What we do to protect your data.

Encryption in transit

All connections to SynthoCore services are encrypted using TLS 1.2 or higher. This applies to:

• Cloudflare Pages and Workers — TLS termination is handled by Cloudflare. TLS 1.0 and 1.1 are not accepted; 1.2 and 1.3 are enforced by the Cloudflare edge.
• Azure-hosted back-end services (SynthoFlow, SynthoOps) — Azure App Service and Azure Database for PostgreSQL enforce a minimum of TLS 1.2. Unencrypted connections are rejected at the service layer.

SynthoDesk connects over HTTPS to Microsoft services and to its Cloudflare backend at api.synthocore.ca. Office.js handles the active Office item; linked-table operations use Microsoft Graph with the user’s consent.

Where SynthoDesk data is stored

SynthoDesk uses a Cloudflare Worker at api.synthocore.ca, with D1 database and R2 object storage on Cloudflare’s global network. It stores tenant and profile records (including name, email hint, and contact fields you enter), governed content blocks and brand kits uploaded by tenant administrators, licensing and entitlement decisions, and privacy-safe operation diagnostics (counts, timings, and error codes, never document text).

Your documents, workbooks, presentations, and mail stay in Microsoft 365. SynthoDesk reads and writes the active Office item through Office.js; user-requested linked-table workflows also use Microsoft Graph with your consent and your own file permissions. SynthoDesk does not store copies of your document content or mail bodies. Workbook values are not stored beyond user-initiated linked snapshots. Content blocks and brand kits intentionally uploaded for reuse are stored separately as described above.

Optional AI previews process only the text or structured data selected for the action through the SynthoCore gateway and Cloudflare Workers AI. SynthoCore does not retain prompt or response bodies; operational usage metadata is recorded.

Per-tenant data isolation

Each customer’s data is isolated at the storage layer:

• SynthoFlow — each workspace is backed by a dedicated Azure PostgreSQL database. Cross-tenant queries are architecturally impossible: the connection string is resolved per workspace at request time and bound to a single tenant’s database.
• SynthoOps — each workspace is backed by a dedicated Cloudflare D1 database binding. The D1 database is provisioned per workspace; the Worker resolves the correct binding from the authenticated session before any query runs.
• SynthoDesk — Microsoft 365 content remains subject to your Microsoft permissions. SynthoDesk-held content blocks, brand kits, and linked-source records are scoped to the authenticated owner at the API layer.

Data retention and deletion

We keep your product data while your subscription is active. Cancelling does not automatically delete it. To request deletion of your SynthoDesk, SynthoFlow or SynthoOps data, write to support@synthocore.ca. We complete deletion within 30 days of your written request and provide written confirmation. Deleting SynthoDesk data does not delete documents, workbooks, presentations or mail in your Microsoft 365 environment.

Entitlement revocation

When a subscription lapses, is cancelled, or a seat is removed, the entitlement revocation propagates to the authentication and authorisation layer within 5 minutes. After revocation, the affected sign-in can no longer access the product — active sessions are invalidated at the next token refresh, which occurs within the same window.

Authentication

SynthoCore uses login.synthocore.ca as its unified sign-in gateway. Sign-in is supported via:

• Microsoft (OAuth 2.0 / OpenID Connect) — the Microsoft account your team already has; no separate credential to create or rotate.
• Google (OAuth 2.0 / OpenID Connect) — any Google account; suitable for individuals not using Microsoft 365.

No passwords are stored by SynthoCore. Credential management is delegated entirely to the identity provider (Microsoft or Google). Sessions are opaque tokens; the token is verified against the revocation state on each request.

Incident contact

To report a security issue, suspected data breach, or vulnerability: email security@synthocore.ca. This address routes to the same queue as support@synthocore.ca and is monitored during business hours. For urgent matters, include “URGENT” in the subject line.

We aim to acknowledge security reports within one business day and to communicate a resolution timeline within five business days. We do not operate a formal bug-bounty programme at this time.

Subprocessors

The following services process SynthoDesk, SynthoFlow and SynthoOps data for the purposes listed. Billing is handled through the central SynthoCore licensing service; no product operates a separate Paddle checkout.

Last updated: 2026-10-25. To request notification of subprocessor changes, email security@synthocore.ca.

Compliance

SynthoCore has not completed a SOC 2 audit and does not claim SOC 2 or ISO certification. For procurement questions, contact security@synthocore.ca.

All personal data processed by SynthoCore is handled in accordance with our Privacy Policy. We do not sell personal data.