Security Policy & Practices

Last updated: August 17, 2026

Introduction & Commitment to Security

Synctile Ltd ("Synctile", "we", "us", or "our") provides a digital manufacturing planning and shop-floor scheduling platform. Precision machine shops, fabricators, and custom manufacturers rely on Synctile to manage critical production data, machine allocations, job cards, and delivery timelines. Protecting the confidentiality, integrity, and availability of customer operational data is foundational to how our platform is engineered and operated.

This Security Policy provides a transparent overview of our technical architecture, database isolation, encryption protocols, access controls, backup schedules, and incident response procedures. This document should be read in conjunction with our Terms of Service and Privacy Policy.

1. Cloud Infrastructure & Edge Network

Synctile is built on top of enterprise-grade, managed cloud infrastructure provided by Google Cloud Platform (GCP) and Firebase, paired with global edge delivery networks:

  • Managed Cloud Infrastructure: Backend application logic and real-time database operations run in Google Cloud's secure, ISO 27001, SOC 2, and SOC 3 compliant datacentres.
  • Global CDN & DDoS Protection: Web traffic and static assets are served through globally distributed edge content delivery networks equipped with automatic DDoS mitigation and origin shielding.
  • HTTP Security Headers: All web endpoints enforce strict HTTP security headers, including HTTP Strict Transport Security (HSTS with max-age=31536000; includeSubDomains; preload), X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and restrictive Content Security Policies (CSP) to eliminate clickjacking and script injection vectors.
  • Permissions Policy: Browsers are restricted by policy from granting access to sensitive device APIs (such as geolocation, camera, or microphone) within our application shells.

2. Multi-Tenant Data Isolation

Synctile operates a multi-tenant cloud architecture where customer data is strictly segregated at the data layer:

  • Organization-Scoped Data Hierarchy: All production boards, job cards, machine configurations, unassigned job pools, presence channels, and audit logs are strictly keyed under unique tenant Organization IDs (organizationId).
  • Database-Level Security Rules: Access boundaries are enforced at the Firestore database layer using declarative security rules. Every incoming database query and mutation is verified against the user's authenticated organization membership before execution.
  • Privilege Escalation Prevention: Security rules prevent client applications from modifying critical organization fields (such as subscription tiers, license keys, or trial periods) or altering user tenant assignments and assigned administrative roles.
  • Locked Server-Only Collections: Sensitive administrative collections—including licensing keys, rate limit records, and internal transactional mail queues—are completely closed to direct client read and write operations and can only be accessed by authenticated Cloud Functions via the Firebase Admin SDK.

3. Data Encryption

Customer data is encrypted at every stage of transmission and storage:

Encryption in Transit

All network traffic between user devices, our web portal, desktop applications, API endpoints, and cloud databases is encrypted using modern TLS (Transport Layer Security, TLS 1.2 and TLS 1.3). Unencrypted HTTP requests are automatically upgraded and redirected to HTTPS.

Encryption at Rest

All application data, operational records, real-time board states, and database backup snapshots stored within Google Cloud Firestore and Google Cloud Storage are encrypted at rest using industry-standard AES-256 encryption.

4. Authentication, Session Security & RBAC

Synctile employs multi-layered authentication controls and granular role-based access control (RBAC):

Authentication & Tokens

  • Secure Credential Handling: User passwords are never stored in plaintext and are hashed using modern cryptographic hashing algorithms managed by Firebase Authentication.
  • Short-Lived JSON Web Tokens: Authenticated sessions use digitally signed, short-lived ID tokens (JWTs) with automatic background token rotation via refresh tokens.
  • Single-Device Session Enforcement: To protect accounts against unauthorized concurrent usage, Synctile maintains active session identifiers with real-time listeners, gracefully terminating superseded sessions upon new logins.

Role-Based Access Control (RBAC)

User permissions within an organization are strictly partitioned according to business roles:

  • Admin (Owner): Full administrative control over organization settings, billing, subscription management, user invites, role assignments, board creation, and data export.
  • Manager (Planner): Shop-floor planning permissions to create and configure boards, schedule jobs, manage machines, assign T-cards, and inspect revision history.
  • Operator / Viewer: Read-only access to assigned production boards and scheduling views, preventing unauthorized modifications to job status or machine queues.
  • Kiosk Mode: Dedicated read-only factory floor presentation mode designed for shop-floor display screens, with access to account configuration and profile management completely locked out.

