Security
- Row-level access rules enforced in the database, not only in the interface.
- Separate roles for patients, clinic staff, moderators, support, compliance and administrators.
- Append-only audit events for privileged reads and administrative changes.
- Security sign-off register in the admin workspace, with evidence state for each item.
Availability
- Response-state monitoring for clinic booking decisions.
- Workflow status board showing running, waiting and paused work.
- Release gates that record whether each milestone passed, failed or is blocked.
Confidentiality
- Private document storage with server-side ownership checks.
- Short-lived links, recorded openings and withdrawable shares.
- Clinic tenant separation, so one clinic can never read another's records.
Processing integrity
- Clinical wording is versioned; published and retired versions cannot be edited.
- Booking state changes are recorded with the person and time behind each one.
- AI answers are traced end to end, with the policy decisions and sources attached.
Privacy
- Purpose-specific consent records with withdrawal.
- Access, correction, export and deletion requests with statutory clocks.
- Personal identifiers redacted before any AI processing.
What we do not claim
SynQ has not been examined by an independent CPA firm, holds no SOC 2 Type I or Type II report, and does not present readiness as certification. When an examination is completed, the report reference will be published here rather than described.