Sanitised / no production access
Syntix works with test environments, redacted exports, scripts, policies or other approved material without access to live personal data.
Security & Data Protection
We ask for the access we need, and no more.
A small workflow build and an ongoing managed service do not need the same access. We agree the access model before work starts.
Working principles
Access should match the work.
Least privilege
Access should match the systems, permissions and time needed for the agreed work.
Named accounts
Where the platform allows it, we prefer named accounts so activity can be tied to a person.
MFA
We use the client's approved identity controls and MFA where the environment supports them.
Keep secrets out of ordinary channels
Passwords, tokens and private keys should not be sent through public website forms or stored in normal project documents or source code.
Treat production differently
Development, test and production have different risks. Production access is agreed before it is granted.
Leave evidence
Important changes, testing and operating notes are recorded when the work requires it.
Access models
Not every workload needs the same delivery boundary.
Controlled Pakistan access
Where live access from Pakistan is necessary and permitted, it is enabled only for the agreed systems and roles after the required contractual, transfer and security controls are approved.
Germany/EU execution + Pakistan engineering
Where production or personal-data access must remain in Germany/EU, an approved Germany/EU operator can retain live access while Syntix handles the agreed engineering work from Pakistan using the information permitted for that scope.
Personal data
The role depends on the engagement.
For the public website, Syntix is the controller for the inquiry and recruitment data described in the Privacy Notice.
For client work, Syntix may be a processor or subprocessor when it handles personal data on the client's instructions. The applicable agreement sets out what is processed, why, who can access it and what happens when the work ends.
International access
Syntix works from Pakistan.
Cross-border access, transfer requirements and country-specific restrictions are covered on the International Delivery page.
Incident handling
If there is an incident, we act on it.
We contain the issue, preserve useful evidence, tell the right client contact and follow the incident process agreed for the engagement. Contractual notification duties stay in the contract and the client's incident procedure.
Website infrastructure
The company website is separate from client production environments.
The current Syntix website uses Cloudflare for delivery and security. Public inquiry records are stored in a dedicated Syntix company-website Supabase project whose current primary database region is Singapore. Email notifications may be sent through Resend if that feature is configured.
These website providers do not define the architecture or data location of a client environment.
Procurement or security review?