Security at Symmathic

How we protect client data. Questions: hello@symmathic.com.

Where your data lives

Each client's platform runs in the cloud region that client needs, and its databases, documents and the assistant's memory are stored there. UK clients, for example, are hosted in Google Cloud's London region. Production runs in its own cloud project, separate from development.

Tenant isolation

Each client has its own database, and the assistant's memory for each client is written to a separate database of its own. Before any new client joins, the platform will make sure that a person who uses it for one client can never read, change or see another client's data.

Encryption

Data is encrypted with TLS on every connection to the platform, with HTTPS enforced, and the platform's data is encrypted at rest.

Access and audit

Access is role-based and denied unless expressly granted, and every check runs on our servers. Security-relevant actions are logged and kept for a year, and our cloud audit logs are held in locked, tamper-resistant storage.

AI models

We use leading AI model providers' paid commercial services, under which your prompts and outputs are not used to improve their models. Where a provider processes data outside your region, we set that out in your data processing terms. If you need AI processing kept in your region, we can arrange it on request where the provider offers it there.

Resilience and incidents

We maintain a documented business continuity and disaster recovery plan with tested backups, and a written incident response procedure. If an incident affects your data, we tell you without undue delay, work with you to contain it, and keep you informed until it is resolved.

Security reviews

We welcome your security team's assessment, whether a questionnaire, a review of our policies and registers, or testing we agree with you. Email hello@symmathic.com to arrange it.

Reporting a vulnerability

Email hello@symmathic.com with what you found and how to reproduce it.