ENTERPRISE TRUST CENTRE / DUE DILIGENCE
Procurement should not require guesswork.
This centre separates what is already published, what is available during enterprise contracting and what is still being formalized. Provider certifications are not presented as Syntropix certifications.
DOCUMENT STATUS
Know what is available before you ask.
Syntropix is building an enterprise procurement pack in layers. Published material is linked directly; contractual or sensitive material is provided through the appropriate client process.
Data Processing Addendum
Contractual processing terms should reflect the actual deployment, roles and applicable data-protection law.
Security & incident pack
Detailed architecture, incident-response and continuity material may contain sensitive operational detail and can be handled through enterprise due diligence.
INFRASTRUCTURE & DELIVERY TRANSPARENCY
Syntropix governs the service. Selected providers support defined infrastructure layers.
Syntropix designs and operates the application and remains responsible for its own access controls, workflow design and data governance. Selected infrastructure providers support specific delivery layers within defined boundaries.
Managed data infrastructure.
Production data services support relevant application and enterprise workflows under Syntropix-controlled authorization and server-side access boundaries.
Server-side application delivery.
Managed compute supports backend workflows while application security and authorization remain Syntropix responsibilities.
Operational communication delivery.
Transactional messaging providers support invitations and operational communication where the workflow requires them.
Static public-site distribution.
Public presentation infrastructure serves website assets; privileged application operations remain outside the static client.
View the current provider register
| Provider | Current role | Potential data exposure | Boundary |
|---|---|---|---|
| Supabase | Managed PostgreSQL/database and related platform services used by Syntropix production systems. | Application/account, assessment or enterprise workflow data where stored by the relevant product flow. | Privileged access remains server-side; database authorization and service-role handling remain Syntropix responsibilities. |
| Render | Managed backend compute for Syntropix server-side application services. | Data transmitted to or processed by backend workflows. | Infrastructure-provider controls do not replace Syntropix application security and authorization. |
| Postmark | Transactional email delivery for invitations, reports and operational messages. | Recipient email address, message content and attachments required for the email workflow. | Email delivery is fail-soft so a provider failure does not silently reverse core assessment or licence actions. |
| GitHub Pages | Public static website delivery. | Public-site requests and static assets; sensitive server-side credentials are not embedded in the public site. | Public presentation layer only; privileged application operations remain off the static client. |
| Meta / WhatsApp Business | Optional customer contact/relay path for Concierge and direct WhatsApp handoff. | Conversation data only when the visitor chooses or the configured relay is used. | Not required for assessment scoring or core enterprise data storage; Syntropix Command retains a fallback path. |
Provider roles can evolve as Syntropix changes infrastructure. Enterprise clients should rely on the provider register and contractual documentation current at the time of their deployment.
CONTROL BOUNDARIES
Security claims stay at the layer Syntropix actually controls.
Using a provider that holds a certification does not make Syntropix itself certified. The relevant question is how the whole system is configured, governed and operated.
Least privilege and server-side secrets.
Privileged credentials are kept out of public browser code, with role and workflow boundaries for sensitive operations.
Access follows the use case.
Developmental data should not become unrestricted enterprise visibility simply because it exists in the platform.
Presentation changes are gated.
Automated regression controls help keep assessment, auth and enterprise runtime logic separate from website redesign work.
Aggregation is not magic anonymity.
Prism360 and employee-experience workflows must consider group size, role context and potentially identifying free text.
Developmental assistance, not autonomous employment decisions.
AI-supported reflection should not be represented as a clinical judgement, definitive talent verdict or substitute for appropriate human review.
Cross-border questions are deployment-specific.
Data-processing roles, retention, lawful basis and transfer mechanisms need to match the client geography and workflow.
DATA LIFECYCLE QUESTIONS
The enterprise conversation should cover more than a security checkbox.
Before deployment, Syntropix and the client should define the data category, purpose, visibility, retention, deletion path and evidence/reporting boundary for the workflow.
01 / COLLECT
What is necessary?
Define participant, rater, assessment, survey or client-administration data required for the stated purpose.
02 / ACCESS
Who needs to see what?
Separate participant, enterprise, assessor, coach and administrative visibility rather than assuming a single access model.
03 / RETAIN
How long should it remain?
Retention should be purpose-based and contractually aligned rather than indefinite by default.
04 / DELETE
What is the deletion path?
Rights and deletion workflows should account for operational, legal and contractual obligations applicable to the data.
DUE DILIGENCE CONTACT
Bring the security, privacy and procurement questions early.
For enterprise due diligence, security, privacy and procurement discussions, contact contact@syntropix.in.
Share the requirement and we will respond with the appropriate scope, documentation and conversation path.