Security Overview

Version 1.11 — effective 28 October 2026

Scope

SYNRADX TECHNOLOGIES S.R.L. applies technical and organisational measures proportionate to a professional cloud service. This overview describes general controls, does not disclose sensitive configurations and is not an independent certification.

Infrastructure

The managed runtime, database and main services are configured in Google Cloud region europe-west1 in Belgium. Production and non-production environments are separated. Server credentials are held in Secret Manager and are not included in the browser bundle or repository.

Identity and access

• opaque sessions, server-side hashes and HttpOnly, SameSite and Secure cookies over HTTPS;
• passwords stored using password-appropriate hashing, never in plaintext;
• optional Google sign-in, when enabled, with anti-CSRF state;
• two-step authentication for administrative accounts and critical providers where available;
• access granted by minimum necessity and separated by role and environment;
• session revocation and device controls.

Data protection

Data is protected in transit by HTTPS/TLS. Encryption at rest is supplied by managed cloud services together with project access controls. Clinical content is intentionally excluded from operational telemetry. API keys, tokens and passwords are not placed in user logs or responses.

Audio is processed only for the requested feature. Local recovery uses device IndexedDB with a three-file, 50 MiB and 24-hour limit; physical protection and device encryption remain the customer's responsibility.

Application security

Where appropriate we apply:

• input and output validation, size limits and time-outs;
• route authorisation and account data separation;
• shared rate limiting, cost and concurrency limits, circuit breakers and fail-closed behaviour;
• CSRF, cookie and security-header protections;
• signature verification and idempotency for webhooks;
• dependency scanning, automated tests and review before release;
• controlled error messages without client-visible stack traces or secrets.

Continuity and restoration

Managed services use backup and restoration controls configured for the relevant environment. Deployment procedures retain a rollback revision and include controlled smoke tests. Recovery objectives depend on plan and incident; we do not promise uninterrupted availability or zero loss under every circumstance.

Providers

Providers are assessed by role, data, security and contract. Data and access are limited to the active service. The public list is available at Subprocessors.

Incidents

Events are investigated, contained, documented and remediated. Where a personal-data incident requires notification, we will inform the customer controller without undue delay and support applicable legal duties.

Report vulnerabilities to security@imoray.app. Do not conduct destructive testing, access other people's data or include patient data in email. We will acknowledge receipt and communicate proportionately to severity.

Customer responsibility

Customers must secure devices and networks, use individual accounts and strong authentication, limit access, anonymise content, maintain current software and review exports before moving them to other systems.