Security at Symphonate
Last updated: 2026-05-22
A one-page summary of how we protect your team's data. For the detailed engineering write-up or to report a vulnerability, email security@symphonate.ai.
Authentication
- Password hashing: bcrypt (10 rounds).
- Sessions: HMAC-signed tokens with rotating server secret.
- Real-time auth: Socket.IO tokens validated per connection.
- SSO (Google Workspace, Microsoft Entra): on the Enterprise roadmap.
Encryption
- TLS 1.2+ in transit (managed certs via AWS).
- Encrypted EBS volumes at rest (AES-256).
- Per-tenant data isolation enforced at the application layer.
AI sub-processors
Anthropic (Claude) and Google Gemini — both called under commercial API terms with training opt-out enabled. Your team's messages are never used to train third-party models. (OpenAI is supported in the platform but is not currently in use.)
Operational
- Error tracking: Sentry (errors only — no message bodies).
- Audit log: append-only
audit_eventstable for high-value mutations. - Backups: daily snapshots, 30-day retention.
- Hosting: AWS Fargate in ap-southeast-2 (Sydney).
Compliance roadmap
- GDPR data-export + deletion: live today via the public API.
- SOC 2 Type II: in progress, target Q4 2026.
- EU data residency: with Enterprise launch.
Reporting a vulnerability
Please email security@symphonate.ai with details and reproduction steps. We acknowledge within one business day and post-launch will run a coordinated-disclosure program. For general product questions or account help, email help@symphonate.ai instead.