Trust & Security

Institutions determine which participant and program records enter Synrgy and how those records support their programs. We limit processing to the services and purposes described in the applicable agreement.

Synrgy does not sell customer data or use it for third-party targeted advertising. Institution-provided data is not used to train a generalized Synrgy AI model unless the institution authorizes that use in writing.

Access is designed around institutional roles and the principle of least privilege. Customer administrators manage authorized users and program access. Synrgy reviews internal access needs and limits provider access to the work required to operate and support the service.

Synrgy uses managed infrastructure and security controls designed to protect data during transmission and storage. We maintain operational safeguards for authentication, access control, monitoring, backups, and vulnerability remediation appropriate to the service and pilot scope.

No system is completely secure. Security requirements, data locations, retention, and deletion procedures for a deployment are documented during contracting when relevant.

AI-assisted features may organize information, generate roadmaps, summarize progress, recommend resources, and help advisors prioritize support. Outputs may be incomplete or inaccurate and should be reviewed by an appropriate person.

Synrgy is designed to support human judgment. It is not intended to make final decisions about admission, employment, funding, benefits eligibility, or other decisions with legal or similarly significant effects.

Synrgy may use providers for hosting, storage, analytics, communications, support, security, and AI-assisted features. We evaluate access and contractual protections according to the data and service involved. Institutional customers may request current subprocessor and integration information during procurement.

We monitor service health and investigate suspected security events. If an incident affects customer data, Synrgy will take reasonable steps to contain and remediate it and provide notices required by law and the applicable customer agreement.

We can work through security questionnaires, data-flow reviews, subprocessor questions, and a data processing addendum as part of an institutional evaluation. Available documentation depends on the deployment scope and contracting stage.

This page describes Synrgy's current approach. It does not claim a certification, independent audit, or regulatory status unless Synrgy provides that documentation directly.