Skip to content
Sygnyfy
Start free trial

Security at Sygnyfy

How Sygnyfy protects your customer data, from database isolation to aliasing personal data before any AI call.

Customer conversations are some of the most sensitive data a product team has. Sygnyfy is built so that your data stays yours, stays separate from every other organization, and never reaches an AI model with personal details in it.

Isolation between organizations

  • Every record belongs to one organization. The database enforces this with Postgres row-level security on every table, so a query can only ever see the current organization's rows, even if application code has a bug.
  • The application connects with a database role that can't bypass those rules.
  • Automated tests try to read and write across organizations on every change, and the build fails if any table is missing its protection.

Personal data and AI

  • Before any text is sent to an AI model, names of people and companies, emails, phone numbers, addresses, card and ID numbers, and dates of birth are replaced with placeholders. The real values are restored only inside Sygnyfy.
  • The code that calls models only accepts text that has been through this aliasing step, so unaliased text can't be sent by mistake.
  • Models are reached through Vercel's AI Gateway, using Anthropic and, as a fallback, OpenAI, under API terms that prohibit training on your data.
  • AI output is always a suggestion. A person accepts or rejects every change.

Read the details in Data and privacy.

Encryption

  • All traffic uses HTTPS with TLS 1.2 or higher.
  • The database and uploaded files are encrypted at rest with AES-256.
  • Application secrets are stored in the hosting provider's encrypted environment settings, never in code.

Sign-in and access

  • Sign-in runs on WorkOS, with Google, GitHub, Slack, or verified email, bot protection, and multi-factor authentication.
  • Roles control what each member can see and change, and the server checks permissions on every action, not just the interface.
  • Owners and admins manage who has access, and removing a member takes effect immediately.
  • Access to production systems is limited to authorized IC5 Labs staff, with multi-factor authentication.

Monitoring and audit

  • Every change to a record is recorded in its activity history, with who made it and when.
  • Errors are monitored with Sentry. Request bodies, cookies, and personal data are removed before an error report leaves Sygnyfy.
  • Product analytics record events and counts only, never the content of your records.

Reliability and backups

  • Sygnyfy runs on Vercel and Neon, with point-in-time restore for the database.
  • Background work, such as transcript analysis, retries safely after failures without running twice.

Your data, your control

  • Export everything at any time as JSON or a CSV archive.
  • Deleting your organization permanently deletes its data after 30 days. See the Privacy Policy for retention details.
  • We process customer data under our Data Processing Addendum, with a public list of subprocessors.

Reporting a vulnerability

If you think you've found a security issue, email security@ic5labs.com with the details. Please don't test against other customers' data or disrupt the service. We'll acknowledge your report within two business days and keep you updated while we fix it.