The answers your IT, security, or legal team will ask for before signing — written plainly, no marketing.
Data and privacy
Who is the data controller?
Synova Digital Solutions SRL (CUIT 30-71890877-5), Av. Scalabrini Ortiz 1135, CABA, Argentina. Contact: desarrollo@synova.la.
Where is the data hosted?
On Supabase (database) and Vercel (application) infrastructure, us-east-1 region (US East, Northern Virginia).
Is my organization's data separated from other clients'?
Yes. Nobody from another company can see your data. BOS is multi-tenant with strict per-account isolation, enforced in the database with Row Level Security and an account-identification function that, if something fails, closes access instead of opening it (when in doubt, it denies). No account accesses another's data, not even through the AI assistant.
Do you sell or use our data for other purposes?
No. We act as data processors; operational data belongs to your organization and is used only to provide the service. There's no third-party sale or advertising.
What subprocessors are involved?
Vercel (hosting), Supabase (database/auth), Microsoft and Google (identity/OAuth), Resend (email), and Anthropic (AI assistant). The list is kept current on our Privacy Policy.
Do you comply with data protection regulations?
We process data under Argentina's Law 25.326 and, when applicable by user location, GDPR principles, under a shared responsibility model. We offer a DPA to clients who require one.
Authentication and access control
How are users authenticated?
They sign in with their Microsoft or Google account (corporate identity providers, via OAuth). Two-step verification (MFA) is enforced at the identity-provider level.
How is what each user can see controlled?
Each person sees and does only what their role allows. Technically, with role-based permissions enforced across four independent layers: middleware, API, database (RLS) and frontend, plus individual permissions for each user. Guiding principle: least privilege.
Is there privileged access or support impersonation?
Yes, and all of it is logged. Support can sign in as a user through controlled, audited impersonation: every action is recorded in the audit log.
Encryption
Does data travel encrypted?
Yes, all traffic uses HTTPS/TLS (1.2/1.3), with HSTS (preload) and forced HTTP-to-HTTPS redirection.
Is data encrypted at rest?
Yes, at the managed database level (Supabase).
Application security and secure development
What controls apply at the application level?
Protection against browser-based attacks and abuse. In detail: strict security headers (Content-Security-Policy; HSTS with preload; X-Frame-Options DENY and frame-ancestors 'none' anti-clickjacking; X-Content-Type-Options nosniff; Referrer-Policy; Permissions-Policy; object-src 'none'; base-uri 'self'; form-action 'self'), rate limiting on sensitive operations, and access validation on every endpoint.
How do you prevent a code change from breaking data isolation?
With automated checks that stop the change before it goes live. Our continuous integration automatically runs, on every change: per-account isolation linters that verify tenant_id coverage and RLS policy coverage at the data layer, a linter requiring every elevated-privilege query to filter by account, type checking, and build verification. A change that breaks isolation never reaches production.
Do you run security assessments?
Yes: code review before every deployment, the automated CI controls mentioned above, and continuous monitoring via our security agent. For enterprise clients who require it, we coordinate specific security assessments.
How do you manage secrets?
Credentials with elevated privileges live only on our servers (server-side) and are never exposed in the browser.
Monitoring, auditing, and incidents
Do you log activity?
Yes. Every write (create/edit/delete) is logged with author, date, and detail in an audit log.
Do you detect anomalous behavior?
Yes. An in-house security agent continuously analyzes activity (every few hours) and automatically alerts the responsible parties on: mass deletions, privilege escalation, impersonation, changes to sensitive data, access from multiple IPs, bulk edits, rapid-fire user creation, and audit-log tampering.
How do you notify a security incident?
In the event of an incident affecting personal data, we notify the affected clients and the relevant authority within 72 hours of confirmation.
Continuity and resilience
Do you run backups?
Yes, automatic database backups, with optional point-in-time recovery (PITR).
What availability do you offer?
We operate on high-availability infrastructure (Vercel + Supabase) with DDoS mitigation. We don't publish an SLA percentage except under a specific contractual agreement.
Compliance and certifications
Are you certified?
Our infrastructure providers are certified: Vercel (ISO 27001:2022, SOC 2 Type II) and Supabase (SOC 2 Type 2). BOS, as an application, doesn't claim those certifications for itself: it relies on them and adds its own application-level controls.
Do you handle health data (HIPAA)?
Not as part of the standard service. The data platform supports operating under HIPAA (add-on + BAA), but only for health use cases under a specific agreement.
BOS is a product of Synova Digital Solutions SRL (CUIT 30-71890877-5), Av. Scalabrini Ortiz 1135, Ciudad Autónoma de Buenos Aires, Argentina. For security or privacy inquiries: desarrollo@synova.la.