Security

Last updated: 24 August 2026

This page answers the questions security reviewers ask, in plain language and without overstatement. synthetic cfo is operated by a single founder and this page says exactly what is and is not in place. Nothing here is aspirational.

The data itself carries no risk

• Born synthetic. Every dataset is generated from deterministic accounting rules. No real company data, no real transactions and no real people exist anywhere in the system. Names, vendors and customers come from synthetic pools.
• No language model produces any data. The engine's first rule is that an LLM may only translate a request into a validated configuration. Every generated field, including the written audit reasoning, comes from deterministic Python. There is no mode in which this is different.
• Reproducible and verifiable. The same seed and configuration regenerate a package byte for byte. Every package ships a certificate listing the SHA-256 of every file, so integrity can be checked by anyone holding the package.

What we store about you

• Your account email, a salted password hash (PBKDF2-SHA256, 200,000 iterations; social sign-ins store no password at all), your plan, display name and generation preferences.
• Your generation history as seed plus configuration, which is what lets you regenerate any package. Generated package files live on our storage until you delete them or they are reclaimed.
• Your chats only if you turn on chat sync; otherwise they stay in your browser.
• Monthly generation counts on the free plan, and reviews you choose to submit.
• We do not process payments on the platform today, we run no advertising or tracking cookies (one strictly necessary session cookie signs you in), and we never see real financial data because none exists here.

How the service is protected

• Traffic is encrypted in transit with TLS. Hosting and storage run on managed cloud infrastructure provided by Railway; transactional email is sent through Resend; social sign-in tokens from Google, Microsoft and GitHub are verified server side.
• Sessions use httponly, same-site cookies with a short idle timeout. Rate limiting guards sign-up, sign-in, reset and generation endpoints.
• Administrative surfaces are locked to the owner account.

Backups and continuity

• The account database is snapshotted daily, session tokens are removed from the copy, the dump is encrypted with AES-256 using a key held only by the owner, and an off-platform copy is delivered automatically. The restore procedure is documented and has been rehearsed against a real backup.
• Generated packages are not backed up because they are regenerable byte for byte from their stored seed and configuration, which is the product's core guarantee.

Deletion and retention

• You can delete your account yourself from the account page. Deletion permanently removes your account, chats, preferences, usage records and every generated package.
• Contact and demo records that never became accounts are deleted automatically after 24 months, as described in the Privacy Policy.

A signable data processing agreement

Customers on a paid plan who need a signed DPA for vendor onboarding can read the full text at app.syntheticcfo.com/dpa. It commits to exactly what this page describes, names the sub-processors the Privacy Policy discloses, and is executed by email with both parties' legal details completed at signature.

What we do not claim

Reporting a vulnerability

If you find a security issue, email us and you will get a human reply. We ask for reasonable disclosure time and we will credit you if you want credit.