Deutsche Version → ← To the SYNTON website

Security & Privacy

Last checked: October 2026

This page lists only statements we have actually verified as of the date given, with a check date and, where possible, a traceable method. What we have not verified is not claimed here.

Our core principle: SYNTON is built without individual performance evaluation and without personal reporting to managers.

Contents

What we have verified
Subprocessors
How we check
What we do not claim
Contact

1. What we have verified

Storage location

The database, authentication, and file storage run on Supabase in the EU region Ireland (eu-west-1). Verified: project configuration, 2026-10-01.

Anonymous access

On 2026-10-01, an anonymous request against the REST interface returned an empty result ([]) for the protected database tables checked. Two explicitly allowlisted tables may return the public app settings and landing-page texts needed before sign-in. Verified: anonymous REST test, 2026-10-01. New tables must be added to the test coverage.

This test has no fixed schedule. It is repeated after significant database changes. A single passed test is a snapshot, not a standing guarantee.

Minimization before AI processing

In the app's functions, an automatic filter removes email addresses, URLs, and long digit sequences before text is sent to an AI provider. In explanation texts, other people's names are replaced with "Person X". No internal user IDs are transmitted to AI providers. Verified: code review of the filter function, 2026-10-01.

Honestly: this filter does not reliably detect real names written out in free text. We therefore do not say "no personal data is transmitted" — we state the categories the filter actually removes.

2. Subprocessors

These providers process data on our behalf. Details, verification sources and transfer grounds: see Privacy notice, section 5 (English courtesy translation; the German version is binding).

Provider	Purpose	Location
Supabase, Inc.	Database, auth, file storage	EU (Ireland)
Vercel Inc.	Website and app hosting	USA
OpenAI, LLC	Semantic embeddings	USA
Anthropic PBC	Language model (Claude Haiku)	USA
Resend, Inc.	Email delivery	USA
Cloudflare, Inc.	Bot protection (Turnstile)	USA
Google LLC, Apple Inc., Mozilla Corporation	Delivery of encrypted push notifications	USA

3. How we check: the anonymous access test

We don't just claim our database is protected — we test it from the outside, as an anonymous user, with no login at all:

For every table in the database (as of 2026-10-01: 71 tables), a REST request is made without an authentication token.
For protected tables, the expected result is an empty array ([]) or an access error — never a readable row.
For the two tables required before sign-in, only the defined public app settings or landing-page texts are allowed. Any other readable data is an open finding.
Any unexpectedly readable row or column is treated as an open finding and must be fixed before access is opened further.

This test checks a limited part of the actual external effect of the access rules (Row Level Security), not merely whether a rule exists in the code. It does not prove separation between signed-in accounts, rooms or roles, and it does not automatically cover file storage or every write path.

4. What we do not claim

SYNTON is not certified (no ISO 27001, no TÜV seal or similar), and we do not describe it as such.
No external penetration test has been conducted to date. Details and open items: see the `tom.md` document in a pilot's contract materials.
A passed access test on a given date is a snapshot, not a standing guarantee for all future dates.
We do not use the terms "works-council-proof" or "GDPR-certified" — there is no reliable seal for either, and we do not invent one.

5. Contact

Questions about privacy or security, including within an organizational pilot:
Kariem Al-Bosta
Email: synton.app@gmail.com

Full legal details: Privacy notice (English courtesy translation; the German version is binding).

Privacy notice | Legal notice | Terms of use