Governance that fits your perimeter
and your audit cycle.

The question is not “can it integrate” but “can it run inside the perimeter under the controls you already attest to.”

An IT and Security leader evaluating AI agent platforms is not asking about feature checklists. The question is where credentials live, where data lives, what the audit trail looks like, and whether the platform can be deployed under the controls you already attest to — SOC 2, ISO 27001, the internal control framework, the regulated environment.

• Where do the credentials live?Syntheka runs in your infrastructure. AI agent credentials, API credentials to your systems of record, approval DAG secrets — all inside your perimeter. The vendor has no path to your systems of record using vendor-held credentials.
• Where does the data live?Inside your perimeter. Self-hosted, or in your private cloud account. No data crosses to us. The LLM traffic stays in your perimeter; we do not proxy LLM calls through vendor infrastructure.
• How does the platform integrate with our systems?MCP-native integrations for SAP (OData / IDoc / BAPI / Events / CDC), Salesforce, NetSuite, QuickBooks, Procore, vendor portals, and custom internal systems. You can write your own integrations if you need to.
• What is the audit trail?Append-only, hash-chained, bi-temporal (transaction time + valid time). The audit trail can be exported as structured JSON for your SIEM, GRC, or audit analytics tooling. Hash chain integrity can be verified on demand.
• How do you handle multi-entity / multi-region?Entity / company / ledger are first-class fields on every action. Cross-entity writes require explicit operator override; the default is refuse. The same applies to multi-region: per-region scoping is enforced, not assumed.
• What is the patch cadence?Public change log; monthly minor releases; security patches applied per the SLA; no silent upgrades. The upgrade itself is auditable through the same chain that agent actions are.

Deployment topology and integration surface.

Syntheka runs in three deployment topologies and integrates with the systems you already have. The integration surface is MCP-native; you can write your own integrations if you need to. The platform runs without any external network access if you need it to.

Honest boundaries for the IT and Security conversation.

If any of these are required for your evaluation, Syntheka is not the right vendor today. We will tell you, and refer you elsewhere if we can.

• No SOC 2 Type II today.We do not yet have a SOC 2 audit attestation. If your procurement requires SOC 2 before pilot, plan to wait or work in a vendor-risk-managed exception. We are explicit about timelines.
• No ISO 27001 today.Same situation. Our documentation covers the equivalent controls; certification is in progress. We can show you the controls matrix.
• No FedRAMP, no IL5, no HIPAA BAA, no PCI DSS.If your environment requires any of these, Syntheka is not ready. We will be explicit about timelines and refer you elsewhere if we can.
• No multi-tenant SaaS today.Self-hosted or your private cloud only. The implication: you run the platform; we support it. There is no shared infrastructure between customers.
• No model hosting included.Syntheka uses external LLMs (OpenAI, Anthropic, etc.) via MCP-native integration. The LLM credentials and traffic are in your perimeter; we do not proxy LLM traffic. Air-gapped deployments use a local or private inference server.

Twelve questions to ask of any AI agent vendor.

Use these against any vendor, including us. If a vendor cannot answer them clearly, treat that as the answer.

1. Where do credentials live — your perimeter, or vendor-managed?
2. Can the vendor's staff access our systems of record with their own credentials, or only with credentials we control?
3. Is the audit trail append-only with a hash chain, and can we verify chain integrity on demand?
4. Do you record bi-temporal timestamps (transaction time + valid time), or only one of them?
5. What is the deployment topology — Docker Compose in our network, our cloud tenant, or air-gapped?
6. Can the platform run without any external network access, including for LLM inference?
7. How do you handle multi-entity / multi-region writes — refuse by default, or allow?
8. What is your patch cadence, and what is the customer-facing change log?
9. What is your model of credential rotation — short-lived tokens, mTLS, both?
10. Is the audit log exportable as structured JSON for our SIEM / audit analytics tooling?
11. What is the upgrade path — rolling, blue-green, or maintenance window — and do upgrades require downtime?
12. What is the exit path — data portability, audit log export, credential revocation, hash chain continuation or verifiable bridge?

Three numbers that matter.

Syntheka's pricing is published, not quoted. There are no per-action variable surprises because there are no per-action variables in the price.

A fixed-fee pilot is $1,500 for one site, 60 days, up to two workflows. The pilot pricing is honored for the first three customers.

Enterprise tier includes the technical evidence pack: deployment topology review, integration security review, hash chain validation report, audit log export schema, and the exit path documentation.

The IT and Security path through the pilot.

Most IT and Security teams we work with run a 60-day pilot on one integration (SAP, Procore, or Salesforce), then expand based on measured results. The pilot ends with a technical evidence pack, not a swap.

1. Week 1: Deployment. Syntheka stands up in your infrastructure (Docker Compose or your cloud tenant). One-command bootstrap. Identity federation with your IdP.
2. Weeks 2-3: Integration. Connect one system of record (SAP, Procore, Salesforce). MCP-native integration takes a day for the first integration. Audit log export to your SIEM configured.
3. Weeks 4-5: Configuration. Configure one approval DAG for the workflow in scope. Set up the rule set, the approver chain, the SoD enforcement, the three-way reconciliation expectation.
4. Weeks 6-7: Pilot run. The agent takes a small set of actions. Every action goes through the approval DAG. Every approval is recorded. Every execution is reconciled. Exceptions are tracked.
5. Week 8: Report. The technical evidence pack is delivered: hash chain validation report, SoD verification record, three-way reconciliation pass rate, bi-temporal export, audit log schema, exit path documentation. Your security team signs off before any production expansion.