Trust Center
Our customers trust Syzygia with their business data. This page summarizes how we protect it. It describes our current practice, not a contractual commitment; the commitments for customers are in our Terms of Service and Data Processing Addendum.
Documents
- Terms of Service and Privacy Policy.
- Data Processing Addendum (DPA), including our technical and organizational measures.
- Sub-processors: the list is available to customers on request.
- Cookie Policy and Vulnerability Disclosure Policy.
1. How we protect data
- Encryption: data is encrypted in transit and at rest.
- Access control: staff access follows least privilege and need-to-know, and is removed promptly when no longer needed. Within an organization, role-based permissions control who can see what.
- Customer separation: each customer's data is logically separated from other customers' data.
- Backups: we keep regular backups so data can be restored after an incident.
- Monitoring and logging: we log and monitor security-relevant activity and act on alerts.
2. Incident response and breach notification
We follow a written incident response plan. Where a personal data breach affects data we process for a customer, we notify the customer without undue delay and within the time set in the DPA. Where Syzygia is the controller, we notify the competent supervisory authority within 72 hours where the law requires it, and the people affected when the risk to them is high.
3. People and sub-processors
- Everyone with access to customer data is bound by confidentiality obligations.
- Sub-processors process personal data only under written contracts with data protection obligations. See our Sub-processors page.
4. Reporting a vulnerability
If you believe you have found a security vulnerability in Syzygia, please email support@syzygia.io. How to report, what is in scope and our safe-harbor commitment are set out in our Vulnerability Disclosure Policy. Our contact details are also published in security.txt.