Least privilege by design.
Authenticated authorization, explicit role boundaries and server-side privileged secrets. Browser-visible code must never contain service-role or equivalent privileged credentials.
SECURITY / PRIVACY / GOVERNANCE
Trust is a system,
not a badge.
Trust comes from explicit boundaries, least privilege, traceable administrative actions, disciplined releases and honest claims—not from borrowing a provider’s certification language.
APPLICATION TRUST PRINCIPLES
Four control areas that matter.
These principles describe the application and operating discipline Syntropix is building around its products and client workflows.
Purpose-bound access.
Row-level or equivalent authorization controls where exposed data requires user or tenant isolation, with deny-by-default handling for sensitive datasets.
Trace the sensitive actions.
Administrative workflows should create traceable events. Auditability complements authorization; it does not replace it.
Presentation must not silently alter logic.
Material changes should pass regression and security checks. Assessment-engine changes require parity testing so UX work cannot silently change scoring.
SECURE & RELIABLE / GLOBAL CAPABILITY
Security is an operating discipline.
Syntropix separates application controls from infrastructure-provider claims so clients can understand the actual control boundary.
Secrets stay out of public clients.
Privileged credentials and sensitive operations belong behind controlled server-side boundaries rather than browser-visible code.
Sensitive stores are not public by convenience.
Backend-only datasets can remain inaccessible to public roles, with access mediated by governed application services.
Purpose before visibility.
Assessment, feedback and pulse-check data should be exposed only to the people and workflows that require it, with confidentiality safeguards where appropriate.
Configure for the client context.
Privacy, processing, retention and cross-border requirements should be reviewed for the relevant geography and enterprise deployment—not assumed universal.
CONTROL BOUNDARY
Know who is responsible for what.
Infrastructure-provider controls are important. They do not automatically become Syntropix certifications.
Application & operations
Authorization, application configuration, assessment-data handling, tenant isolation, retention choices, administrative access, release discipline and incident response remain Syntropix responsibilities.
Underlying infrastructure
Hosting, database and other providers operate their own controls and publish their own compliance material. Their certifications apply within their documented service boundaries.
ASSESSMENT DATA
Developmental data deserves explicit boundaries.
A person’s assessment or feedback story should not become unrestricted organizational visibility simply because a platform can technically expose it.
Collect what the workflow needs.
Collect only information required for a stated purpose and attach scoring/evidence to an instrument version.
Keep development separate from diagnosis.
Developmental interpretation must remain distinct from clinical, neurological or diagnostic claims.
Do not manufacture certainty.
Population percentiles should not be exposed until defensible normative evidence exists for the relevant population and version.
Purpose before access.
Apply explicit retention/deletion rules and treat enterprise access as purpose-bound rather than unrestricted visibility into an individual’s developmental story.
PRISM360 CONFIDENTIALITY
A threshold reduces disclosure risk. It does not guarantee anonymity.
Rater-group design also has to consider role context, subgroup size and potentially identifying comments.
Confidentiality is a design problem, not a footnote.
Groups that do not safely meet the applicable threshold should be suppressed or combined only where the resulting group remains sufficiently protected.
Minimum group thresholds
Use thresholds as a safeguard for confidential categories.
Context review
Check whether identity could still be inferred from role or subgroup structure.
Comment handling
Free-text can disclose identity even when numeric aggregation is safe.
DUE DILIGENCE
Trust questions should have clear answers.
For security, privacy and enterprise due-diligence questions, contact the Syntropix team.