Sypher AIField service operating systemPrivacy policy

Trust center

Security

How Sypher AI keeps your business and customer data safe, and the service providers that help run the platform.

Data separation

Every business on Sypher AI has its own workspace. Database row level security is turned on for every table, and every request is checked on the server against the signed-in person's company and role, so one business cannot see another's data.

Encryption

All traffic to Sypher AI uses HTTPS with strict transport security. Data is encrypted at rest by our database and storage provider. Access tokens for connected apps such as calendars, accounting and social accounts are encrypted a second time by Sypher AI before they are saved.

Access control

Owners and managers decide who on their team can see and do what, using roles and per-feature permissions, and can remove a person's access at any time. Sypher AI staff accounts are limited to the people who run and support the platform, must use authenticator-app two-step verification, and are reviewed every quarter.

Sign-in protection

Sign-in pages are protected by rate limits and automated bot checks. Passwords are never stored by Sypher AI in readable form. Accounts with two-step verification turned on cannot open anything until the authenticator code is entered.

Audit trail

Sensitive actions, such as permission changes, exports, deletions and integration connections, are recorded with who did it and when.

Backups and recovery

The database is backed up every day, and the newest backup is checked automatically every day. We keep a written recovery plan and practice restores.

Secure development

Every change goes through a pull request with automated security checks, type checks, tests and a full build before it can reach the live site. Dependencies are scanned for known vulnerabilities and updated weekly. Security headers, including a content security policy, are sent on every page.

Payments

Card and bank details are handled by Stripe, a PCI DSS Level 1 certified provider. Sypher AI never stores full card numbers.

Policies and incident response

Sypher AI follows written security policies covering access, change management, vulnerability management, vendor review, data retention and incident response. If an incident affects your data, we will notify the business owner within 72 hours of confirming it.

Compliance status

Sypher AI is preparing for a SOC 2 audit and has not yet completed one. Our hosting, database and payment providers hold their own SOC 2 or PCI reports.