Trust & Security

Last updated: November 10, 2026

Gynergy exists to help you transform. That only works if you trust us with your data — your coaching conversations, your goals, your health metrics, and (if you choose) your financial accounts. This page is the plain-English version of how we handle that responsibility.

If something here is unclear or missing, email privacy@gynergy.com. If you find a security issue, email security@gynergy.com.

Our commitments

Transparency over jargon. We tell you what we collect, why, and who processes it. You'll find the full list below.
Your data, your call. Ask for a copy of everything we hold about you, or for its deletion, at any time by emailing privacy@gynergy.com. We answer within 30 days. You can also close your account yourself in Account Settings.
72-hour breach notice. If something happens that affects your data, we will tell you within 72 hours of confirmation — not 60 days later when regulation requires it.
No surprise sub-processors. The list on this page is it. When we add someone, we update this page before the change goes live.
Your coaching data isn't training data. We do not sell your data. Your conversations with ARIA are not used to train third-party AI models — we use zero-retention API endpoints where available and disclose the posture below. One thing we do share, and name: our websites send Meta the pages you visit and your application events so we can measure our own ads, unless you opt out. The privacy policy lists exactly what.

Evidence and documents

The artifacts a Third-Party Risk Management (TPRM) team will ask for, with honest status and a clear path to each one. Public artifacts link directly; NDA-gated artifacts list the request workflow.

Attestations

SOC 2 Type I readiness
In progress
SOC 2 readiness is in progress — not certified; the formal audit aligns with our first enterprise contract. Readiness work to date: a control-evidence map with its gap roadmap, shared under NDA; continuous-monitoring tooling under evaluation (Vanta, Drata, SafeBase).
Email security@gynergy.com for the SOC 2 Control-Evidence Map (AICPA 2017 TSC, with 2022 Points of Focus) under NDA.
SOC 2 Type II
Planned
Type II observation window begins after Type I report. Twelve months of evidence collection follows. We do not pre-commit to a Type II date until Type I is in hand — pre-committing to dates we cannot guarantee burns trust.
Email security@gynergy.com to discuss our Type II roadmap and how it aligns with your procurement cycle.

Security questionnaires

CAIQ v4 Responses
Available under NDA
Cloud Security Alliance Consensus Assessments Initiative Questionnaire (CAIQ v4) — responses drafted and provided to enterprise procurement under NDA. Not yet submitted to the CSA STAR Level 1 registry.
Email security@gynergy.com with your NDA template (or ours, on request) and the CAIQ will follow within one business day.
SIG Lite Responses
Available under NDA
Shared Assessments Standardized Information Gathering (SIG Lite) — full responses available. We can also respond to a full SIG questionnaire on request for engagements that require it.
Email security@gynergy.com — typical turnaround three business days for SIG Lite, ten for full SIG.

Contractual addenda

Data Processing Addendum
Available under NDA
Pre-counsel template covering GDPR Article 28 + CCPA Service Provider clauses, with placeholders for customer-specific scope. Counsel review of the template is committed for the first enterprise engagement that requires execution.
Email security@gynergy.com with the customer legal entity name and intended scope; we send the parameterized draft within one business day.

Whitepapers + architecture

Security & Trust Whitepaper
Public
The unvarnished account of our security posture — defense-in-depth at the implementation layer, inherited certifications, operational discipline, and what we have deliberately chosen not to do yet. Updated whenever posture materially changes.
View →
Architecture Overview
Available under NDA
Multi-tenant isolation model, encryption envelope, audit-log architecture, RLS strategy, and adversarial test plan. Provided to enterprise security reviewers under NDA — contains internal naming and ops detail intentionally kept out of public documentation.
Email security@gynergy.com with your NDA; document follows within one business day.

Policies

Vulnerability Disclosure Policy
Public
Report a vulnerability to security@gynergy.com and we acknowledge within two business days. Our RFC 9116 security.txt names that contact and links back to this page.
View →
Data Retention Policy
Public
Member data is kept while the account is active. Deleting an account in Account Settings removes sign-in right away and keeps the history until the member asks us to erase it (privacy@gynergy.com). Audit logs retained for seven years to support attestation work. The schedule is on this page; the full policy document is available on request.
View →

Audits + testing

Third-Party Penetration Test
Planned
A third-party penetration test is planned. We have not completed one yet, and no engagement is signed. When one is, its scope goes on this page, and the attestation letter is shared under NDA once the test is done.
Email security@gynergy.com — we share the scope and engagement letter as soon as an engagement is signed.

