Security at Syro
At Syro, we take the responsibility of managing our clients' infrastructure seriously, as we recognize the trust they put in us. We uphold high standards of security, not only for our technology solutions but also in our daily operational procedures and access controls. Our team continually improves our security so you can use Syro with confidence.
Organizational Security
- Robust Unit Testing
- Syro prioritizes rigorous unit testing at each step of the development process.This commitment enhances code stability, aids in early error detection, and fosters the creation of dependable and efficient software products.
- Secure Development Lifecycle (SDLC)
- Syro integrates security throughout the software development lifecycle, from design and coding to testing and maintenance, to deliver secure and reliable software products.
- Third-Party Penetration Testing
- Syro engages independent third-party services to conduct penetration testing, which evaluates our security and compliance measures on a routine basis.
- Confidentiality
- Before their first day of work, every team member must sign an industry standard confidentiality agreement and commit to following its terms.
- Security Awareness Training
- All employees at Syro undergo security awareness training within thirty (30) days of onboarding and at least annually thereafter.
- Product Access Control
- Syro grants a select group of employees regulated access to products. This safeguards security protocols, enables swift response to potential incidents, and supports efficient problem resolution and customer service. Multi-factor authentication (MFA) is also an important part of our layered defense to protect access control systems.
Cloud Infrastructure Security
- Cloud Infrastructure Security
- Syro utilizes Amazon Web Services(AWS) as its cloud platform, benefiting from AWS's stringent security measures and compliance norms pertaining to physical data center protection and cloud system reliability. Details of AWS Cloud Security can be found here.
- Encryption in Transit
- Your secrets are end-to-end symmetrically encrypted using 256-bit AES encryption in Galois/Counter Mode. Syro supports encryption in transit using Transport Layer Security. All network traffic to/from our servers is protected by TLS v1.2.
- Encryption at Rest
- Your secrets are encrypted at rest with 256 - bit AES encryption in Cipher Block Chaining mode via OpenSSL.
- Data Hosting
- Your data is hosted on Amazon Web Services(AWS), which handles physical security to data centers.These data centers are located in the United States.
- Security Awareness Training
- All employees at Syro undergo security awareness training within thirty(30) days of onboarding and at least annually thereafter.
- Threat and Vulnerability Scanning
- Syro utilizes multiple monitoring and threat detection systems to identify and alert on incidents.
- Email Protection
- We have DMARC, DKIM and SPF records in place, targeting syro.com, in order to prevent email spoofing.
- Logging and Monitoring
- Syro utilizes a Security Information and Event Management (SIEM) solution to process and manage logs from critical systems.This tool enables comprehensive logging and alert capabilities, ensuring prompt notification of security events as they occur.These logs also aid in troubleshooting and support tasks.Access to these logs is strictly controlled.
- Backups
- Your data is encrypted and backed up by MongoDB Atlas. Syro backs up your data hourly with a retention time of a week. Syro also performs weekly backups with a retention time of 2 months. Our backups are isolated from our system because they are performed by mongoDB. They are stored in the same datacenter as our server instance.
Compliance
Syro has procured certifications from independent third-party auditors in line with the American Institute of Certified Public Accountants' (AICPA) Service Organization Control (SOC) standards: SOC2 Type 1 and ISO 27001*
- SOC2 Type I and Type II (in progress)
- This is an audit conducted by an independent third party, certified by the American Institute of Certified Public Accountants (AICPA). It examines a service organization's compliance with Trust Services Criteria (TSC) controls. The SOC 2 Type I and Type II report evaluates the effectiveness of these controls at a discrete point in time and over time, offering customers and stakeholders confidence that the organization has robust controls in place to safeguard their data.
- ISO 27001 (in progress)
- This international standard sets the benchmark for information security management.It defines the framework for creating, implementing, managing, and enhancing an Information Security Management System(ISMS).Designed to help organizations employ a risk management approach, this standard ensures the protection and secure management of sensitive data.
Report an Issue
If you believe you’ve discovered a bug in Syro’s security, please contact us at security@syro.com and we will get back to you within 24 hours or sooner. Our PGP key is available below in case you need to encrypt your communications with our team. We kindly request that you not publicly disclose the issue until we have had the chance to address it.