Security & Trust

Synarch connects to your email and calendar through Google OAuth, the same credential layer that apps like Slack, Zapier, and thousands of others use. We request only the scopes we need to provide value:

• Gmail read & compose: To classify inbox messages and place drafts (not send)
• Google Calendar: To see meetings, decline misaligned ones, and book deep work
• Google Tasks: To sync your task list and schedule task execution
• GitHub webhooks: To ingest commit metadata (you control which repos)

We do not request access to your Drive, Contacts, or Payments. We do not request full account control ("Do Not Disturb"). You can see exactly what permissions you've granted in your Google Account settings at any time.

You retain absolute control. From your Synarch account settings, you can disconnect any OAuth integration (Gmail, Calendar, GitHub, etc.) in one click. When you disconnect:

• Synarch immediately stops requesting new data
• All autonomy features (auto-reply, calendar management) pause
• The OAuth token is deleted from our database
• Your historical data remains on file for reference

You can reconnect and resume at any time. No friction, no phone call required.

When you first connect Gmail or Google Calendar, Synarch runs in pure shadow mode: it watches your inbox and calendar, classifies everything, and suggests actions — but it never touches anything. No emails sent, no meetings declined, no calendars modified.

After you've seen a week of accurate classifications and suggestions, you can opt into the next tier: drafting. Synarch places email drafts in your Gmail and you decide to send or discard. After you're confident in those drafts, you can opt into sending autonomy. Each tier requires your explicit approval.

Result: You earn trust in Synarch before giving it power. No surprise sends, no unauthorized calendar changes.

Your Google and GitHub OAuth tokens (the credentials that grant Synarch access) are:

• Encrypted at rest: Stored in our database encrypted with AES-256
• Never logged: We never write tokens to application logs or error traces
• Encrypted in transit: All communication from your device to Synarch is HTTPS/TLS 1.3+
• Rotated automatically: Refresh tokens are rotated on each use

Even if Synarch's database were compromised, tokens would be unreadable. Google and GitHub detect token misuse patterns and will notify you if unauthorized access is detected.

Synarch has three proven security features built into every action:

Synarch is AI-powered. Sometimes it will misclassify an email or decline a meeting it shouldn't have. When that happens, you can report it:

• Click "Report Problem" in the Synarch brief or settings
• Immediately, all of Synarch's autonomy is suspended — it reverts to suggest-only mode
• For 28 days, Synarch watches and recommends but never acts
• After 28 days, the issue is re-reviewed; if you confirm it's resolved, autonomy is restored
• If another problem occurs in those 28 days, the clock resets

Why 28 days? It's long enough to prove Synarch has learned from the mistake and won't repeat it, short enough that you're not stuck in a permanently limited state.

This mechanism is a security feature, not a limitation. It's your insurance policy.

This is the core of our privacy promise. When Synarch processes your email to generate a draft or classify a meeting:

• Your email content and calendar events are processed only by Anthropic's Claude API under a limited-use agreement
• That content is never used to train or improve Claude models accessed by other Synarch users
• Synarch maintains per-user tone profiles and sender models — not shared across users
• Your preferences, VIPs, and autonomy settings are entirely private to your account

We use cryptographic signing to prevent token theft and cross-account access. Every API call to external services is tagged with your user ID to prevent data leakage.

If Synarch makes a mistake: Click "Report Problem" in the app or email [HUMAN: support email address]. Include a description of what went wrong. This immediately locks Synarch into the 28-day recovery protocol above.

If you discover a security vulnerability: Please do not post it publicly. Email [HUMAN: security contact email] with details. We will investigate and patch within 72 hours, and credit you in our security changelog.

If you suspect unauthorized access: Disconnect the affected OAuth integration immediately from your account settings. Change your Synarch password. Email [HUMAN: support email address] and we will review your account logs for suspicious activity.

Synarch is built on infrastructure that complies with:

• HTTPS/TLS 1.3+ for all data in transit
• AES-256 encryption for OAuth tokens at rest
• SOC 2 Type II compliance for Vercel (hosting) and Neon (database)
• GDPR compliance for EU user data (privacy policy, right to deletion, data portability)
• No third-party analytics on public pages (auth/product analytics only for logged-in users)

Synarch is pursuing a voluntary security assessment (CASA Tier 2) to meet Google's requirements for restricted OAuth scopes. This assessment will validate our data handling practices against industry standards.

You can mark email addresses as VIPs (your investors, CEO, key clients, etc.). For VIPs:

• Synarch will never auto-decline a meeting from them, regardless of score
• Draft emails to VIPs always go to a secondary AI fact-check before being placed
• VIP emails never auto-receive responses — you see them first

This reduces the risk of misclassification damaging your most critical relationships.

Email [HUMAN: security contact email] with detailed questions about Synarch's security architecture, OAuth handling, data retention, or any other concerns.

For general support, email [HUMAN: support email address].

Mailing Address:
Synarch, Inc.
[HUMAN: street address]
[HUMAN: city, state, ZIP]
[HUMAN: country]