The answers your IT, security, or legal team will ask for before signing — written plainly, no marketing.
Data and privacy
Who is the data controller?
Synova Digital Solutions SRL (CUIT 30-71890877-5), Av. Scalabrini Ortiz 1135, CABA, Argentina. Contact: desarrollo@synova.la.
Where is the data hosted?
On Supabase (database) and Vercel (application) infrastructure, us-east-1 region (US East, Northern Virginia).
Is my organization's data separated from other clients'?
Yes. BOS is multi-tenant with strict per-account isolation, enforced at the database level with Row Level Security and a fail-closed account-identification function (when in doubt, it denies). No account accesses another's data, not even through the AI assistant.
Do you sell or use our data for other purposes?
No. We act as data processors; operational data belongs to your organization and is used only to provide the service. There's no third-party sale or advertising.
What subprocessors are involved?
Vercel (hosting), Supabase (database/auth), Microsoft and Google (identity/OAuth), Resend (email), and Anthropic (AI assistant). The list is kept current on our Privacy Policy.
Do you comply with data protection regulations?
We process data under Argentina's Law 25.326 and, when applicable by user location, GDPR principles, under a shared responsibility model. We offer a DPA to clients who require one.
Authentication and access control
How are users authenticated?
Via corporate identity providers (Microsoft and Google) through OAuth. Two-factor verification (MFA) is enforced at the identity-provider level.
How is what each user can see controlled?
With role-based access control (RBAC) enforced across four independent layers: middleware, API, database (RLS), and frontend, plus individual per-user permissions. Guiding principle: least privilege.
Is there privileged access or support impersonation?
Support can operate via controlled, audited impersonation: every action is logged in the audit trail.
Encryption
Does data travel encrypted?
Yes, all traffic uses HTTPS/TLS (1.2/1.3), with HSTS (preload) and forced HTTP-to-HTTPS redirection.
Is data encrypted at rest?
Yes, at the managed database level (Supabase).
Application security and secure development
What controls apply at the application level?
Strict security headers (Content-Security-Policy; HSTS with preload; X-Frame-Options DENY and frame-ancestors 'none' anti-clickjacking; X-Content-Type-Options nosniff; Referrer-Policy; Permissions-Policy; object-src 'none'; base-uri 'self'; form-action 'self'), rate limiting on sensitive operations, and access validation on every endpoint.
How do you prevent a code change from breaking data isolation?
Our continuous integration automatically runs, on every change: per-account isolation linters that verify tenant_id coverage and RLS policy coverage at the data layer, a linter requiring every elevated-privilege query to filter by account, type checking, and build verification. A change that breaks isolation never reaches production.
Do you run security assessments?
Yes: code review before every deployment, the automated CI controls mentioned above, and continuous monitoring via our security agent. For enterprise clients who require it, we coordinate specific security assessments.
How do you manage secrets?
Privileged credentials are kept exclusively server-side; they are never exposed to the client.
Monitoring, auditing, and incidents
Do you log activity?
Yes. Every write (create/edit/delete) is logged with author, date, and detail in an audit log.
Do you detect anomalous behavior?
Yes. An in-house security agent continuously analyzes activity (every few hours) and automatically alerts the responsible parties on: mass deletions, privilege escalation, impersonation, changes to sensitive data, access from multiple IPs, bulk edits, rapid-fire user creation, and audit-log tampering.
How do you notify a security incident?
In the event of an incident affecting personal data, we notify the affected clients and the relevant authority within 72 hours of confirmation.
Continuity and resilience
Do you run backups?
Yes, automatic database backups, with optional point-in-time recovery (PITR).
What availability do you offer?
We operate on high-availability infrastructure (Vercel + Supabase) with DDoS mitigation. We don't publish an SLA percentage except under a specific contractual agreement.
Compliance and certifications
Are you certified?
Our infrastructure providers are certified: Vercel (ISO 27001:2022, SOC 2 Type II) and Supabase (SOC 2 Type 2). BOS, as an application, doesn't claim those certifications for itself: it relies on them and adds its own application-level controls.
Do you handle health data (HIPAA)?
Not as part of the standard service. The data platform supports operating under HIPAA (add-on + BAA), but only for health use cases under a specific agreement.
BOS is a product of Synova Digital Solutions SRL (CUIT 30-71890877-5), Av. Scalabrini Ortiz 1135, Ciudad Autónoma de Buenos Aires, Argentina. For security or privacy inquiries: desarrollo@synova.la.