Synthesia

Synthesia is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. Synthesia's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Synthesia hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Synthesia is SOC 2 Type II compliant and holds ISO 42001, ISO 27001, ISO 27701, SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Synthesia hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@synthesia.io or via a /security page (Synthesia lists a security contact).

Synthesia's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

Synthesia's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Synthesia's trust center is at https://security.synthesia.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Security risk assessment is an integral part of our software development life cycle. We use frameworks such as OWASP Top 10, as part of the risk review. For development stories of a given size, complexity or sensitivity we perform a formal threat model analysis. The process is influenced by STRIDE, modified to better fit our team and processes. We use Semgrep to detect and manage code vulnerabilities (SAST, SCA and Container). We run weekly authenticated and un-authenticated DAST scans. We also have a strong partnership with HackerOne, with extensive application and network pentests, as well as a private bug bounty program. This means that everything we deploy is continuously pentested by vetted and experienced security researchers. We use Wiz.io to monitor for production infrastructure security issues such as vulnerabilities and misconfigurations

We ensure that all access is based on the principle of least privilege. We use an identity provider with built-in threat intelligence feeds (i.e. dark web monitoring), strong password complexity requirements and a requirement for all employees to use a FIDO2 compliant authentication factor (biometric or security key). All employees are required to use a password manager, with a unique strong password and multi-factor authentication by default for all accounts. Access to our cloud infrastructure has restricted permissions using role based access controls, with access alerts and auditing in place. For employee and contingent worker access to customer data and personal information we have implemented the following specific controls: * Written policy for limiting employee, contingent worker, and contractor access to sensitive data, such as role-based access limitations and use of the principle of least privilege * Periodic access reviews * Access requests and explicit approvals for all access to sensitive data * A requirement that all employees and contingent workers to execute NDA or other confidentiality agreements * Periodic privacy and security training * Immediate termination of access upon termination of employment * Physical access restrictions, such as key card access and video monitoring * Full audit logging of all access to our backend infrastructure and actions taken by staff

Risk assessment is an integral part of operating procedures and incorporated in our Risk Management Policy. This is implemented and monitored through Vanta, our compliance tracking platform. Within Vanta, we define risk areas, risk scenarios, treatments, etc. These are owned by relevant stakeholders within the business. The ISO, together with legal counsel, is responsible for overseeing this process. Controls and mitigatory measures are either continuously monitored for effectiveness through Vanta, with automated alerts for failures, or audited by ISO periodically as part of the general compliance upkeep. Controls related to SOC2 are also reviewed as part of the external audit.

Our Head of Security, Martin Tschammer (martin.tschammer@synthesia.io), is the Information Security Officer (ISO) for Synthesia, reporting to the CTO and senior management team. The roles and responsibilities at Synthesia are set out in our policy on Information Security Roles and Responsibilities.

We have a Data Privacy and GDPR Compliance Policy in place to meet our obligations under the UK Data Protection Act 2018, the UK's implementation of the General Data Protection Regulation (GDPR). We also have an explicit Data Subject Request Policy in place, which sets out how to respond to an individual’s request to exercise their rights under the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. Further, Synthesia's Data Management Policy ensures that information is classified, protected, retained and securely disposed of in accordance to regulatory responsibilities as well as internal classification. Data Protection Impact Assessment and Transfer Impact Assessment have been conducted, and are shared on https://security.synthesia.io/documents

You can see a selection of Vanta-monitored security controls on the security portal (https://security.synthesia.io). You can also find a SIG Lite questionnaire and a Consensus Assessment Initiative Questionnaire (CAIQ)v4 under https://security.synthesia.io/documents for more details. In general, our control fabric is aligned with our policies, risk management program and industry best practices and standards. We secure access to all our systems and ensure that all access is based on the principle of least privilege. All employees are required to use a password manager, with a unique strong password and multi-factor authentication by default for all accounts. For employees, we use Okta as our identity management solution. For all Okta users, we require a FIDO2 compliant authentication factor (biometric or Yubico Security Key). Access to our cloud infrastructure has restricted permissions using role based access controls, with access alerts and auditing in place. Encryption, audit logging, password policy etc are in place, as evidenced on this Trust Report. We have a centralised MDR/SOC function that is able to detect and respond to incidents coming from workstations, servers, cloud infrastructure and identity management platform 24/7. Our infrastructure is secured using internal networks protected by virtual firewalls. Access to the network configuration is restricted and only allowed on the basis of least privilege. We use AWS to provide the infrastructure for our production system. We review our infrastructure with external security experts at least annually to ensure we meet best practises and identify areas that need to be addressed.

We have well-established Incident Response playbooks. For incidents where Synthesia is the Data Controller, regulatory authorities and affected individual will be notified without undue delay, but in no later than within 72 hours. For incidents where Synthesia is the Data Processor, Synthesia will notify the Data Controller as stipulated in the applicable DPA. Incident response and disaster recovery plans are tested annually.