Syndu is a threat observatory beacon that collects outside-in traffic signals from the public edge. Connected-user activity inside the app is excluded from the risk model, and account, billing, subscription, and social sign-in workflows stay outside the evidence graph.
Syndu collects public-facing traffic signals that reach the observatory surface and turns them into behavioral context. That is the material used for risk scoring: outside-in signal, not customer self-reporting.
Traffic generated by signed-in users while working in the app is obscured and excluded before scoring. Dashboard activity, support interactions, documentation reads, websocket control traffic, and other account-bound product operations are filtered out as a prerequisite step so customer use of Syndu never inflates the evidence graph.
Syndu keeps the minimum account information needed to provision access, notify users, respond to support or security events, and communicate about the service. Account records are not part of the threat observatory dataset and are not mixed into report scoring.
If a user chooses Google Sign-In, Syndu requests only the basic Google account data needed for authentication and account matching: the user's Google account identifier, email address, email-verification status, and the basic profile fields Google returns for sign-in, such as name and profile image. Syndu does not request Gmail, Drive, Calendar, Contacts, or other Google Workspace content for this sign-in flow.
Google, GitHub, and Microsoft sign-in data is used to authenticate the user, link the sign-in to the right Syndu account, prevent duplicate account paths, establish a secure session, and communicate about account access, support, billing, or security events. Identity-provider data is not used as threat-observatory input, does not change risk scoring, is not used for advertising, and is not used to train generalized AI or machine-learning models.
Syndu does not sell Google user data or publish it into the evidence graph, workspace memory, or the shared hive layer. Identity-provider data may be processed only by service providers that host Syndu infrastructure or deliver account email on Syndu's behalf, and may be disclosed when required for platform security, fraud prevention, or legal compliance.
Account identity records are stored in protected application databases and transmitted over encrypted connections. Administrative access is limited to people operating the service, and Syndu retains audit and security records needed to detect misuse, investigate abuse, and protect user accounts.
Syndu keeps account and sign-in records while an account remains active and as long as needed for subscriptions, security, fraud prevention, support, and legal compliance. Signed-in users can start irreversible account closure from the Access dashboard, which cancels active subscriptions, revokes credentials, and emails a confirmation link before deletion is finalized. Users who cannot reach the dashboard can request account and social-sign-in data deletion by emailing admin@syndu.com. Paid subscribers may also open the request through the Syndu support desk. When a verified deletion request is completed, Syndu removes or anonymizes account-linked identity data from active systems except where limited retention is required for payment, security, or legal obligations.
Syndu does not process subscription payments directly on the website. Instead, the service sends a subscription payment request to the customer's secure email account, and the customer can approve the subscription directly with PayPal. When PayPal confirms the subscription, Syndu provisions the account and notifies the user.
Syndu can only act as a trustworthy shared context layer if customer operations stay separate from the evidence graph. This privacy commitment protects the integrity of the reusable context, memory, and scoring surfaces buyers are paying for.
Syndu turns outside-in network behavior into shared cyber-and-fraud context, then preserves decisions in memory for humans, applications, and agents. This manual is the public map of that platform: the evidence graph, the Risk API, the MCP server, and the governance layer that ties them together.
Syndu exposes a dimensional risk surface across network entities and geography: ip address, subnet, ISP, ASN, organization, city, region, and country. That same dimensional graph powers the Risk API, MCP tools, and the memory loop that preserves the resulting decisions.
Syndu is an external context layer for monitoring, hygiene review, agent workflows, and decision support. It complements SoC and SIEM processes rather than replacing them, while sharing the same evidence and memory model used elsewhere on the platform.
Syndu is also a decision surface for fraud, payments, merchant-risk, and trust workflows. The same outside-in evidence graph, Risk API, and governed memory loop help teams score, review, and preserve conclusions around risky identifiers.
The platform supports three access surfaces at scale: direct report access for large-scale browser or agent consumption, the Risk API for application-native scoring, and the MCP server for collaborative agent workflows.
Syndu is one platform with three access surfaces: direct access for report-shell consumption, API access for application-side scoring, and MCP access for agent collaboration. They sit under the same workspace, quota, and subscription control plane, but differ in delivery contract.
Registration unlocks the workspace control plane, plan selection, credential provisioning, and the subscription flow across web, API, and MCP access.
