Trust
Security
SynOS is self-hosted by default. In our standard deployment the software runs inside the customer's own infrastructure, and customer data never reaches SynOS Labs LLP. This page describes how the platform is built, what we do and do not hold, and where our responsibility begins and ends.
Posture at a glance
Default deployment: single instance inside the customer's own cloud or datacentre. Zero egress of customer data to SynOS Labs LLP.
Raw data stays put: SynOS extracts context from your systems of record; the underlying records remain in those systems.
Model-agnostic: you choose the model provider and supply the credentials. Customer content is not used to train models.
Certifications: SynOS Labs LLP does not currently hold SOC 2 or ISO 27001. We do not claim otherwise. See Compliance status.
Contents
- Deployment models and the trust boundary
- What data SynOS handles
- Model providers and training
- Access control and audit
- Encryption and credentials
- Code execution and sandboxing
- Infrastructure and tenancy
- Corporate security
- Incident response
- Business continuity
- Compliance status
- Reporting a vulnerability
1. Deployment models and the trust boundary
SynOS ships in three deployment modes. All three use identical architecture; what changes is who controls the infrastructure and therefore who holds the data.
| Mode | Runs on | Who holds customer data | Subprocessors touching customer data |
|---|---|---|---|
| Self-hosted (default, and the mode used for our current enterprise engagements) | Customer's own cloud account, VPC, or datacentre | The customer. SynOS Labs LLP has no access unless the customer explicitly grants it for support. | None |
| Dedicated managed | A dedicated instance operated by SynOS Labs LLP on the customer's behalf | SynOS Labs LLP as a processor, under the terms of the signed agreement | See Subprocessors |
| Hosted multi-tenant | SynOS Labs LLP-operated infrastructure at app.synos.in. Used for evaluation; no production enterprise workload runs here. | SynOS Labs LLP as a processor, with per-tenant isolation | See Subprocessors |
Switching modes requires no application changes. Enterprise customers are onboarded self-hosted unless they ask otherwise.
2. What data SynOS handles
- Context, not copies. SynOS connects to your systems of record and extracts the context needed to answer and act. The source records stay in the source systems.
- Project-level isolation. Every query and operation is scoped to a project. A project's context graph does not cross into another project.
- Per-tenant isolation. In managed and multi-tenant modes, each tenant's context graph is isolated from every other tenant's.
- Execution records. Agent runs, tool calls, corrections and skill promotions are logged so that behaviour is attributable, and corrections can be superseded by later corrections.
- Deletion. In self-hosted deployments, deletion is entirely under customer control. In managed and hosted modes, we delete customer data on written request and on termination, subject to the retention terms in the signed agreement.
3. Model providers and training
- SynOS is model- and harness-agnostic. The customer selects which model providers are used.
- In self-hosted deployments the customer supplies their own provider credentials or endpoints, including private and in-VPC endpoints where available. Model traffic goes from the customer's deployment to the customer's chosen provider.
- SynOS Labs LLP does not train models on customer content, and does not use customer content to improve models for other customers.
- Where SynOS calls a commercial model provider, it uses that provider's business or enterprise API endpoints, under which submitted content is not used for model training.
4. Access control and audit
- Enterprise single sign-on. SynOS authenticates against your identity provider over SAML 2.0 or OIDC, with SCIM user provisioning and de-provisioning. Multi-factor authentication, conditional access and device policy are enforced by your IdP under your own policy. We do not ask you to adopt ours.
- Role-based access on two axes. Instance role (platform operator, instance admin, member) determines who administers the deployment. Project role (viewer, editor, project admin) determines what a user may do inside a given project, and can be narrowed or widened per user and per tool. An instance role does not by itself grant access to a project's data.
- Per-skill and per-agent permissions declared at the individual tool level, and revocable.
- A skill carries its tool list, parameter contract and scope, so the same permissions apply wherever it runs. Where a skill declares the external hosts it needs, that declaration is recorded with the skill; enforcement of it is not yet in the runtime path.
- Graduated autonomy: agents move from suggest-only to review-required to autonomous per worker, rather than being trusted wholesale.
- Full audit trail. Every execution, correction and promotion is logged, with cost and tool calls attributable per run.
