01Encryption
All data transmitted between your browser and Synthesis is encrypted with TLS 1.2+. We enforce HTTPS via HTTP Strict Transport Security (HSTS) with a one-year policy including all subdomains.
All stored data — in Google BigQuery, Firestore, and Cloud Storage — is encrypted at rest using AES-256 encryption, managed by Google Cloud's Key Management Service.
02Authentication
- Firebase Authentication — Industry-standard JWT-based authentication with cryptographic token verification on every API request.
- Automatic token refresh — Session tokens refresh automatically, with short-lived access tokens that expire and re-verify.
- OAuth 2.0 for integrations — Amazon, Shopify, Meta and Google Ads connections use secure OAuth flows with HMAC signature verification and CSRF protection via cryptographic nonces.
03Access Control
Role-Based Permissions
Every user is assigned a role within their organization. Permissions are enforced server-side on every request — not just in the UI.
| Role | Capabilities |
|---|---|
| Viewer | Read-only access to dashboards and insights |
| Member | Run queries, view data, manage own sessions |
| Admin | Invite team members, manage brand settings, access all analytics |
| Owner | Full control including billing, brand claiming, and organization settings |
Brand-Level Access Control
Users can only access brands they are explicitly authorized for. Brand access is verified on every API call through a two-layer check: an in-token cache for speed, plus a live Firestore verification for accuracy.
04Data Isolation
Your data is never mixed with other customers' data. Every organization receives its own isolated infrastructure:
- Separate BigQuery datasets — Each organization's Amazon, Shopify, Meta and Google Ads data is stored in dedicated, isolated datasets. No cross-tenant queries are possible.
- Isolated file storage — Uploaded files are stored under brand-specific paths in Google Cloud Storage with per-brand access controls.
- Organization-scoped Firestore — Application data (sessions, settings, memories) is scoped to your organization with no shared collections.
05API Security
- CORS protection — Cross-origin requests are restricted to an explicit allowlist of trusted domains. No wildcard origins.
- Security headers — Every response includes X-Content-Type-Options, X-Frame-Options (SAMEORIGIN), HSTS, Referrer-Policy, Permissions-Policy, and a Content-Security-Policy that restricts which origins may load scripts.
- Webhook signature verification — All incoming webhooks (Amazon, Shopify, Stripe) are verified using HMAC-SHA256 signatures before processing. Invalid signatures are rejected, and a missing signing secret fails closed rather than accepting the request.
- Parameterized queries — All database queries use parameterized inputs to prevent SQL injection attacks.
- Input validation — All API inputs are validated through typed Pydantic models. Every upload endpoint enforces a file-type allowlist (PDF, Excel, CSV, images, etc.) and a size ceiling, checked as the file is read rather than after it is in memory.
- Output escaping — Values that originate from you, from a connected platform, or from the AI are HTML-escaped before they are rendered, so text can never execute as script.
- Sanitized error responses — Error messages returned to clients never expose internal system details, stack traces, or database information.
06Rate Limiting & Usage Controls
- Monthly query limits — Each plan has defined query limits enforced server-side. Exceeding limits returns HTTP 429 with a clear upgrade path.
- Seat limits — Team member invitations are capped per plan to prevent unauthorized access sprawl.
- File size limits — Uploads are capped at 200MB with automatic text extraction limits to prevent abuse.
07Credential Management
- No hardcoded secrets — All API keys, client secrets, and tokens are loaded from environment variables, never stored in source code.
- Google Cloud Secret Manager — Production credentials are managed through GCP Secret Manager and injected into the runtime environment.
- Per-merchant token storage — Amazon, Shopify, Meta and Google Ads OAuth tokens (including Google Ads refresh tokens) are stored per-merchant in encrypted Firestore documents, isolated by organization.
08Infrastructure
Serverless hosting with automatic scaling, built-in DDoS protection, and no exposed public IP addresses. Managed by Google's infrastructure security team.
Enterprise data warehouse with AES-256 encryption at rest, fine-grained IAM access controls, and automatic audit logging of all queries.
NoSQL database with automatic encryption, per-document access rules, and real-time audit logging via Google Cloud Audit Logs.
Object storage with AES-256 encryption, per-object access controls, and versioning for uploaded brand files.
09Audit Logging & Monitoring
- Query logging — Every analytics query is logged with brand context, timestamp, and response metadata for full auditability.
- Google Cloud Audit Logs — All access to BigQuery, Firestore, and Cloud Storage is tracked through GCP's native audit logging.
- Cloud Run request logging — Every HTTP request is logged with metadata for security analysis and incident investigation.
- Usage tracking — Per-organization query counts, seat usage, and feature access are tracked monthly.
10Compliance & Policies
Comprehensive privacy policy covering data collection, usage, storage, sharing, and your rights. Read our Privacy Policy
Documented 5-phase incident response protocol with severity classification, 72-hour breach notification, and post-mortem procedures. Read our Incident Response Policy
Mandatory compliance webhooks for customer data requests, customer data deletion, and full shop data erasure. All requests verified via HMAC signatures.
Clear data retention policies. Account data deleted within 30 days of account termination. You can request data deletion at any time.
11Security Summary
| Category | What We Do |
|---|---|
| Encryption (Transit) | TLS 1.2+ with HSTS enforcement |
| Encryption (Rest) | AES-256 via Google Cloud KMS |
| Authentication | Firebase JWT with automatic token refresh |
| Authorization | 4-tier RBAC with per-brand access control |
| Data Isolation | Per-organization BigQuery datasets and storage paths |
| API Protection | CORS whitelist, security headers, HMAC webhooks |
| Input Validation | Typed models, parameterized queries, file type whitelist |
| Credentials | Environment variables + GCP Secret Manager |
| Monitoring | Query logs, GCP audit logs, usage tracking |
| Compliance | Privacy policy, incident response plan, GDPR webhooks |
12Questions?
If you have questions about our security practices or need additional documentation for your compliance review, contact us at: