Not “we promise not to.” Not “our policy says we won't.” Mathematically cannot. The architecture makes it impossible.
When you onboard, Syntac generates a cryptographic key pair in your browser. Your private key is encrypted with a passphrase that only you know, then stored. We never see the passphrase or the unencrypted private key.
When you save client data, it's encrypted in your browser before it ever leaves your device. Our servers store ciphertext — scrambled data that is meaningless without your private key.
This means even if our servers were breached, your client data would be unreadable. Even under a court order, we could not produce readable client records. We don't have the key.
aGVsbG8gd29ybGQ...Client intake notes, contact info, session detailsTransparency builds trust. Here's exactly what our systems have access to.
When Syntac's AI generates session prep or intake analysis, it works exclusively with de-identified, structured data. Names are stripped. Dates of birth become age ranges. Encrypted notes are never sent.
This follows the HIPAA Safe Harbor de-identification standard: all 18 categories of protected health information identifiers are removed before any AI processing.
The AI sees patterns. It never sees people.
For the security-minded practitioner who wants to know exactly what's under the hood.
Asymmetric key pair generated in your browser using the Web Crypto API. The same standard used by banks and governments.
Your private key is encrypted with your passphrase using PBKDF2 (600,000 iterations) and AES-256-GCM. Even if stolen, it's useless without your passphrase.
All encryption and decryption happens in your browser. Unencrypted data never touches our servers. Keys never leave your device unprotected.
During setup, you download a one-time recovery key. If you forget your passphrase, this is the only way to regain access. We cannot reset it for you.
AI queries use de-identified data only. No client data is stored by AI providers. No data is used to train models. Processing is ephemeral.
Every API access is logged. Encryption versions are tracked per record. The architecture is designed for regulatory review.
We believe in earning trust through transparency, not marketing claims. Many platforms call themselves “HIPAA compliant” without the BAAs or audits to back it up. We'd rather tell you exactly where we are and let the architecture speak for itself.
Apply for the founding beta. Your data is encrypted from day one.
Apply for Beta →