01
No shared platform: every customer gets their own machine, with a French hosting provider, running nothing but their Syniaps.
- Your files, your synapses (your company memory) and your conversation history are stored on that machine, in France.
- Backups are stored in France as well.
- If your company moves to another machine, everything follows: access, connections, scheduled missions, cloud folders.
02
Nobody gets in without having been invited.
- An access gate placed in front of the application filters entries, company by company: only invited addresses get through.
- Every sign-in requires a second factor: a one-time code generated by an authenticator app (TOTP), with backup codes.
- The company's identity is verified at sign-up; a company has a single space, and its members are invited into it.
- An access can be suspended or removed at any time, with immediate effect.
03
To act on your tools and websites, Syniaps needs keys and sessions. They never leave the server.
- Site passwords, API keys, cookies and session states are encrypted (AES-256) in protected files on the machine, never in the database.
- The AI model has no access to them: it requests an action, the server performs it with your credentials, and only the result comes back.
- These secrets are strictly personal, even within your team: a website session is never shared.
- A guardian immediately removes from your team's view any file dropped by mistake in the shared folder that would contain a key or a session, and moves it to your trash.
04
On the company machine, every member has their own space.
- The intelligence works in a sandbox: it only sees your space and what the company has shared; the other spaces are physically invisible to it.
- Your files, your conversations and your connections remain yours until you decide to share.
- Sharing is an explicit gesture: a folder, a conversation, a project, a skill, and you can take it back.
05
What travels and what is stored is protected, at every step.
- In transit: every exchange between your browser, your phone and your server goes over HTTPS (TLS). Nothing travels in the clear.
- At rest: the passwords, keys and sessions you entrust to Syniaps are encrypted with AES-256-GCM on the server, with a key unique to each machine, out of reach of the intelligence and of the database.
- In backups: every copy that leaves the server is encrypted before it goes; without the key, kept in our vault, it is unreadable.
- Between servers: Syniaps' internal traffic (supervision, updates, backups) goes over a private encrypted network, never the open internet.
- The whole disk: your server's disk is encrypted (LUKS) and its decryption key is kept off the machine; a stolen or replaced disk is unreadable.
06
An outage, a mistake, an unfortunate deletion: nothing is lost.
- Every night, an encrypted backup of your data leaves the server for OVHcloud in France.
- We keep the last seven nights, one copy a week for a month and one a month for six months.
- The decryption key stays in our vault: a stolen backup is unreadable.
07
What happens on your server is recorded, and any flaw can be reported to us.
- An audit log per company records sensitive actions: who did what, and when.
- A public disclosure policy (security.txt) lets any security researcher report a flaw to us.
- Syniaps' code runs on the server without privileges: the intelligence never holds the machine's administration rights.
08
Our measures are not only stated: they are reviewed every year by a third party, against the most widely used application security standard.
- Syniaps has passed the CASA (Cloud Application Security Assessment) of the App Defense Alliance, at level AL1, with an authorized lab.
- 48 requirements of the OWASP ASVS standard were verified one by one, with evidence: authentication, session management, access control, communications, data validation, configuration.
- The assessment includes an external security scan of the application, and it has to be renewed every year.
- Following this assessment, the Syniaps application is verified by Google for access to Gmail and Google Drive. A verification is not an endorsement by Google: it attests that our use of your data has been reviewed and approved.
09
Syniaps imposes no model on you. You connect Claude, ChatGPT or the model of your choice, with your own subscription, and switch whenever you want: your company memory, your connections and your automations stay. Only the content needed to read, search and answer is sent to it, under our GDPR-compliant data processing agreement, which names each provider and where it processes.
- Claude, ChatGPT or the model of your choice, with your own subscription: the provider can be swapped at any time.
- The model only receives what is strictly needed: never your passwords, keys or sessions.
- An alternative provider only connects after your explicit consent in the interface, with its terms recalled at connection time.
