Compliance - Graphor Docs

The stance

This page is intentionally honest about what is and is not certified. Graphor is operated by Synapse Inovação e Tecnologia LTDA., a company at an early-stage. It does not yet hold its own SOC 2 Type II or ISO 27001 certification. Stating that openly is the first compensating control. What this page commits to:

No aspirational certification dates. Where a certification is under evaluation, the page says so without binding to a delivery date. When a date is committed, this page is updated and the change history at the bottom records it.
Every control claim in the rest of the Trust Center is verifiable. Each row in the compensating-controls inventory below links to the Trust Center page that documents the control in implementation detail.
Inherited certifications are listed verbatim with links. Where Graphor relies on a subprocessor’s certified posture, the certification is named with its issuing standard and the customer can read the same report under NDA.

For enterprise customers that contractually require Graphor itself to hold a specific certification, see §6 at the bottom of this page for the path forward.

1. Synapse’s own certification status

Certification	Current status	Committed timeline	Compensating controls (see §3)
SOC 2 Type II	Evaluating; no committed date	None today	Full set in §3
ISO/IEC 27001	Evaluating; no committed date	None today	Full set in §3
ISO/IEC 27017 (cloud services security)	Evaluating; no committed date	None today	Inherited from the cloud infrastructure provider — see §2
ISO/IEC 27018 (PII in public cloud)	Evaluating; no committed date	None today	Inherited from the cloud infrastructure provider — see §2
ISO/IEC 27701 (privacy information management)	Not evaluated	None today	Compensated by LGPD / GDPR alignment per §4
PCI DSS	Not applicable to Synapse directly	n/a	Payment-card data is processed by Stripe — see Subprocessors §5; Graphor stores only payment metadata
HIPAA	Not in scope today	n/a	Graphor is not currently positioned as a HIPAA-Business-Associate. Gap to BAA-eligibility for a healthcare customer would require coverage across the Security Rule (45 CFR §§ 164.302–318), Privacy Rule (§§ 164.500–534), and Breach Notification Rule (§§ 164.400–414). Specifically: (i) Google Cloud BAA (available — Synapse would execute), (ii) AWS BAA covering Bedrock (available — Synapse would execute), (iii) Stripe BAA (n/a — billing-only, no PHI transit), (iv) administrative safeguards (45 CFR § 164.308) — training, sanctions, workforce policies (largely present per Tenant Isolation §7 but require HIPAA-specific scoping), (v) technical safeguards including audit controls (45 CFR § 164.312(b)) and person/entity authentication (§ 164.312(d)) — current MFA posture supports (d); the customer-facing audit-log API needed for (b) is on the roadmap, (vi) organizational requirements (45 CFR § 164.314) — BAA-required content and subprocessor BAAs, (vii) PHI-Project posture commitment — observability tracing remains off by default for the Project (current Enterprise default); the gap is contractually binding this for any PHI Project, (viii) breach-notification mapping to 45 CFR § 164.404 alongside the existing LGPD/GDPR notification. Not on roadmap today; revisit on first healthcare enterprise engagement via privacy@graphorlm.com.
FedRAMP	Not in scope today	n/a	Out of scope — Graphor is not positioned for US-federal-government workloads

The “evaluating” status on SOC 2 Type II and ISO 27001 reflects an active assessment of when it makes sense to enter the audit cycle. Enterprise contracts that require either certification can accelerate the timeline — see §6.

2. Inherited certifications

Graphor’s operational stack runs on subprocessors that carry the certifications listed below. Inheritance is not a substitute for Graphor holding its own certification, but it is the standard way that a SOC 2-pending company demonstrates that the upstream chain meets enterprise security expectations.

Subprocessor	Certifications and audit reports
Google Cloud Platform (production cloud infrastructure including identity)	ISO/IEC 27001, 27017, 27018, 27701; SOC 1, SOC 2 Type 2, SOC 3; PCI DSS Level 1; FedRAMP High; HIPAA BAA available. Reports: Google Cloud compliance offerings.
Amazon Web Services (Bedrock)	ISO/IEC 27001, 27017, 27018, 27701; SOC 1, SOC 2, SOC 3; PCI DSS Level 1; FedRAMP. Reports: AWS compliance programs.
OpenAI (embeddings)	SOC 2 Type 2. Reports: OpenAI Trust Portal.
Cerebras (chunk enrichment + fast tier)	SOC 2 Type 2. Reports: available on request from Cerebras under NDA.
Stripe (payment processing)	PCI DSS Level 1; SOC 1, SOC 2 Type 2; ISO/IEC 27001. Reports: Stripe Privacy and Compliance.
Neo4j AuraDB (managed graph store)	SOC 2 Type 2; ISO/IEC 27001. Reports: Neo4j Trust Center.

