Your store is in safe hands.
Attacks are stopped before they reach you. If something gets through, you find out from us first, with the fix. And there is always a copy of your store that you can bring back yourself.
What we run.
Every control below is running today, on every store, at no extra charge. The ones that keep a store open come first.
-
Attacks stop at the edge
Cloudflare absorbs volumetric and layer-7 DDoS in front of every store. The origin only answers requests that came through that edge: authenticated origin pulls plus a load-balancer allowlist, so nobody routes around it.
-
A firewall for your store alone
Each store runs its own web application firewall at the origin, with rules tuned to its app. Blocked requests never reach PHP.
-
Every node watched at runtime
File integrity monitoring and intrusion detection run on every node and every container. If a file in your checkout changes when it should not, you know before your customers do.
-
Backups you can restore yourself
Weekly full and hourly incremental database backups, with the binlog shipped every minute for point-in-time recovery where the engine supports it. Thirty days of retention, a copy in a second region, and a write-once vault that ransomware cannot reach. Restores are self-service from the dashboard.
-
Your data in its own room
Per-store namespace, database, cache, media bucket, and encryption key. Network policy between stores is enforced. Nothing is shared or mixed with another customer.
-
Encrypted end to end, with your own key
TLS 1.2 or better from the browser to the edge and from the edge to the origin. Data at rest is encrypted under a key that belongs to your store, replicated to a second region so recovery never depends on a cross-region call.
-
Accounts with roles, MFA, and a record
Owner, admin, developer, and billing roles. Two-factor with TOTP and recovery codes for every account. Every action on your team is in an audit log kept for twelve months.
-
AI diagnostics without your customers' data
Diagnostics run only when you turn them on. Card numbers and personal data are stripped before anything leaves the platform, nothing is retained after the answer comes back, and nothing is used for training.
What happens if.
The commitments below are written into our data processing agreement and our internal procedures. This is what you can count on when something goes wrong.
-
There is a breach
You hear from us within 24 hours of us becoming aware, with what happened, whose data, and what we are doing about it. Incident and breach records are kept for seven years.
-
One of your customers asks for their data
Export, correction, deletion across every store we hold, portability, and a restriction flag that reaches every system within 15 minutes. We answer your request within 5 business days, 10 for a large erasure.
-
A critical vulnerability is announced
Critical fixes in the platform layer ship within 24 hours, and a deployment cannot go out with one open. High severity within 7 days. Anything that threatens the boundary between stores is treated as critical no matter its score.
-
A government asks for your data
Nothing is disclosed without legal review. We challenge requests that are overbroad, produce only what is compelled, and tell you within 24 hours of receiving the request unless the law forbids it.
-
You need an investigation
You get the logs, network flow data, and infrastructure state for your store, scoped to you, whether it is your own review or a PCI forensic investigator.
-
An engineer needs to get in
Our engineers reach your store through the control plane, where every action is logged to your team activity view. Emergency direct access needs MFA, is time-limited, and you are told within 24 hours.
-
A diagnostic report might contain a card number
Every report is scanned for card-number patterns before it is rendered or sent. If one is found, the report is blocked and our security team is alerted.
-
You leave
Your site is kept for 30 days after you cancel, restorable from the dashboard, then deleted, and the last backup expires within 30 days more. Ask in writing and live data is gone within seven days. What we keep after that is what the law makes us keep, and the retention schedule lists every item.
Your assessor asks. We already have it.
The documents, ready
Attestation of Compliance, shared responsibility matrix, penetration test summary, and the DPA with Standard Contractual Clauses. One email to security@synsmarts.ai.
The evidence, kept
Twelve months of audit log, every deploy and access recorded, and the tenant isolation test results your assessor asks for under Appendix A1.
The edge Cloudflare absorbs DDoS and serves the cache. The origin answers only requests that came through it.
Your store's own firewall OWASP rules tuned to your app, with path rules you set. This is the boundary your assessor audits.
Your data
Its own database, its own encryption key, a copy in a second region. No other store can reach it.
What we hold, and what you can ask for.
Everything your assessor or DPO will ask for, and where to get it.
Published
-
Data Processing Agreement
GDPR Article 28 terms, Standard Contractual Clauses, and our sub-processor obligations.
-
Sub-processor register
Every company that touches your data, where it sits, and 30 days' notice before that list changes.
-
Privacy policy
What we collect about you and your customers, and how long we keep it.
-
PCI-DSS posture
SAQ D as a service provider. Card data passes through the platform to your payment processor and is never stored here.
On request
| Document | Who asks for it | How |
|---|---|---|
| Attestation of Compliance (AOC) | Your QSA or acquiring bank, as evidence for your own Requirement 12.8 | security@synsmarts.ai |
| Shared responsibility matrix | Your assessor, to see which requirements we cover and which are yours | security@synsmarts.ai |
| Penetration test summary (redacted) | Your assessor, for pass/fail and scope | security@synsmarts.ai |
| Tenant isolation test results (redacted) | Your assessor, for Appendix A1 | security@synsmarts.ai |
| Transfer Impact Assessment | Your DPO, for EU personal data | dpo@synsmarts.ai |
| Retention schedule | Your DPO, for your own records of processing | dpo@synsmarts.ai |
| DPIA for AI diagnostics | Your DPO, before you turn diagnostics on | dpo@synsmarts.ai |
| Technical and organizational measures (DPA Annex 1) | Your DPO or your assessor | dpo@synsmarts.ai |
Questions your assessor asks.
More questions in the FAQAre you PCI compliant?
We operate as a PCI-DSS SAQ D service provider. Card data passes through PHP to your payment processor and is never stored on the platform. The cardholder data environment is the path from the edge to PHP: Cloudflare, the load balancer, Envoy, the per-store WAF, nginx, PHP-FPM. Your assessor can have the AOC and the shared responsibility matrix on request.
Which PCI requirements are mine?
Your application code, your extensions, your payment integration, and your team's access hygiene. Ours are the network, the hosts, the runtime, logging, and the boundary between stores. The shared responsibility matrix lists every requirement with an owner.
Are you GDPR compliant?
We process your customers' data as your processor under a DPA with Standard Contractual Clauses. The sub-processor register is public, retention is scheduled, the breach procedure and the DPIA for AI diagnostics are documented, and we designate an EU representative when the first EU customer onboards.
How is my store isolated from other customers?
Its own namespace, database, cache, media bucket, and encryption key, with network policy enforced between stores. Session tokens, payment data, and personal data never cross that boundary. We test the boundary with a tenant isolation penetration test, and the redacted results are available to your assessor.
Do you use AI on my data?
Only when you turn diagnostics on, and only on redacted telemetry and code. Card numbers and personal data are stripped before transmission, nothing is retained after inference, and nothing trains a model.
Who do I ask?
security@synsmarts.ai for PCI documents, dpo@synsmarts.ai for GDPR and data-protection questions. A person answers.
Have a question your assessor asked? Send it over.
Send it over and a person answers. Or run the free diagnostic and see the platform on your own store first.