1. Our role
SynaptoSec acts as a Data Processor for customer content (we process on behalf of the customer, who is the Data Controller) and as a Data Controller for our own customer account data.
2. Legal basis
| Processing activity | Legal basis | GDPR Article |
|---|---|---|
| Providing the Service | Contract | Art. 6(1)(b) |
| Improving detection (anonymized) | Legitimate interest | Art. 6(1)(f) |
| Billing & tax records | Legal obligation | Art. 6(1)(c) |
3. Data residency
Our infrastructure runs in Amsterdam, Netherlands. Some processing occurs with providers outside the EEA (NVIDIA and Google in the US — see the sub-processor list); the transfer instruments are being finalized with legal counsel and are not claimed here until executed. Sub-processors are listed at .
4. Data minimization
We collect the metadata necessary for billing, audit, and detection, applying the principle of data minimization (Art. 5(1)(c)). A verified statement covering prompt and response content handling will be published here.
5. Security measures (Art. 32)
- Encryption at rest: AES-256-GCM for stored audit reports
- Encryption in transit: TLS 1.3
- Access control: Role-Based Access Control (RBAC)
- Audit logging: every API call logged with correlation ID
- Regular security audits: completed before each feature release
- Dependency scanning: automated OSV.dev audit
6. Data subject rights
We assist the Controller in responding to data subject requests within one month, as required by GDPR Article 12(3). Requests can be directed to synaptosec@gmail.com.
7. Breach notification (Art. 33)
In the event of a personal data breach, we notify affected customers within 72 hours of becoming aware of the breach, providing: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken.
8. Sub-processors
Current sub-processors are listed at . We provide 30 days' notice before adding or replacing a sub-processor, giving customers the opportunity to object.
9. DPA
A standard Data Processing Agreement (DPA) is incorporated by reference into our Terms of Service. Review the complete terms at . Enterprise customers may request a custom DPA at legal@synaptosec.com.
10. Contact
Data Protection Officer: dpo@synaptosec.com. General legal counsel: legal@synaptosec.com.