Trust & Transparency
Trust
must be proven.
At Synaptiik, the sovereignty of your data is a sacred asset — not a marketing promise. Here are our concrete, verifiable and contractually enforceable commitments.
GDPR by design
From the ground up
ISO 27001
Hosting provider (Supabase/AWS EU)
Electronic signature (SES)
SHA-256; server timestamp in the audit ledger
PCI DSS Level 1
Stripe payments
TLS 1.3 + AES-256
Encryption in transit & at rest
Anthropic zero-retention
AI with no third-party training
Data protection
GDPR by design
GDPR is not a checkbox. It is wired into the architecture from the very first commit.
- Granular consent with SHA-256 timestamped proof
- Right to erasure (DSAR): request logged, account deactivated within 72 hours, permanently purged 30 days later (cancellable during that window) — internal SLA monitored daily, well inside the one-month statutory GDPR deadline
- Records of processing activities (ROPA) available on request
- Automatic retention according to legal periods (invoices 10 years, logs 1 year)
- Breach notification within 72h to the CNIL (GDPR art. 33 obligation)
- Legal holds for judicial freezing (legal proceedings)
- Your data is never resold, shared or used for third-party commercial purposes
Artificial intelligence
Transparent AI, zero retention
Leeza runs exclusively on Anthropic models — with a zero-retention policy.
- Single AI provider: Anthropic (Claude Haiku 4.5 / Sonnet 4.6 / Opus 4.7) — zero OpenAI, zero Google
- Zero retention: your data is never used to train third-party models
- Every Leeza suggestion displays: Why · Risks · Alternative
- Human override on every automated decision
- Complete audit trail of all Leeza actions
- Instant kill-switch on all AI services, per portal and per account
- No fully automated business decision without explicit approval
Infrastructure
Hardened security
Encryption in transit (TLS 1.3) and at rest (AES-256), multi-factor authentication, zero-trust architecture.
- Encryption in transit: TLS 1.2 minimum, 1.3 preferred on all connections
- Encryption at rest: AES-256 for all sensitive files and data
- MFA mandatory on Studio and Agence accounts
- Hierarchical RBAC — 7 permission levels (platform_owner → client)
- Strict CSP with cryptographic nonce (no unsigned inline scripts)
- Rate limiting per user and per IP, with distributed Redis (Upstash) on sensitive routes
- Continuous security monitoring with real-time P0 alerts
Sovereignty
EU hosting — ISO 27001 datacenters
Production infrastructure and data hosted in Europe, with ISO 27001 certified providers. AI processing via Anthropic (US) governed by DPA/SCC, zero retention.
- ISO 27001 certified datacenters (Supabase / AWS EU), hosted in Europe
- Photo and video data: EU storage only, never routed outside the EU
- Supabase EU tier — database and auth in France
- Vercel Edge EU — European CDN for public assets
- Full export of your data at any time, open formats (JSON/CSV/PDF)
- Permanent and verifiable deletion on request (GDPR art. 17)
- AI processing (Anthropic) governed by DPA + SCC clauses — zero data retention
Legal value
Simple electronic signature (SES)
Simple electronic signature (SES) within the meaning of Article 25(1) of the eIDAS regulation, reinforced by SHA-256 integrity proof and a server timestamp.
- In-house SES: SHA-256 integrity proof + server timestamp in the audit log
- Explicit time-stamped consent and a single-use confirmation code before the signature is applied
- Immutable audit log (SHA-256 fingerprint) — no NF Z42-020 vault
- Framework applicable across the European Union: eIDAS regulation (EU) No 910/2014
- Digital audit trail: who signed, when, from which IP, on which device
- Retention of evidence for the applicable legal period
- Secure payments via Stripe — PCI DSS Level 1 certified
Tax compliance
Electronic invoicing compliant — ready today
The French reform makes electronic invoicing mandatory for every VAT-liable business: receiving from September 1, 2026, issuing from September 1, 2027. Synaptiik is ready.
- Factur-X generation: PDF/A-3 with embedded structured CII data
- SIREN, SIRET, RCS and intra-EU VAT legal mentions generated automatically
- Connection to a partner e-invoicing platform (PDP) — in progress, ahead of the legal receiving deadline (09/2026)
- Full lifecycle: issuance, credit notes, incoming supplier invoice reception
- No re-entry: the same billing data feeds the Factur-X format
Product commitment
Transparency without compromise
No dark patterns. No paid rankings. No algorithmic manipulation.
- Cancel in 2 clicks from the dashboard — no friction, no form
- No paid ranking in the Agora (matching criteria published)
- Trust Score based on objective, non-editable metrics
- Client reviews unfiltered and not editable by the pro
- No data sold to commercial third parties (advertising, third-party analytics)
- Major incidents documented with root cause
- 30 days' notice on any change to the terms of use
Service agreement
Availability & SLA
Contractual commitments, not marketing promises.
