Security & Data Protection

1. Infrastructure & Cloud Hosting

Sytira’s production infrastructure is hosted in enterprise-tier, certified data centers located in the European Union (EU) on ISO 27001, SOC 1, SOC 2 Type II, and PCI DSS Level 1 compliant cloud infrastructure.

---

2. Encryption at Rest & in Transit

We treat every message, attachment, customer identifier, and token with state-of-the-art cryptographic safeguards:

• In Transit: All HTTP and WebSocket connections strictly require TLS 1.3 (with TLS 1.2 fallback). HSTS (HTTP Strict Transport Security) is enforced with preloading. Insecure HTTP connections are automatically redirected.
• At Rest: Customer databases, encrypted cache stores, and persistent attachments are encrypted using industry-standard AES-256 encryption.
• Token Cryptography: Channel credentials, WhatsApp access tokens, Meta app secrets, and payment keys are encrypted at the application layer with authenticated envelope encryption prior to persisting to storage.

---

3. Multi-Tenant Data Isolation

Sytira enforces strict logical data isolation between customer workspaces. All queries across conversations, contacts, inboxes, canned responses, and analytics are scoped at the application and database query layer to the authenticated account_id.

Cross-tenant data leakage is prevented via automated security integration suites, role-based authorization gates, and strict request-boundary sanitization.

---

4. Authentication & Access Control

We provide robust controls to safeguard team access:

• Role-Based Access Control (RBAC): Granular workspace permissions distinguish between Administrators, Team Agents, and Super Admins.
• Two-Factor Authentication (2FA): Support for time-based one-time password (TOTP) two-factor authentication.
• Session Management: Secure, HTTP-only, SameSite cookies with automated expiration and instant revocation upon sign-out.
• Single Sign-On (SAML / SSO): Enterprise tier accounts can integrate SAML 2.0 / Okta / Google Workspace SSO for centralized provisioning and de-provisioning.

---

5. Sytira AI Security Standards

Sytira AI assists customer support teams with message summarization, tone enhancement, and automated FAQ responses.

---

6. Official Meta WhatsApp Security

Sytira connects directly to Meta's official WhatsApp Business Cloud API. Unlike unauthorized WhatsApp web scraping hacks or unofficial QR tools:

• All messaging webhooks are cryptographically validated against Meta’s X-Hub-Signature-256 HMAC signatures before being accepted.
• Messages travel through Meta’s verified endpoints with end-to-end transport encryption.
• Your WhatsApp Business accounts remain 100% compliant with Meta Business terms, eliminating ban risks.

---

7. Compliance & Certifications

Sytira is built to comply with international data protection standards:

• GDPR (General Data Protection Regulation): EU data residency, Data Processing Agreements (DPA), one-click contact data export, and complete "Right to Be Forgotten" erasure workflows.
• CCPA (California Consumer Privacy Act): Complete transparency regarding data categories, with zero sale of personal information.
• Payment Security (PCI DSS): All credit card processing is handled directly by Stripe. Sytira never stores, receives, or transmits raw credit card numbers.

---

8. Backups & Disaster Recovery

Production databases are continuously backed up with point-in-time recovery (PITR) enabling restoration to any second in the preceding 7 days. Automated daily snapshots are encrypted and replicated across independent availability zones.

Our infrastructure maintains automated health checks, self-healing processes, and zero-downtime rolling deployments.

---

9. Vulnerability Management

We run automated dependency vulnerability scanning, static code analysis, and continuous security testing in our deployment pipelines. Operating system dependencies and application runtime stacks are regularly patched.

---

10. Responsible Disclosure & Security Contact

We welcome reports from security researchers and customers who discover potential vulnerabilities. We commit to acknowledging reports within 24 hours and keeping you informed as issues are resolved.