Each subprocessor’s audit reports can be requested through Synapse via privacy@graphorlm.com; the report itself is delivered by the subprocessor under their own NDA terms.

3. Compensating controls inventory

In the absence of Synapse’s own SOC 2 or ISO 27001 certification, the following operational controls — already in place and documented elsewhere on the Trust Center — cover the gap that the certification would otherwise demonstrate.

Control area (SOC 2 / ISO 27001 mapping)	What Graphor does	Where it is documented
Asset inventory and architecture	Public, sanitized architecture published; every component and data flow documented; production region pinned and verifiable per component.	Architecture, Data Residency
Vendor and subprocessor management	Versioned subprocessor list; 30-day prior-notice commitment for material additions; inherited-certification inventory; related-party disclosure for Synapse Consultoria.	Subprocessors
Encryption at rest and in transit	Cloud-provider-managed AES-256 default; customer-managed encryption keys available on enterprise request (typical scoping engagement: 4–8 weeks; may carry an incremental fee); TLS 1.2+ enforced on every public surface.	Trust Center Overview §3
Identity and access management	Per-project API tokens with TTL + last-used auditing; tier-aware observability access; Project-scoped Synapse-personnel access via role assignment on the observability store today; per-personnel access-audit logging on the observability instance is on the roadmap (see Tenant Isolation §1).	Tenant Isolation
Logical tenant isolation	Single-tenant logical model with application-layer scoping at the API, database, graph store, storage, and observability layers; per-layer failure-mode analysis published.	Tenant Isolation §1
Data retention and disposal	Infinite-until-DELETE posture; end-to-end delete cascade; customer-callable DSR API; bounded TTL on observability traces; 7-day database backup + point-in-time recovery window for the primary database. Billing records are retained for the statutory tax-record window (5 years under CTN art. 173) even after account deletion — see Data Retention §6.	Data Retention
AI / model governance	Contractual no-training commitment from every active provider, with verbatim citations; tier-based provider declaration; explicit non-commitments around training-program opt-in, fine-tuning, and human review of customer content.	Model Use and Training
Incident response and breach notification	72-hour customer notification SLA after internal confirmation; 14-day post-mortem commitment; customer-side reporting path with safe-harbor.	Incident Response
Privacy program and DSR	Privacy policy published in English and Portuguese; DSR API satisfies LGPD art. 18 and GDPR art. 17; privacy contact channel monitored.	Privacy Policy, Data Retention §3
Contractual instruments	DPA template available for customer counter-signature; SCC-equivalent international transfer clauses; pass-through clauses referencing upstream DPAs.	DPA Template
Audit logging	Today: API-token last-used metadata, payment-processor billing events, usage metering aggregates, and DSR delete confirmations are customer-visible. The full customer-visible activity log API + UI + export are on the roadmap. Ad-hoc audit queries served via privacy@ within 10 business days for routine queries.	Audit Logs
Vulnerability management	Container images built on official base images; dependency scanning in CI; security advisories monitored for every active subprocessor; at least annual review of patch posture. No third-party penetration test has been performed yet; compensating controls are the CI dependency scanning, the daily operational-log review in Incident Response §2, and the vulnerability disclosure program. A baseline external pentest is planned; the resulting executive summary will be available under NDA.	Incident Response §9
Disaster recovery	Cloud-provider automated backups + point-in-time recovery window; documented restore procedure that preserves customer DSR actions across recoveries.	Data Retention §5, Incident Response
Business continuity	Single-region deployment is intentional; provider redundancy for AI inference (Cerebras + Bedrock both available); founder-incapacitation continuity plan with documented backup-access procedure and named alternate operations contact disclosed to enterprise customers under NDA. Full BCP detail in §5.	This page §5

Enterprise customers performing a Graphor-specific security questionnaire can use this table as a cross-reference: for each line item on the questionnaire, identify the relevant control area and follow the link to the implementation detail. LGPD and GDPR are regulatory regimes, not certification schemes — there is no formal “LGPD-certified” stamp. Graphor’s posture against each is documented as compliance by design, with the relevant articles cited next to the control that satisfies them:

