Back to SynQ

Trust services criteria

SOC 2 readiness

SynQ keeps a live evidence register against the five SOC 2 trust services criteria. This is readiness work in the open — an examination by an independent firm has not been carried out.

Security

  • Row-level access rules enforced in the database, not only in the interface.
  • Separate roles for patients, clinic staff, moderators, support, compliance and administrators.
  • Append-only audit events for privileged reads and administrative changes.
  • Security sign-off register in the admin workspace, with evidence state for each item.

Availability

  • Response-state monitoring for clinic booking decisions.
  • Workflow status board showing running, waiting and paused work.
  • Release gates that record whether each milestone passed, failed or is blocked.

Confidentiality

  • Private document storage with server-side ownership checks.
  • Short-lived links, recorded openings and withdrawable shares.
  • Clinic tenant separation, so one clinic can never read another's records.

Processing integrity

  • Clinical wording is versioned; published and retired versions cannot be edited.
  • Booking state changes are recorded with the person and time behind each one.
  • AI answers are traced end to end, with the policy decisions and sources attached.

Privacy

  • Purpose-specific consent records with withdrawal.
  • Access, correction, export and deletion requests with statutory clocks.
  • Personal identifiers redacted before any AI processing.

What we do not claim

SynQ has not been examined by an independent CPA firm, holds no SOC 2 Type I or Type II report, and does not present readiness as certification. When an examination is completed, the report reference will be published here rather than described.