How your book stays yours.

Last updated 18 September 2026.

De-identified data and document review

Syntra is designed for de-identified commercial case records, not patient records. Do not enter or upload patient names, MRNs, dates of birth or other protected health information. Import and text checks catch some identifying patterns; they cannot identify every sensitive detail. Document capture is optional. A captured photo or PDF is sent to the configured extraction provider as it was taken, and you can black out part of a case-sheet photo afterwards, before it is attached to the case; extracting only business fields does not remove sensitive information from the source document or from what was sent. Case-sheet attachments may be retained in private storage under the workspace retention policy. Contact us before considering a workflow that would require a Business Associate Agreement. See our privacy and security pages for the data flow.

Workspace isolation

Every distributorship gets its own workspace. Isolation is layered:

• Row-level security, forced. The database itself refuses rows outside your workspace. It is enabled in forced mode, so it applies to the table owner too.
• A non-privileged role per request. Each request opens a transaction, drops to an unprivileged database role, and pins your workspace for the life of that transaction. Nothing is cached between requests, so one request cannot inherit another's workspace.
• The workspace is never taken from the browser. The selection is carried in a signed cookie bound to your user id, and it is treated only as a hint — re-checked against live membership on every single request.
• Extra policies narrow, they never widen. Where a second rule sits on top of workspace isolation, it is written as a restrictive policy, so it can only subtract access.

This is tested rather than asserted: the test suite builds a user who belongs to two workspaces at once — the case most likely to leak — and proves that no record from one appears in the other.

Access inside a workspace

People you invite get a role: owner, bookkeeper or sales rep. A sales rep sees their own cases and their own commission, not the whole book and not what colleagues are paid. Roles are enforced in the database, not merely hidden in the interface.

An activity log that cannot be rewritten

Audited changes record who made them and when. Ordinary application roles can append entries but cannot edit or delete existing history.

Payments

Subscriptions run through Stripe. Card details go directly to Stripe and are never seen or stored by Syntra. Payment events arrive over a signed webhook whose signature is verified before anything is acted on, with replay and out-of-order protection.

In transit and at rest

All traffic is served over HTTPS with HSTS. Data at rest is encrypted by our database provider. The application sets standard protective response headers and cannot be embedded in a frame by another site.

Providers

What we do not claim

We would rather be straight with you than impressive. Syntra is a small, focused product: we hold no SOC 2 report, have not commissioned a third-party penetration test, and do not offer a contractual uptime guarantee. What is written above is what is actually built and actually tested. If your IT reviewer needs something specific, ask — we will answer honestly about what exists and what does not.

Reporting a vulnerability

If you believe you have found a security problem, email hello@syntrahealthanalytics.com with enough detail to reproduce it. We will acknowledge you, keep you posted while we fix it, and credit you if you would like. Please give us a reasonable chance to fix it before publishing, and do not access or alter anyone else's data while testing.