Regime	Article / topic	Where Graphor’s posture is documented
LGPD art. 7º (legal bases)	Contractual necessity, consent, legal obligation, legitimate interests	Privacy Policy
LGPD art. 9º (transparency)	Privacy Policy, Trust Center, ToS	This site
LGPD art. 18 (data-subject rights)	DSR API + privacy contact	Data Retention §3
LGPD art. 33, II, b (international transfer via standard contractual clauses)	EU SCCs 2021/914 for EU customers, ANPD Cláusulas-Padrão Contratuais (Resolução CD/ANPD nº 19/2024) for Brazilian customers in every subprocessor DPA; single-region production; ZDR on OpenAI	Data Residency §3
LGPD art. 38 (DPIA)	DPIA template for high-risk processing on request	Available on request via privacy@graphorlm.com
LGPD art. 39 (operator’s duty to follow controller’s instructions); subprocessor authorization is governed contractually under arts. 39 and 42 (solidary liability)	Versioned subprocessor list with notification subscription; documented instructions captured in the Agreement, Trust Center, and DPA per DPA §3.1	Subprocessors
LGPD art. 48 (incident notification)	72-hour contractual SLA meets or exceeds the 3-business-day regulatory floor in ANPD Resolução CD/ANPD nº 15/2024, art. 6	Incident Response
GDPR art. 5 (data protection principles)	Mirrored by the same controls that satisfy LGPD art. 7º and 9º	This site
GDPR art. 6 / 9 (lawful basis / special categories)	Same legal-basis statement as LGPD art. 7º; no processing of special-category data on a Graphor-product basis (customer may upload it as part of Customer Content under their own legal basis)	Privacy Policy
GDPR art. 15–22 (data-subject rights)	Same DSR API as LGPD art. 18	Data Retention §3
GDPR art. 28 (processor obligations)	Codified in the DPA template	DPA Template
GDPR art. 32 (security of processing)	Inherited from Google ISO 27001/27017/27018 + AWS Bedrock equivalents + the compensating controls in §3	This page
GDPR art. 33(2) (processor-to-controller breach notification)	72-hour contractual SLA exceeds the statutory “without undue delay” floor of art. 33(2); the art. 33(1) 72-hour clock binds the controller, not the processor	Incident Response
GDPR art. 44–49 (international transfer)	Same SCC-equivalent posture as LGPD art. 33	Data Residency §3
EOAB art. 7 (advocacy confidentiality, Brazil)	Reinforced by the no-training commitment, the Enterprise-tier observability default-off posture (the recommended default for legal-sector customers), and the DSR API that satisfies the sigilo profissional surface	Model Use and Training, Tenant Isolation §4

5. Business continuity and key-person risk

Synapse is operated by SYNAPSE INOVAÇÃO E TECNOLOGIA LTDA., currently founder-led. A founder-led operation carries an explicit key-person risk that customers should evaluate at signature. This section discloses what mitigates that risk today and what does not.

5.1 What is in place

Provider redundancy for inference. AWS Bedrock and Cerebras are both active subprocessors; if one provider’s availability degrades, traffic is routed to the other within the per-tier provider chain documented in Model Use and Training §1.2.
Data durability. Cloud-provider automated backups + point-in-time recovery within a 7-day window for the primary database; object-storage redundancy at the cloud-provider tier; managed-graph-store provider redundancy per Subprocessors §2. See Data Retention §5.
External incident-alerting service. Inbound mail to the privacy mailbox triggers an external alert that routes to the on-call engineer, providing notification continuity independent of any single device.
Backup-access procedure (operationalizing). Synapse is operationalizing a credential-recovery arrangement for the event of founder incapacitation. The current interim measure is a sealed-credential procedure with a named alternate operations contact (a Brazilian licensed attorney) who can revoke credentials, freeze the production environment, and trigger customer notification under the Incident Response SLA. A formal third-party escrow arrangement (cartório or commercial escrow provider) is on the roadmap; the current arrangement and the named alternate contact are disclosed to enterprise customers under NDA.
Stateless customer integration. Customers integrate via the public REST + streaming API; there is no Synapse-deployed customer-side agent that would fail if Synapse-side operations paused.

