Security

Security and trust are foundational to SynTerra FlowAI. This page summarises how we protect your data and the controls we operate.

Hosting and data protection

You should know where your data is processed. Swiss deployments and data-residency options are planned and are not yet available; they must be scoped and verified with each customer before any sensitive production use. Until then, processing is designed to follow the GDPR and the Swiss Federal Act on Data Protection (FADP), and we confirm the enabled services, processing locations and retention terms before onboarding.

Encryption

Data is encrypted in transit using TLS and at rest using industry-standard encryption. Access to production systems is restricted and logged.

Access control

The Service uses role-based access controls so administrators can scope who can view, edit and approve contracts. Enterprise SSO and MFA are planned capabilities and are not included in the current pilot.

How contract review works today

You upload a contract and it stays private, not public. Assistive pattern masking helps prepare a separate review copy before it is sent to an AI provider. You check and confirm the exact text before AI extraction or risk review. You then check the extracted details, run the AI risk assessment, and an authorised person makes the decision. Applicable renewal dates can be tracked afterwards.

Masking is assistive: names and free text still need human checking, and no tool can detect every personal or confidential detail. At present, PDF and Word files require the review text to be pasted in, while plain text files can be read locally.

Compliance roadmap

ISO 27001 certification and SOC 2 Type II attestation are part of our enterprise security roadmap. We follow an enterprise-grade control framework and will publish certification status as it is achieved.

AI and your data

We do not use your contracts to train our own AI models. Processing by external service providers is subject to the applicable provider terms and agreed data-processing arrangements. Before onboarding we confirm which AI services are enabled, where they process data and what retention terms apply.

Reporting and contact

To report a security issue or request a Data Processing Agreement (DPA), contact info@synterraai.com.