Insurance

Cyber Liability + Technology E&O
Planned
Cyber liability and technology E&O: application prepared; not yet bound. We carry none today. We share the certificate of insurance once a policy is bound.
Email security@gynergy.com — we share the COI immediately on binding.

Source of truth: 11 evidence items at lib/trust/evidence.ts. Status updates ship the day evidence changes — not on a quarterly cadence.

What we collect and why

Account basics — email, name, password (managed by Clerk, not stored by us). Needed to create your account.

Coaching data — your ARIA conversations, assessment responses, goals, and reflections. Used to give you relevant coaching. Stored in our Supabase database in the US.

Health-adjacent data — sleep, stress, energy, recovery, exercise targets if you choose to track them. This is wellness data, not medical data. LVL-5 LIFE is not a medical service and nothing here is medical advice.

Financial data (LEDGER, optional) — if you link a bank account via Plaid, we store encrypted access tokens (not your login), account names, balances, and transaction records for your personal view. Your bank credentials never touch our servers. You can disconnect at any time.

Payment data — Stripe handles all card details. We store a customer ID and subscription status, never card numbers or CVCs.

Usage data — pages viewed, features used, errors encountered. Kept pseudonymously where possible. Used to improve the product and fix bugs.

Sub-processors

We work with the following companies to deliver the platform. Each is held to its own security commitments, most of which are independently audited (SOC 2).

Provider	Purpose	Region	Certification
Supabase	Primary database (Postgres) and file storage	United States (AWS us-east-2)	SOC 2 Type II
Vercel	Object storage (Blob) for a small set of legacy marketing media — hosting retired 2026-07-31	United States	SOC 2 Type II
Render	Application hosting (container services)	United States (Oregon)	SOC 2 Type II
Cloudflare	DNS, TLS termination and edge network	Global edge	SOC 2 Type II
Vultr	Container image build host and warm standby	United States	SOC 2 status unverified
Clerk	Authentication and user identity	United States	SOC 2 Type II
Stripe	Payment processing (cards never touch our servers)	United States	SOC 2 Type II
Plaid	Financial account linking for LEDGER (optional feature)	United States	SOC 2 Type II
Anthropic	Claude models powering ARIA coaching and ATHENA	United States	SOC 2 Type II
OpenAI	GPT models for select features	United States	SOC 2 Type II
Sentry	Error monitoring (PII scrubbed before send)	United States	SOC 2 Type II
PostHog	Product analytics and feature flags	United States	SOC 2 Type II
Resend	Transactional email delivery	United States	SOC 2 Type II
UploadThing	User-uploaded file storage	United States	SOC 2 Not public

How your data is protected

Encryption in transit. Every connection to Gynergy is TLS 1.2+ with HSTS enforced in production.
Encryption at rest. Our database provider, Supabase (on AWS), encrypts its disks (AES-256), as does our object storage vendor (Vercel Blob, for a small set of legacy marketing media). On top of that, we encrypt sensitive data ourselves: new ARIA conversations, Highest Self and Shadow Work content are encrypted at the application layer (AES-256-GCM) as they are written, and connection tokens such as Plaid's are encrypted too. Older records, including earlier ARIA conversations and Highest Self profiles, are not yet encrypted by us; that backfill has not run yet.
Access controls. Clerk-managed authentication with session cookies using SameSite=lax. Admin routes require an elevated role, and some sensitive admin actions are written to an append-only log. Two-factor sign-in is available through Clerk.
User-scoped data access. Queries are scoped to the signed-in user in our application, so one user's session cannot read another user's data. Database-level row security policies are written but not yet enforced.
Content Security Policy. Strict CSP limits which scripts can run on our pages, reducing the impact of any script injection.
Rate limiting. API endpoints are rate-limited per IP and per user to limit abuse and credential-stuffing attempts.
Error monitoring with PII scrubbing. We use Sentry to catch bugs, and we strip personal data from error reports before they leave our servers.
Audit logging. Some sensitive admin actions are written to an append-only audit log. Coverage is not complete yet.

