Our clients trust us with software their businesses depend on and with data that is often sensitive. Tax records, financial plans, member data, and business correspondence all deserve care. Security is part of every phase of our work rather than a final checklist.
In the systems we build
- Designed in, not bolted on. Security boundaries, data flows, and access models are part of architecture and design reviews, before implementation starts.
- Least privilege by default. People, services, integrations, and AI agents get only the access they need. Roles and assignments are explicit.
- Strong authentication. We favor single sign-on and multi-factor authentication for administrative access and, where appropriate, for every user.
- Reviewed changes. Code changes go through review and automated tests, and preview deployments let clients see changes before they reach production.
- Quality gates before launch. Launches are gated by security, accessibility, and performance checks.
- Recoverable operations. Backups, recovery runbooks, and restore testing are part of how we run systems after launch.
In our products
Each product publishes how it is built to protect its users. For example, Zacello enforces two-factor sign-in for every account, separates firm data with row-level security, keeps an audit trail the application cannot alter, and scans uploads for malware. IVOKER opens only in a signed desktop app with registered computers and authenticator codes, and requires approval before mail is sent. PursuitBid enforces organization and entity permissions and preserves the records behind every report.
These descriptions explain how the products are built. They are not third-party certifications.
With client information
- We ask clients not to send sensitive records through public forms and agree a secure channel for sharing them.
- Access to client systems is scoped to the engagement and removed when it ends.
- Remediation and infrastructure changes are authorized in writing before they are made.
- AI systems we build keep a person in the loop for consequential actions and log what they do.
For regulated clients
Many of our clients have their own obligations, such as tax professionals under the FTC Safeguards Rule. We help implement and document the technical safeguards those obligations describe, including access controls, MFA, encryption, monitoring, and incident response. Each client remains responsible for its own compliance program. See our WISP checklist and cybersecurity services.
Reporting a vulnerability
If you believe you have found a security vulnerability in syntonyl.com or one of our products, please tell us through the contact form and choose “Cybersecurity & Resilience” as the service. Include enough detail for us to reproduce the issue, but please do not include sensitive data in the form. Give us reasonable time to investigate and fix the issue before disclosing it. Please do not access, modify, or delete data that is not yours, and do not degrade the service for others. We appreciate good-faith reports and will respond promptly.