1. Who we are
CYNAPSE is a cyber-assurance platform operated by Cynapse (“Cynapse”, “we”, “us”, or “our”). The platform brings together governance, risk and compliance (RABUILD GRC), exposure and vulnerability analysis (Exposure Engine), the Navai intelligent navigator, the Academy, and the Community.
We are committed to handling personal data lawfully, fairly, and transparently, and to applying the same security discipline to our own platform that we help our customers apply to theirs.
2. Scope and our role
This policy applies to personal data we process when you:
- browse our public website at cynapse.app;
- submit a contact, demo, or access request;
- register for, sign in to, or use the CYNAPSE platform, the Academy, or the Community; or
- deploy a CYNAPSE agent (such as the Exposure Engine agent) in an environment you control.
Customer data. When an organization uses CYNAPSE to manage its own projects, assets, risks, controls, evidence, scan results, and reports, that organization decides what data is entered and why. For that content Cynapse acts as a data processor (service provider) on the organization’s behalf and processes it only under the organization’s instructions and our agreement with it. If you are an individual whose information appears in a customer’s workspace, please contact that organization first; we will support them in responding to you.
For website visitors, people who contact us, and account holders’ own account information, Cynapse acts as the data controller.
3. Data we collect
| Category | Examples |
|---|---|
| Account and identity data | Full name, business email address, organization, job role, optional telephone and mobile numbers, selected products and plan, and account preferences. |
| Authentication data | Password (stored only as a salted one-way hash, never in readable form), email verification and one-time passcode records, and multi-factor authentication settings. |
| Enquiry data | Name, business email, organization, subject, topic, requested product, and the message you send through our contact, demo, or access forms or by email. |
| Platform content | Information you or your organization enter or upload, such as projects, facilities, systems, assets, risks, controls, evidence files, assessments, comments, reports, Academy progress and certificates, and Community posts and profile details. |
| Agent and scan data | When an authorized user deploys a CYNAPSE agent, technical information from the systems it is installed on or instructed to assess, such as host name, operating system, installed software and versions, running services, open ports, network and device discovery results, IoT protocol detection, security events, and log records. |
| Technical and security data | IP address, browser and device type, pages requested, date and time, session activity, request timing, sign-in history, rate-limiting events, and audit-trail records of actions taken in the platform. |
| Commercial data | Plan tier, licence and entitlement records, and correspondence needed to quote, invoice, and support your subscription. We do not collect payment card details through the website. |
We collect this data directly from you, from your organization when it invites you or provisions your account, from agents your organization deploys, and automatically from your use of our website and platform. We do not buy personal data and we do not use third-party advertising or behavioral tracking tools.
4. How we use data
- Provide the service — create and verify accounts, authenticate users, run the modules your organization is licensed for, generate reports and certificates, and deliver agent and scan results.
- Protect the service — secure sign-in, enforce multi-factor authentication and role-based access, detect and prevent abuse, fraud, and unauthorized access, apply rate limits, and keep audit trails.
- Communicate with you — send verification codes, invitations, security and account notices, responses to your enquiries, and service announcements. Where we send optional product news, you can opt out at any time.
- Support and improve — troubleshoot problems, respond to support requests, monitor availability and performance, and improve the reliability and usability of the platform.
- Manage our business — administer licences and subscriptions, issue quotes and invoices, and keep records required for accounting and tax purposes.
- Meet legal obligations — comply with applicable law, respond to lawful requests from authorities, and establish, exercise, or defend legal claims.
We do not sell personal data, and we do not use customer content to train general-purpose artificial intelligence models.
5. Legal bases for processing
Where data protection laws such as the EU/UK GDPR or comparable regional laws apply, we rely on the following legal bases:
- Contract — to provide the platform and the services you or your organization have requested.
- Legitimate interests — to secure our systems, prevent abuse, respond to business enquiries, and improve our services, balanced against your rights and expectations.
- Legal obligation — to keep records and respond to lawful requests.
- Consent — where we ask for it, for example for optional communications. You may withdraw consent at any time without affecting prior processing.
7. AI-assisted features
Certain features, such as the Navai intelligent navigator and AI-assisted assessment review, use large language models to generate guidance. When you use these features, the prompt you submit and the relevant context needed to answer it may be processed by our AI inference provider or by models hosted on Cynapse-controlled infrastructure.
- AI providers process this data only to return a response to us and are not permitted to use it to train their models.
- AI-generated output is advisory. It should be reviewed by a qualified person before being relied on for security, compliance, or safety decisions.
- Avoid entering secrets, passwords, or unnecessary personal data in AI prompts.
9. International data transfers
Our service providers may process data in countries other than the one where you are located. Where data is transferred internationally, we take steps to ensure it receives an appropriate level of protection, such as contractual safeguards (including standard contractual clauses where required) and supplier security assessments. Customers with specific data residency requirements may contact us to discuss available options.
10. Data retention
- Account data is kept for as long as your account is active and for a limited period afterwards to meet legal, accounting, and dispute-resolution needs.
- Platform content and agent data are kept for the duration of the customer’s subscription and are deleted or returned in accordance with the customer agreement after it ends.
- Enquiry data is kept for as long as needed to respond and to manage any resulting business relationship.
- Security logs and audit trails are kept for a limited period appropriate to their security, investigation, and compliance purposes.
- Backups are retained on a rolling schedule and are overwritten in the normal course of operation.
When data is no longer needed, we delete it or anonymize it so that it can no longer be associated with you.
11. How we protect data
We apply administrative, technical, and organizational safeguards designed for the environments our customers operate in, including:
- encryption in transit using TLS with HTTP Strict Transport Security;
- salted one-way password hashing, strong password requirements, and multi-factor authentication (mandatory for administrators);
- organization-level tenant isolation, role-based access control, and the principle of least privilege;
- audit logging of security-relevant actions, session controls, and rate limiting against automated abuse;
- hardened security headers, including a Content Security Policy, and regular security testing and dependency review; and
- regular backups and documented recovery procedures.
No method of transmission or storage is completely secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities where required by law.
12. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy of it;
- correct inaccurate or incomplete data;
- request deletion of your data;
- restrict or object to certain processing;
- receive your data in a portable, machine-readable format;
- withdraw consent where processing is based on consent; and
- lodge a complaint with your local data protection authority.
Self-service tools
Signed-in users can download a copy of their personal account data in machine-readable (JSON) format and submit an account deletion request directly from their account settings. Deletion requests are reviewed by our team so that records shared with your organization, such as project ownership and audit history, are handled correctly; we will confirm completion at your account email address.
To exercise any other right, email support@cynapse.app. We will respond within the period required by applicable law, and may need to verify your identity before acting on your request. We will not discriminate against you for exercising your rights.
13. Children
CYNAPSE is a business service intended for professionals. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
14. Changes to this policy
We may update this policy to reflect changes in our services, technology, or legal requirements. We will post the updated version on this page and change the “Last updated” date. Where changes are material, we will provide additional notice, such as an email to account holders or a notice in the platform, before they take effect.
15. Contact us
If you have questions about this policy or how we handle personal data, please contact:
Cynapse — Privacy
Email: support@cynapse.app
Web: cynapse.app/contact
To report a security vulnerability, please see our security.txt.