Security and Data Handling
What SynapseOrch Cloud does with your data, how long it keeps it, and what we do not claim.
This page describes the posture in practical terms. The privacy policy is the authoritative document, and where the two differ the policy governs.
Your content is not training data
Content you put into SynapseOrch Cloud — prompts, documents, run inputs and outputs — is not used to train models, ours or anyone else's. Platform models run against providers under terms that exclude training on customer data.
How long things are kept
| Data | Kept for |
|---|---|
| Workspace content, vault documents, memory | As long as your organisation exists, or until you delete the item |
| Run logs — step inputs and outputs | 90 days, then pruned automatically |
| Technical and security logs | 90 days, longer only as part of an incident investigation |
| Audit records | As long as your organisation exists, then deleted with it |
| Metering and billing records | As long as tax and accounting rules require, typically seven years |
Ninety days after a run ends, its step inputs and outputs, its errors and its agents' transcripts are cleared. The run's record stays — its status, timings, tokens and cost — so a run past that point can be listed and counted, but not replayed or scored. Billing records are usage totals and invoices, not your content.
Exporting the audit log
On the Business plan, owners and admins download the organisation's audit records under Settings → Audit log, as CSV or as JSON, for any range of days (UTC, both ends included; the last 30 days to start with).
- Each row says when, what (
org.member.invited,settings.updated, …), who — the person's email, an API key's id, a widget visitor or the system — what it acted on, the IP address and user agent, and the event's details. - A row written by SynapseOrch support while signed in as someone in your organisation is marked
via_support, with the person it acted as. Support's own records about your account, such as a plan changed for you, are not in the export. - In the CSV, a value that a spreadsheet would read as a formula starts with
', so opening the file runs nothing. - Exporting is itself recorded in the log.
Deletion
Delete an item and it goes. To delete the organisation, an owner emails info@synapseorch.com; its content, audit records and vault are deleted within 30 days, and backups roll off within a further 30 — subject to the billing records above, which are a legal obligation rather than a choice.
What is isolated
Each organisation's data is scoped to that organisation throughout — storage, runs and model calls. Provider keys are read for each run and never written into the process environment, so they are not inherited by the subprocesses the engine spawns, including MCP servers and the code sandbox. That is the same boundary as self-hosting.
What agents can reach
Worth being explicit, because it is the part you control rather than us:
- An agent can reach exactly the tools you give it. Tool policy decides what it may do with them, and
confirmputs a person in the loop. - Python tools run with network access. The sandbox tool defaults to none, but an agent can ask for it.
- An embedded widget's visitors can use only the tools you tick for that widget under What visitors can use — none until you tick them — and never the agent's memory. Anything you tick, anyone on your site can make the agent use.
What we observe
To run the service we record traces of runs and chat turns: ids, timings, token counts, cost, step types and tool names. They never carry content — no prompt, message, tool argument or result.
What we do not claim
Being straight about this is more useful than a confident page:
- No SOC 2 certification today. If you need one, ask where it stands rather than assuming.
- A DPA is available on request rather than automatically attached.
- We describe this as a documented, auditable data-handling posture — not as a guarantee. Run logs, the event journal, vault documents and object storage all hold customer data, and saying "guaranteed" of a pipeline with that many parts would be overclaiming.
If your requirements are firmer than this, self-hosting keeps every byte on infrastructure you control, and is the honest answer for a hard data-residency rule.
Reporting a vulnerability
Security issues in the open-source engine go through SECURITY.md in the repository. For anything affecting SynapseOrch Cloud, email info@synapseorch.com — please do not open a public issue.