How we protect data
Encryption
TLS 1.2+/1.3 for all traffic in transit; data at rest is encrypted by our certified infrastructure providers.
Infrastructure
Hosted on SOC 2 Type II certified cloud and edge infrastructure, with an always-on Web Application Firewall and DDoS protection at the edge.
Authentication
Passwords are salted and hashed (PBKDF2); sessions use signed, HttpOnly tokens; two-factor authentication is available on administrative accounts.
Access control
Least-privilege, role-based access. Multi-tenant data is scoped per organization, and administrative actions are recorded in an append-only audit trail.
Payments
Card data is handled by a PCI DSS Level 1 processor through hosted fields (SAQ A). Full card numbers never touch our systems.
Data minimization
We collect only what a feature needs, redact PII from logs, and keep secrets out of source control with automated secret scanning.
Threat model, in brief
Our primary risks are the common ones for multi-tenant web applications: broken access control (IDOR/BFLA), authentication and session weaknesses, injection, and misconfiguration. We defend with tenant-scoped queries, default-deny API gating, input validation at the edge of every endpoint, hardened HTTP security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), and a pre-deploy review that walks each layer a change touches.
Responsible disclosure policy
We welcome reports from security researchers. If you believe you have found a vulnerability in a SynthBridge-operated site or service, please tell us before disclosing it publicly, and give us a reasonable opportunity to fix it.
How to report
- Email security@synthbridge.net with a clear description, the affected URL or endpoint, and steps to reproduce.
- Include a minimal proof of concept. Please do not include more data than is necessary to demonstrate the issue.
- Our machine-readable contact is published at /.well-known/security.txt (RFC 9116).
Please do
- Give us a reasonable time to remediate before any public disclosure.
- Use a minimal-footprint proof of concept — access only the least data needed to prove impact.
- Report promptly if you inadvertently access someone else’s data, and delete any such data.
Please don’t
- Run denial-of-service tests, automated mass fuzzing, or credential brute-force against production.
- Access, modify, delete, or exfiltrate data that is not your own beyond what a minimal proof requires.
- Use social engineering, physical attacks, or spam against our people or customers.
Our commitment
We aim to acknowledge a good-faith report within 3 business days and to keep you updated as we investigate and remediate. We will not pursue or support legal action against researchers who act in good faith and follow this policy. With your permission, we are glad to credit you on our acknowledgements page. We do not currently run a paid bug-bounty program.
Security contact
Email: security@synthbridge.net
Machine-readable: /.well-known/security.txt
Acknowledgements: /security/thanks
For procurement and compliance questions, see our Trust & Compliance center.