Security & AI Governance
Symma is engineered from the ground up for high-growth e-commerce brands that require ironclad data isolation, real-time catalog grounding, and enterprise cloud compliance.
Google Cloud Vertex AI
Core intelligence and multimodal embeddings powered directly by Google Cloud Vertex AI infrastructure, featuring automated failover and secure low-latency API boundaries.
End-to-End Encryption
All network traffic is enforced over TLS 1.3 in transit. At rest, all persistent store data, product vectors, and configuration secrets are encrypted using industry-standard AES-256.
Multi-Tenant Data Isolation
Strict logical and database-level tenancy. PostgreSQL pgvector embeddings are keyed by merchant store ID with strict tenant boundary checks across all query paths.
Zero Model Training Guarantee
Under our enterprise Vertex AI agreements, merchant catalogs, customer queries, and uploaded shopper images are NEVER utilized to train public foundation models.
Least-Privilege API Scopes
Our Shopify and Comez platform integrations request strictly read-only permissions for product catalogs and order status. We never request or store raw customer payment methods.
Continuous Audit & Monitoring
Automated vulnerability scanning, container image verification, structured audit logging, and continuous uptime monitoring with real-time health checks.
How We Protect Your Store’s Intellectual Property
A primary concern for modern merchants deploying artificial intelligence is whether their proprietary catalog descriptions, inventory strategies, and customer questions will be harvested to train public AI models.
The Symma Guarantee:
- No Model Training: Google Cloud Vertex AI terms explicitly mandate that Customer Data (inputs, prompts, and embeddings) are never used to train or fine-tune Google foundation models.
- Ephemerality: Multimodal image queries uploaded by shoppers are processed in RAM to compute 768-dimensional visual vectors and discarded immediately after inference.
- Hallucination Defense: We utilize strict Retrieval-Augmented Generation (RAG) with reciprocal rank fusion (RRF). If a product or policy does not exist in your live database, Symma declines to guess.
Cloud Compliance & Certifications
Symma’s cloud services are hosted within Google Cloud Platform datacenters adhering to the most stringent international compliance frameworks:
SOC 2 Type II
Security & Availability
ISO/IEC 27001
Information Security
GDPR & CCPA
Global Privacy Standards
PCI-DSS Ready
Zero cardholder exposure
Data Retention, Purge & Disaster Recovery
We believe in data minimization. When you uninstall Symma or terminate a subscription:
- Active API connections to your Shopify or Comez store are severed immediately.
- All store knowledge embeddings, vector indices, and cached catalog records are deleted within 30 days.
- Merchants may trigger an immediate cryptographic purge of all store data at any time by contacting our security team.
- Automated encrypted backups are retained in isolated multi-region buckets for disaster recovery and rotated on a rolling 14-day schedule.
Vulnerability Disclosure & Bug Bounty
We welcome responsible security disclosures from white-hat researchers and developers. If you identify a vulnerability in any of our public endpoints or widgets, please report it directly to our security engineering team:
Symma Security Operations
Security Response Email: security@symma.shop
PGP Public Key available upon request. We review and triage security reports within 12 hours.