5. Application & Desktop Client Security

Synctile is available both as a modern web application and as a native Windows desktop / shop-floor application. Security controls in our client software include:

  • Process Sandboxing: The Windows desktop application is built with strict renderer sandboxing, context isolation enabled (contextIsolation: true), and Node.js integration disabled (nodeIntegration: false) in web views.
  • External Protocol Whitelisting: Window creation and external navigation events are validated and allowlisted strictly to secure protocols (https:, mailto:), preventing unauthorized local file or SMB protocol executions.
  • Cryptographic Update Verification: Desktop auto-updates are transferred over secure HTTPS connections, validated, and verified against SHA-256 cryptographic hashes before execution.
  • Offline Resilience: Local cache operations in our desktop and web clients utilize transactional IndexedDB persistence, ensuring secure synchronization when network connectivity fluctuates on the shop floor.

6. Payment & Financial Data Security

All payment processing and subscription billing for Synctile is handled by Stripe:

  • PCI-DSS Compliance: Payment card processing is certified to PCI-DSS Level 1 (the highest standard in the payments industry).
  • Zero Cardholder Data Storage: Credit card numbers, expiration dates, and CVVs never pass through or get stored on Synctile servers.
  • Cryptographic Webhook Verification: Billing webhooks sent from Stripe to Synctile Cloud Functions are validated using cryptographic signature checks (stripe.webhooks.constructEvent) and processed idempotently to prevent replay attacks.

7. Automated Backups & Disaster Recovery

We maintain comprehensive backup and disaster recovery procedures to safeguard manufacturing operations against accidental data loss or cloud disruptions:

  • Automated Daily Cloud Backups: Automated Cloud Functions execute full database backups every 24 hours, exporting Firestore collections to Google Cloud Storage.
  • Failure Monitoring & Alerting: Backup executions are logged and monitored, with automated failure alerts dispatched for immediate engineering investigation.
  • Board Revision Snapshots: Live boards capture revision snapshots on critical updates, allowing organization planners to review historical board states.
  • Tier-Based History Retention: Audit logs and board histories are maintained according to plan retention schedules (ranging from 30 days on Workshop plans up to unlimited history on Factory tiers) and pruned via automated background jobs.

8. Abuse Prevention, Rate Limiting & Audit Logging

To maintain platform resilience and accountability:

  • API Rate Limiting: Public and sensitive backend endpoints (such as account activation and invitation triggers) are guarded by transactional rate limiting to defend against brute-force and credential-stuffing attacks.
  • PII Sanitization: Server-side logs automatically mask personally identifiable information (such as email addresses) before logging operational data.
  • Tamper-Evident Audit Trails: Key lifecycle events—including board creation, deletion, member permission updates, and organizational configuration changes—are logged into dedicated tenant audit subcollections for customer oversight.

9. Incident Response & Breach Notification

In the event of a confirmed security incident affecting customer data, Synctile executes a documented incident response procedure:

  • Immediate Containment & Forensics: Our team acts immediately to isolate affected services, contain threats, and determine root causes.
  • Customer Notification: We will notify affected organization administrators by email without undue delay, providing details regarding the nature of the event, affected data scope, and remedial actions taken.
  • Regulatory Compliance: We fulfill all statutory breach notification obligations under UK GDPR and the Data Protection Act 2018, including notifying the UK Information Commissioner's Office (ICO) within 72 hours where legally required.

10. Internal Access Controls & Operational Security

We enforce strict internal access governance for all personnel and operational systems:

  • Principle of Least Privilege: Production environment access is restricted strictly to authorized engineering personnel who require access for system maintenance.
  • Multi-Factor Authentication (MFA): MFA is required on all internal accounts, code repositories, cloud consoles, and administrative dashboards.
  • No Unauthorized Access to Customer Data: Synctile personnel will never view or interact with a customer's proprietary job cards, CAD references, or schedule data unless explicitly authorized by the customer for troubleshooting or technical support.

11. Responsible Vulnerability Disclosure

We welcome reports from security researchers and users who have identified potential vulnerabilities in Synctile services. If you believe you have discovered a security flaw, please notify us responsibly:

When submitting a vulnerability report, please include:

  • A clear summary of the issue and potential impact.
  • Step-by-step instructions or proof-of-concept to reproduce the behavior.
  • Any relevant screenshots, network request payloads, or system details.

We ask that you allow us reasonable time to investigate and remediate the issue before publicly disclosing any details, and refrain from accessing or modifying other users' data without authorization.

12. Contact Information

If you have questions regarding this Security Policy, our data protection practices, or compliance documentation, please reach out to us: