Security Overview
Security at Synthesis
Synthesis is built on Google Cloud Platform with enterprise-grade security at every layer. Your business data is encrypted, isolated, and accessible only to your authorized team members.
01Encryption
✓ Encryption in Transit
All data transmitted between your browser and Synthesis is encrypted with TLS 1.2+. We enforce HTTPS via HTTP Strict Transport Security (HSTS) with a one-year policy including all subdomains.
✓ Encryption at Rest
All stored data — in Google BigQuery, Firestore, and Cloud Storage — is encrypted at rest using AES-256 encryption, managed by Google Cloud's Key Management Service.
02Authentication
- Firebase Authentication — Industry-standard JWT-based authentication with cryptographic token verification on every API request.
- Automatic token refresh — Session tokens refresh automatically, with short-lived access tokens that expire and re-verify.
- OAuth 2.0 for integrations — Amazon, Shopify, Meta and Google Ads connections use secure OAuth flows with HMAC signature verification and CSRF protection via cryptographic nonces.
03Access Control
Role-Based Permissions
Every user is assigned a role within their organization. Permissions are enforced server-side on every request — not just in the UI.
| Role | Capabilities |
|---|---|
| Viewer | Read-only access to dashboards and insights |
| Member | Run queries, view data, manage own sessions |
| Admin | Invite team members, manage brand settings, access all analytics |
| Owner | Full control including billing, brand claiming, and organization settings |
Brand-Level Access Control
Users can only access brands they are explicitly authorized for. Brand access is verified on every API call through a two-layer check: an in-token cache for speed, plus a live Firestore verification for accuracy.
04Data Isolation
Your data is never mixed with other customers' data. Every organization receives its own isolated infrastructure:
- Separate BigQuery datasets — Each organization's Amazon, Shopify, Meta and Google Ads data is stored in dedicated, isolated datasets. No cross-tenant queries are possible.
- Isolated file storage — Uploaded files are stored under brand-specific paths in Google Cloud Storage with per-brand access controls.
- Organization-scoped Firestore — Application data (sessions, settings, memories) is scoped to your organization with no shared collections.
05API Security
- CORS protection — Cross-origin requests are restricted to an explicit allowlist of trusted domains. No wildcard origins.
- Security headers — Every response includes X-Content-Type-Options, X-Frame-Options (DENY), HSTS, Referrer-Policy, and Permissions-Policy headers.
- Webhook signature verification — All incoming webhooks (Amazon, Shopify, Stripe) are verified using HMAC-SHA256 signatures before processing. Invalid signatures are rejected with HTTP 401.
- Parameterized queries — All database queries use parameterized inputs to prevent SQL injection attacks.
- Input validation — All API inputs are validated through typed Pydantic models. File uploads are restricted to a whitelist of safe file types (PDF, Excel, CSV, images, etc.).
- Sanitized error responses — Error messages returned to clients never expose internal system details, stack traces, or database information.
06Rate Limiting & Usage Controls
- Monthly query limits — Each plan has defined query limits enforced server-side. Exceeding limits returns HTTP 429 with a clear upgrade path.
- Seat limits — Team member invitations are capped per plan to prevent unauthorized access sprawl.
- File size limits — Uploads are capped at 200MB with automatic text extraction limits to prevent abuse.
07Credential Management
- No hardcoded secrets — All API keys, client secrets, and tokens are loaded from environment variables, never stored in source code.
- Google Cloud Secret Manager — Production credentials are managed through GCP Secret Manager and injected into the runtime environment.
- Per-merchant token storage — Amazon, Shopify, Meta and Google Ads OAuth tokens (including Google Ads refresh tokens) are stored per-merchant in encrypted Firestore documents, isolated by organization.
08Infrastructure
✓ Google Cloud Run
Serverless hosting with automatic scaling, built-in DDoS protection, and no exposed public IP addresses. Managed by Google's infrastructure security team.
✓ Google BigQuery
Enterprise data warehouse with AES-256 encryption at rest, fine-grained IAM access controls, and automatic audit logging of all queries.
✓ Google Firestore
NoSQL database with automatic encryption, per-document access rules, and real-time audit logging via Google Cloud Audit Logs.
✓ Google Cloud Storage
Object storage with AES-256 encryption, per-object access controls, and versioning for uploaded brand files.
09Audit Logging & Monitoring
- Query logging — Every analytics query is logged with brand context, timestamp, and response metadata for full auditability.
- Google Cloud Audit Logs — All access to BigQuery, Firestore, and Cloud Storage is tracked through GCP's native audit logging.
- Cloud Run request logging — Every HTTP request is logged with metadata for security analysis and incident investigation.
- Usage tracking — Per-organization query counts, seat usage, and feature access are tracked monthly.
10Compliance & Policies
✓ Privacy Policy
Comprehensive privacy policy covering data collection, usage, storage, sharing, and your rights. Read our Privacy Policy
✓ Incident Response Plan
Documented 5-phase incident response protocol with severity classification, 72-hour breach notification, and post-mortem procedures. Read our Incident Response Policy
✓ GDPR Compliance
Mandatory compliance webhooks for customer data requests, customer data deletion, and full shop data erasure. All requests verified via HMAC signatures.
✓ Data Retention
Clear data retention policies. Account data deleted within 30 days of account termination. You can request data deletion at any time.
11Security Summary
| Category | What We Do |
|---|---|
| Encryption (Transit) | TLS 1.2+ with HSTS enforcement |
| Encryption (Rest) | AES-256 via Google Cloud KMS |
| Authentication | Firebase JWT with automatic token refresh |
| Authorization | 4-tier RBAC with per-brand access control |
| Data Isolation | Per-organization BigQuery datasets and storage paths |
| API Protection | CORS whitelist, security headers, HMAC webhooks |
| Input Validation | Typed models, parameterized queries, file type whitelist |
| Credentials | Environment variables + GCP Secret Manager |
| Monitoring | Query logs, GCP audit logs, usage tracking |
| Compliance | Privacy policy, incident response plan, GDPR webhooks |
12Questions?
If you have questions about our security practices or need additional documentation for your compliance review, contact us at:
Synthesis Intelligence, Inc.
security@synthesisintelligence.ai