AI and your data

ARIA is our AI coaching companion. Because AI handles sensitive conversations, we hold it to a higher standard than typical product telemetry.

User-scoped retrieval. ARIA can only retrieve conversations and context for the user it is currently serving. Our application scopes ARIA's lookups to that user; database-level row security is written but not yet enforced.
No training on your data. We use Anthropic and OpenAI API endpoints with provider-documented retention policies. Where zero-retention options are available, we use them. We do not fine-tune public models on your data.
Model transparency. ARIA is primarily powered by Anthropic's Claude family (Sonnet and Opus tiers, depending on the task). We disclose this rather than obscure it.
Red-team tests. We maintain prompt-injection and cross-user isolation tests for ARIA. Not all of them run automatically on every release yet.

Data retention

Active account data. Kept for as long as your account is active.
When you close your account. Deleting your account in Account Settings removes your sign-in right away. It does not cancel a paid plan: cancel the plan first (Dashboard → Billing), or email support. Your history is kept until you ask us to delete it: email privacy@gynergy.com and we remove your personal data from our primary systems.
Backups. Database backups are retained for 30 days for disaster recovery. After that, deleted data is removed from backups through normal rotation.
Plaid connections. When you disconnect a financial account, we revoke the token with Plaid within 24 hours and retire the stored token.
Logs and metrics. Operational logs kept 30-90 days depending on system. Aggregate metrics (no PII) may be kept indefinitely.
Payment records. Retained by Stripe per financial compliance requirements.

Your rights

You can always:

See what we have about you. Ask for a full copy of your data at privacy@gynergy.com.
Close your account, or have your data erased. Account Settings → Delete Account closes your account and removes your sign-in; it does not cancel a paid plan, so cancel the plan first (Dashboard → Billing) or email support. To have your data erased as well, email privacy@gynergy.com.
Correct inaccurate data. Edit from your profile, or email privacy@gynergy.com.
Opt out of sale or sharing. Use the link, here or in the footer of our marketing pages. It works without an account. We also honor Global Privacy Control (GPC): if your browser sends it, advertising sharing stays off. We don't sell your data for money; the opt-out turns off the “sharing” with Meta described in our privacy policy.
Limit use of sensitive personal information. California residents have the right to limit our use of sensitive categories (health, financial, precise location). Email privacy@gynergy.com.

Where we serve users

Gynergy is currently available to users in the United States. We're not serving European Union or UK residents at this time while we complete our GDPR readiness work. If you're in the EU/UK and want to be notified when we launch there, email hello@gynergy.com.

Certifications and audits

SOC 2 — we are not SOC 2 certified yet. Type I readiness work is underway, and the audit begins with our first enterprise contract, with Type II following on twelve months of subsequent evidence. We will not spend on the audit ahead of the controls being hardened. Our AICPA TSC 2017 control-evidence map (30 controls in scope, each with its evidence and its open gaps named) is available to enterprise security teams under NDA — email security@gynergy.com.
External penetration test — a third-party penetration test is planned. We have not completed one yet. The planned scope covers authentication, payment flows, the ARIA AI surface, tenant isolation, and admin privilege boundaries.
Cyber liability + technology E&O insurance — application prepared; not yet bound. We carry none today.
CSA STAR Level 1 — CAIQ v4 responses drafted and available under NDA; not yet submitted to the public registry.
HIPAA — we are not a HIPAA covered entity or business associate, and we do not sign BAAs today. Gynergy is a wellness and coaching platform, not a medical service.
CCPA / CPRA — we honor California residents' rights as described above.
FTC Health Breach Notification Rule — we are subject to the 2024 expanded rule and have a breach notification runbook with 60-day regulatory and 72-hour user commitments.

Service status

A public status page is coming online during beta. For incident or availability questions before then, email security@gynergy.com.

Reporting a security issue

Email security@gynergy.com. We'll acknowledge within two business days. The same contact is published for researchers in our security.txt.

Researcher hall of fame

Security researchers who have responsibly disclosed issues to us will be listed here (with their consent). Thank you to everyone who helps keep Gynergy safe for the people building their best lives here.

Questions

Privacy questions: privacy@gynergy.com
Security issues: security@gynergy.com
Anything else: hello@gynergy.com