5. Encryption and credentials
- All traffic to and between SynOS services runs over HTTPS/TLS, with automatic certificate provisioning.
- All credential material the platform writes is encrypted at rest.
- In environments SynOS Labs LLP operates, data at rest is additionally encrypted by the underlying cloud platform by default. In self-hosted deployments, storage-level encryption is configured by the customer as part of their own infrastructure.
- Credentials are referenced by agents, not exposed to them: an agent invokes a tool, and the tool layer holds the credential.
6. Code execution and sandboxing
SynOS lets agents and internally built apps run code. That is handled explicitly rather than implicitly:
- Generated apps and any code an agent executes run in their own sandbox.
- Code generated in the product is scanned before it is built: unsafe imports, escape hatches, raw network calls and embedded secret literals block the build.
- Sandboxes have no egress path in production. Per-sandbox egress policy is a development-mode capability, pending kernel-level sandbox hardening.
- Sandboxed app code carries a short-lived scoped token, checked against that app's own tool catalogue on every call. A run cannot exceed the permissions of the skill that started it, which is enforced by the skill's declared tool list and by role-based access control.
7. Infrastructure and tenancy
Self-hosted deployments run wherever the customer chooses: their cloud account, their region, their network controls, their backup regime. SynOS Labs LLP operates no infrastructure in that path.
SynOS Labs LLP-operated environments (the hosted multi-tenant evaluation environment and any dedicated managed instances) run on Google Cloud Platform. Hosting region for a specific deployment is confirmed on request and can be fixed contractually.
8. Corporate security
SynOS Labs LLP is an early-stage company and describes its internal controls plainly rather than dressing them up:
- Company email, documents and calendars run on Google Workspace with multi-factor authentication enforced on business accounts.
- Company endpoints use full-disk encryption and automatic screen lock.
- Production and customer credentials are held in restricted secret storage and issued on a need-to-know basis.
- Access to any customer environment is granted only where the customer has explicitly authorised it, and is revoked at the end of the engagement.
- Every person with access is bound by written confidentiality obligations.
9. Incident response
- We investigate any suspected security incident on receipt and prioritise containment.
- Where an incident affects a customer's data in an environment we operate, we alert that customer's designated contact without delay and provide a detailed report within 72 hours of confirming the incident.
- Notification includes the nature of the breach, what is affected, the number of people affected so far as known, what we have done, and what we recommend the customer do.
- Where the incident involves personal data and reporting is required, we also report to the Data Protection Board of India within the timelines set by the Digital Personal Data Protection Rules, 2025, and to any other regulator the customer's contract or applicable law requires.
- For self-hosted deployments, incident detection and response in the customer's environment sit with the customer; we support investigation on request.
10. Business continuity
A self-hosted deployment keeps running inside the customer's infrastructure independently of SynOS Labs LLP. It has no runtime dependency on our servers, our licence server, or our continued operation.
For enterprise engagements we can additionally agree continuity arrangements in the signed agreement, including source and artefact escrow and air-gapped continuity terms. Raise it during contracting and we will scope it with you.
11. Compliance status
SynOS Labs LLP does not currently hold SOC 2 Type I or II, ISO 27001, or any equivalent certification, and does not claim to. We would rather tell you that up front than have it surface in a questionnaire.
- We complete customer security questionnaires, architecture reviews and vendor-risk assessments as part of onboarding.
- We sign NDAs, DPAs and customer-specific security addenda.
- Because the default deployment is self-hosted, most of the vendor-risk surface that certifications are designed to cover stays inside the customer's own control: their infrastructure, their network, their retention, their access reviews.
- Formal certification will follow customer demand. If it is a contractual requirement for you, tell us and we will scope the timeline.
SynOS Labs LLP processes personal data in line with India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. See our Privacy Policy.
12. Reporting a vulnerability
Email security@synos.in with enough detail to reproduce the issue. We acknowledge reports within three business days and will keep you updated until it is resolved.
We ask that you give us a reasonable window to fix an issue before disclosing it publicly. We will not pursue legal action against researchers who report in good faith, act only against their own or authorised environments, and avoid privacy violations, data destruction and service degradation.
Contact
SynOS Labs LLP
Varthur, Gunjur, Bengaluru, Karnataka 560087, India
Security: security@synos.in
General: hello@synos.in