5.2 What is NOT in place (honest disclosure)

No 24/7 in-house SecOps rotation. Severity-1 and Severity-2 alerts route to the founder + external alerting service today. Synapse is investing in a 24/7 escalation path as the team scales; the current model is disclosed rather than overstated.
No active-active multi-region deployment. Per Data Residency §5, the single-region posture is intentional; the Brazil and EU region roadmap items in Data Residency §6 provide a customer-driven path to regional alternatives, not active-active redundancy.
No published RTO/RPO commitments today, and no end-to-end restore drill has been run. The point-in-time recovery within the 7-day backup window targets sub-hour RPO under normal operation (per the cloud-provider PITR granularity, typically seconds-to-minutes); an effective RTO for a full-region rebuild is on the order of hours and depends on the cloud-provider control plane. Quantified RTO/RPO targets will be published once an annual restore-drill cadence is established.
No formal vendor-termination wind-down playbook today. A customer-data export path is available on request via privacy@graphorlm.com; a published wind-down playbook is on the roadmap.
No published company-dissolution playbook today. In the event of voluntary or involuntary dissolution of Synapse Inovação e Tecnologia LTDA., Customer Content would be subject to standard Brazilian corporate-dissolution procedures under the Código Civil arts. 1.033–1.038 (sociedade limitada) and the LGPD obligations that survive dissolution. A formal commitment to (a) provide a 30-day customer-data export window on dissolution notification, (b) certify destruction of remaining Customer Content within 60 days of dissolution, and (c) name a Brazilian licensed attorney as the post-dissolution data-protection contact is available as a contractual rider on enterprise engagements on request. A published dissolution playbook is on the roadmap.

5.3 What customers should do

Customers with stringent business-continuity requirements (regulated financial-sector workloads, healthcare BAA-equivalent, government engagements) should:

Discuss BCP scope at contract signature, including target RTO/RPO and a vendor-termination wind-down clause specific to the engagement;
Maintain an independent export of Customer Content at a cadence appropriate to the workload (Graphor provides export on request, and a self-service export API is on the roadmap);
Subscribe to subprocessors@graphorlm.com to receive material-change notifications that may affect continuity posture.

6. How to request audit reports and discuss certification needs

For enterprise customers:

Subprocessor audit reports (Google SOC 2, AWS SOC 2, OpenAI SOC 2 Type 2, etc.): request via privacy@graphorlm.com. Reports are delivered by the subprocessor under their own NDA terms.
A formal Synapse certification commitment (specific SOC 2 timeline, ISO 27001 scope agreement, HIPAA BAA): request via privacy@graphorlm.com. An enterprise contract with a binding certification clause is the path to bringing a specific audit cycle forward.
A DPIA / Legitimate Interest Assessment specific to your processing activity: Synapse can provide a Graphor-side template that you complete with your processing details, on request via privacy@graphorlm.com.
A custom security questionnaire: Synapse will complete reasonable enterprise security questionnaires within 10 business days of receipt, citing the Trust Center pages above for the answers wherever they apply.

Executive intent statement

Synapse Inovação e Tecnologia LTDA. — the operator of Graphor — is committed to building the controls, the operational discipline, and the audit posture that regulated enterprise customers require. We are honest about what is certified today and what is not. We do not publish aspirational dates that we may miss. We do publish, in detail, the controls that are in place in lieu of those certifications, and we welcome customer audits of those controls under reasonable scoping. — Lucas Neves, Founder & CEO, Synapse Inovação e Tecnologia LTDA.

7. Change history

Version	Date	Change
1.0	2026-06-21	Initial publication.

When a certification status changes (audit started, audit completed, scope expanded), this table is updated and subscribers to subprocessors@graphorlm.com receive an email.

Contact

Compliance, audit, and certification inquiries: privacy@graphorlm.com
Subscription to compliance-status change notifications: subprocessors@graphorlm.com
Customer support: support@graphorlm.com

​The stance

​1. Synapse’s own certification status

​2. Inherited certifications

​3. Compensating controls inventory

​4. Regime-based posture (LGPD, GDPR)

​5. Business continuity and key-person risk

​5.1 What is in place

​5.2 What is NOT in place (honest disclosure)

​5.3 What customers should do

​6. How to request audit reports and discuss certification needs

​Executive intent statement

​7. Change history

​Contact