Syntic is building for a global economy. We approach privacy, security and regulation with the ambition to serve businesses across borders, and the discipline to assess what each jurisdiction requires. Explore the frameworks that matter to your market, then talk to us about today's capabilities and tomorrow's roadmap.
Three questions guide every regional discussion: where data is handled, which obligations apply, and which legal entity contracts with the customer. Availability and safeguards are confirmed for each engagement.
Where your data is stored and processed. Data residency and deployment requirements are scoped with our team as part of your engagement. Tell us what your jurisdiction requires, and we will tell you plainly what we can support today.
Which laws and frameworks apply to your deployment. HIPAA for US healthcare, GDPR for the EU, UK GDPR and DPA 2018, PIPEDA in Canada, DPDP Act in India, Privacy Act in Australia, and LGPD in Brazil, plus industry-specific frameworks like FDCPA, GLBA, FERPA, PCI DSS, and SR 11-7. Requirements are scoped per engagement. SOC 2 Type I, SOC 2 Type II and ISO 27001 are planned milestones, not completed assessments. No FedRAMP authorization is claimed.
Which Syntic legal entity holds your contract and processes your data under it. Different jurisdictions require different contracting structures — local data processor, local controller, joint-controller arrangements, intra-group data transfer agreements, and local incorporation requirements. We adapt the contracting structure to your jurisdiction's requirements, not the other way around. Where we don't yet have a local entity, we partner with established local entities for contracting, billing, and data handling. The current entity structure is in the Contracting section below.
If your jurisdiction isn't listed, contact privacy@syntic.ai and we'll tell you plainly what we can support today.
The following frameworks help shape our discussions with regulated organizations. Their inclusion does not mean Syntic is certified, authorized or compliant with every requirement listed.
Cross-border processing requires a clear understanding of data flows, applicable law and contractual safeguards. No particular residency arrangement is guaranteed without review.
The legal contracting party and any regional arrangements are confirmed in the applicable customer agreement.
Talk with our team about available documentation, contractual requirements and the diligence appropriate to your deployment.
Data residency, regulator requests, and emerging AI frameworks.
Talk to our team about your data residency and deployment requirements. We will tell you plainly what we can support today and what is not yet available.
We require proper legal process — a court order, subpoena, or equivalent legal instrument in the relevant jurisdiction — before complying with any government or law enforcement request for customer data. We do not voluntarily disclose customer data to any authority. Where the law permits us to notify the customer before complying, we do so. Where we cannot notify, we log the request. We publish aggregate government request counts in our annual transparency report. If you receive notice of a legal process requiring your data from Syntic, contact privacy@syntic.ai immediately.
Contact privacy@syntic.ai with your jurisdiction. If we can support your jurisdiction today, we'll tell you that. If we can't yet, we'll tell you that honestly and give you a realistic timeline.
Syntic AI is scoping compliance with the EU AI Act aligned to its phase-in timeline. The AI Act classifies AI systems by risk category — the majority of Syntic's use cases fall in the limited or minimal risk categories. Where Syntic deployments touch higher-risk categories — certain HR use cases, some public sector deployments, and some healthcare applications — we are documenting conformity requirements and will publish our approach as the relevant provisions enter force. Our clinician-in-the-loop framing for healthcare and our human-in-the-loop platform controls for high-stakes decisions are designed to be consistent with the Act's requirements for human oversight. Contact privacy@syntic.ai for EU AI Act scoping on your specific deployment.
Talk to our team about deployment requirements. Government and regulated-industry engagements are scoped individually, and we will tell you plainly what we can support today.
We monitor regulatory developments in the jurisdictions we serve and update our compliance posture as frameworks finalize. Customer-facing changes are communicated 30 days in advance for Business and Enterprise.
Most regulatory requirements are scopable into our existing framework. Contact privacy@syntic.ai with your specific framework and we'll assess fit and propose a path.
Every compliance engagement starts with a conversation. Tell us where you operate, what industry you're in, and what frameworks your procurement or legal team requires. We will scope what we have today, what's in progress, and what we'd need to build for your specific deployment.