- Monthly availability target: 99% (T&Cs art. 9)
- Service credits in the event of SLA breach — being rolled out (Phase 2)
- Priority support on Agence and Scale plans
- Continuous availability supervision
- Incidents documented with root cause
- Regular automatic backups with retention
Disambiguation
The name "Synaptiik".
- Synaptiik is spelled with two "i"s — not "Synaptik" (a US neurotech company) or "Synaptic" (a generic neural-computing term). The name refers to the synapse, the link between the people on an imaging project, not a neuroscience or generic AI product.
- Synaptiik is neither a framework, a technical library, nor a hardware brand — it is SaaS management software dedicated to imaging professionals (photographers, videographers, drone operators).
Your data belongs to you
Your photos, videos, contracts, client data and organizational memory belong exclusively to your studio. Synaptiik is a service operator, not a data owner. You can export everything at any time and request full deletion — without justification; the account is deactivated within 72 hours, then permanently purged 30 days later (cancellable during that window).
In the event of cancellation, your data remains exportable for 30 days. After that period, it is irreversibly and verifiably deleted.
Absolute isolation
Row Level Security (RLS) enabled on every table. Your data is never accessible to another Synaptiik subscriber. Strict per-organization isolation via Row-Level Security.
What this actually means
A security promise is described.
"Secure" means nothing until you say against what, at what level, and what remains verifiable afterwards. The commitments listed above describe measures that are actually implemented — not intentions, and not labels we don't hold.
When a guarantee relies on a third party, it is named as such: PCI DSS compliance for payments is Stripe's, ISO 27001 certification is our infrastructure host's. What falls under Synaptiik is described below in technical terms.
Photo: Felix Moeller · Pexels
Technical measures
Six mechanisms, and what they prevent.
Each measure is described by what it does and by the risk it covers — because a mechanism whose purpose is unknown reassures no one.
Studio practices
The habits that create exposure, and what replaces them.
Most incidents at a studio don't come from an attack, but from a convenient habit: a public link, a shared password, a local folder.
Disambiguation
What Synaptiik is not.
The name invites confusion, and the photo-software market is crowded with vague promises. Here is, plainly, what Synaptiik does not do.
Money & billing
How Synaptiik handles the money flowing through the platform.
A sensitive topic, explained without jargon: who gets paid, when, and under what conditions you can change your mind.
FAQ
Frequently asked questions about your data.
Where is my studio's data hosted?
In the European Union, with our infrastructure host. Application processing and file storage fall within the same geographic perimeter, which avoids a transfer outside the EU in normal operation.
Can a collaborator see all of the studio's projects?
No, unless you decide otherwise. Access is granted per person and per scope: a second shooter or a service provider only sees the assignments they are attached to. Filtering is applied at the source, in the database, not just hidden on screen.
Who owns the images uploaded to Synaptiik?
You do. Synaptiik is a technical service provider: it hosts and transmits your files on your behalf. No usage rights are acquired over your images, and they are never resold or used for third-party commercial purposes.
What happens if one of my clients requests erasure of their data?
The request is processed within the timeframe set by GDPR. Because data is attached to an organization and a project, it can be located and then deleted, subject to legal retention obligations — invoices, in particular, must be kept for the duration required by law.
Can Leeza act on my data without my consent?
No. Every recommendation is presented with its reason and its alternative, no commercial decision is executed without explicit validation, and the assistant can be switched off per account and per portal.
What happens to my data if I cancel my subscription?
It remains accessible for thirty days after cancellation, giving you time to export your projects, documents, and files. After that period, it is purged according to the retention policy applicable to your account.
How does Synaptiik handle the money flowing through the platform?
Payments are processed by Stripe, our licensed payment provider. Synaptiik never holds funds in an escrow account: they are settled directly to the professional or contractor concerned. A flat 5% service fee applies identically across all relevant services — never presented as a variable commission.
Can I get a refund if I change my mind?
Yes, on the Solo and Studio plans: commercial refund within 14 days monthly, 30 days annually. The Prestataire plan (€29/month) gets 14 days. Agence and Agence Scale, evaluated via demo and pilot before subscribing, are not covered by this window.
How do I cancel my subscription?
Synaptiik has no commitment: cancellation happens from your billing space, with no contractual notice or exit fees. Your data stays accessible for thirty days after cancellation so you can export your projects.
Is Synaptiik actively developed?
Yes. The Synaptiik blog shows the publish date of every article, updated as the product and regulatory framework evolve — you can check the freshness of the content yourself on /blog. The business guides (/ressources) are also revised when the legal framework changes.
Questions about security or compliance?
Our team answers any DPO request, security audit, or contractual question. Guaranteed response time: 48 business hours.