customer conversations. It cannot reach staff functions or other customers' records.

Infrastructure

• The application servers accept traffic only from the load balancer; the database accepts connections only from the server itself.
• Administrative access to servers is restricted to named addresses and uses AWS Systems Manager, with instance metadata protected (IMDSv2).
• Responses carry security headers that stop the portals being framed by other sites and stop content-type sniffing.

Backups and recovery

• Daily backups of the whole server, kept for 35 days, plus a nightly database export, all within your hosting region.
• Each backup is encrypted and held in a separate AWS Backup vault.

Retention and deletion

• You set one retention period for your data: conversations, closed cases and session records. Until you set one, it is kept. A daily job deletes what has passed the period.
• Your client portal administrators can find everything held about a person by email, phone or reference, export it, or erase it. Agents on the agent desktop cannot, and every export and erasure is logged with who carried it out.
• When a contract ends, all of your organisation's data is permanently deleted from the live service, and backups containing it expire within 35 days.
• Optional redaction removes email addresses, phone and card numbers, names and addresses from stored conversations.

Development and operations

• Every change runs an automated regression suite of more than 1,200 tests, including the access-control and organisation-separation tests above, before it can be merged.
• Dependencies are checked for known vulnerabilities weekly.
• Logs record events, not personal data: no email addresses, passwords, session tokens or message content.
• Personal data is accessed by our staff only to provide support you have asked for, or to keep the service secure.

If something goes wrong

We tell you within 48 hours of becoming aware of a personal data breach affecting your data, with what we know and what we are doing, so you can meet your own duties to the ICO and the people affected. The data processing agreement sets this out.

Reporting a vulnerability

If you think you have found a security problem in Syntalyze, email hello@mg12.design with "Security" in the subject. We will reply within two working days. Please give us a reasonable chance to fix it before telling anyone else.

Hosting and sub-processors are on Where data is hosted. For a security questionnaire, email hello@mg12.design.