Skip to content
Syntasa

Product · Security & Trust

Your data never touches our systems.

Zero trust you can enforce, agents that stay contained, and AI you can observe, with accreditations proven in the most demanding environments.

Request a technical briefingDeploy anywhere

Zero-trust principles

Every request verified. Every movement on record.

  • Identity

    Every human and agent request is authenticated against your identity provider. No shared accounts, no Syntasa-held credentials in production.

  • Privilege boundaries

    Least privilege at the data, model and agent layers independently. An agent never exceeds the identity that invoked it.

  • Auditable data movement

    Every read, transformation and export logged with actor, time and justification, append-only and exportable to your SIEM.

  • Ingest-time governance

    Lineage, classification handling and policy from the moment data arrives.

Every request path

How a request travels inside your boundary.

  1. Step 1: Your identity provider

    Authenticates every human and agent request.

  2. Step 2: Policy enforcement

    Least privilege at data, model and agent layers.

  3. Step 3: Data · models · agents

    Scoped access; agent authority never exceeds its invoker.

  4. Step 4: Append-only audit

    Actor, time, justification, exported to your SIEM.

Agent containment

An agent inside the perimeter cannot leak what the perimeter does not release.

Agents run inside the same sealed boundary as the data, under the same controls as any human operator. Containment is a property of the architecture, not an instruction the agent is trusted to follow.

  • Declared authority

    What an agent may do is a reviewable artifact, never more than the identity that invoked it.

  • Credentials that expire

    Identity-bound, time-boxed and scoped to the task.

  • No route out

    Agents act only inside the perimeter. Air-gapped, there is no outside to reach.

  • Causality on record

    Every action logged with its chain of whys: data, model and policy.

AI observability

Containment says what an agent can reach. Observability shows what it did.

  • Model behavior

    What each model consumed and produced, on which version of the data.

  • Agent activity

    Every action, under whose identity, within which authority.

  • Data lineage

    Raw source to decision, traceable both ways.

  • Cost attribution

    Compute mapped per workload, visible before the bill.

Identity and access in the product

Controls your security team will recognize.

  • Single sign-on: Okta, Azure, Google, LDAP, PKI and government identity providers
  • Multi-factor authentication
  • Custom roles built from 64 permissions
  • Service accounts for pipelines and agents
  • Secret stores: AWS Secrets Manager, Google Secret Manager, Azure Key Vault
  • OCSF audit events for your SIEM

Jurisdiction and data handling

Processed only where you choose.

Customer data is processed only within your chosen jurisdiction and boundary. Syntasa runs deployments in the US, UK and EU. The platform has no mechanism to move your data to Syntasa infrastructure, because none sits in the data path.

  • Support without data access

    Personnel reach production only with customer-granted, time-boxed, logged credentials. Diagnostic sharing is customer-initiated and customer-reviewed.

  • Disclosure policy

    Report suspected vulnerabilities to security@syntasa.com. We acknowledge within two business days and do not pursue good-faith research within scope.

Accreditations

In production since 2014. US · UK · EU.

  • C2S

  • IL2-IL6

  • ATO in 3 months

  • Federal ATOs

    Held with U.S. federal agencies, including the highest classified environments.

  • FedRAMP High

    The full platform as deployed for federal customers.

  • ISO/IEC 27001

    Independent audit of the information security management system.

  • CAC / PKI

  • AWS GovCloud

  • On-premise

  • Need it in writing?

    Accreditation letters, architecture documentation and security questionnaires are available under NDA.

    Ask our team →

Procurement · available on

Tradewinds is open to U.S. government customers only. For more information on AWS Marketplace for the U.S. Intelligence Community (IC), contact AWS_ICMP@jdiss.cia.ic.gov or icmp@amazon.com.

Trust that extends to every workload.

Walk through your accreditation path.

A technical briefing with our engineers: architecture, accreditations and a deployment path for your constraint. No deck-only meetings.

Request a technical briefingDeploy anywhereA working session with our engineers, on your data and constraints.