Security & Trust

Effective from 2026-10-06 · English translation; the Czech version prevails

Companies on Negotiq entrust agents with their prices, terms and business decisions. This document describes how we protect the Platform, how you can verify the integrity of records yourself, how we handle incidents and how to report a vulnerability to us. It is informative; the binding measures for processing personal data are set out in Annex 1 to the Data Processing Agreement. Capitalised terms have the meaning given in the Terms of Service.

Certifications: The Operator does not yet hold ISO/IEC 27001 certification, a SOC 2 report or any other security certification. Both are planned. Until then we will provide more detailed information or complete a reasonable security questionnaire on request.

1. What the Platform does not do

• It does not hold money. The Operator does not receive, hold or transfer funds of the parties to Deals and does not provide payment services; payments go directly from the Buyer's account to the Supplier's account. The Platform only displays payment instructions and keeps records (Article 7 of the Terms of Service).
• It does not train models on your data. We do not use User Content to train artificial intelligence models; under its contract the generative model provider does not use it for training either.
• It does not let generative AI negotiate. Agents are deterministic rules; the generative model only converts unstructured price lists and a human always reviews the result (AI Governance statement).
• It does not track you. Neither the app nor the legal pages load analytics, advertising or tracking code, or third-party fonts or scripts. The page language follows your browser settings, without asking any other service.
• It does not sell data. We sell neither personal nor business data; market benchmarks are published only in anonymised, aggregated form from deals of at least two different Suppliers.

2. Access and accounts

• All communication with the Platform is encrypted over HTTPS (TLS).
• Passwords are stored only as Argon2id hashes. Recovery codes, sign-in sessions and API keys are stored only as cryptographic hashes; an API key is displayed only when created.
• The session cookie is HttpOnly, Secure and SameSite=Lax; for requests that change data we check the Origin header (CSRF protection).
• After 5 failed sign-in attempts the account is locked for 15 minutes; a password change signs out all devices. The API is subject to rate limits.
• Who may do what is determined by roles assigned by the Organisation Administrator (e.g. the right to approve Offers). The Organisation Administrator creates, names and revokes API keys and sees the Organisation's audit records.

3. Customer separation

All access to data is limited to the Organisation of the signed-in User or API key; the Platform rejects any request for another Organisation's data. Automated tests verify this separation on every change. Demo data are kept separate from real companies' data. Before a Deal is concluded, the counterparty sees neither the other party's identity nor its limits.

4. Integrity and verifiability of records

• Audit Chain. We write material actions to a chain to which entries can only be appended. Each entry contains the hash of the previous entry, and a database trigger blocks alteration or deletion of entries, so any tampering is detectable.
• Ed25519 signatures. Mandates, Receipts, AP2 Records (IntentMandate, CartMandate, PaymentMandate) and Audit Chain exports are signed with the Platform's key. The public key (algorithm, key and key identifier) is available at https://app.negotiq.synqflows.com/api/trust/public-key and in JWKS format at https://app.negotiq.synqflows.com/.well-known/jwks.json; AP2 Records carry signatures in JWS format (EdDSA). Signatures of Mandates, Receipts and AP2 Records can also be checked directly through the API's verification endpoints.
• Public check. At https://app.negotiq.synqflows.com/api/trust/chain anyone can see whether the Audit Chain is intact, including the signed latest hash; https://app.negotiq.synqflows.com/api/trust/status shows that production does not use development signing or encryption keys.
• Custodial attestation. Records are signed by the Operator with its own key, not with keys held by the parties. The signature proves that the record originated on the Platform and has not been altered since signing; on its own it does not prove that a party signed it — the link to the acting person is provided by sign-in, roles and the Audit Chain. When we rotate the key, we will publish the new key with a new identifier and keep earlier public keys available for verifying older records.
• Webhooks. Notifications are signed with HMAC-SHA256 under the Standard Webhooks specification (headers webhook-id, webhook-timestamp, webhook-signature). Verify both the signature and the age of the message and keep the secret out of source code.

5. Data protection

• Encryption in transit (TLS) and at rest at the hosting provider.
• Credentials for connected systems (ERP) and Webhook signing secrets are encrypted with AES-256-GCM. Credentials are used only to fetch the price list on a User's instruction; we recommend creating a dedicated user with read-only access and the minimum necessary permissions for the connection.
• Attachments are accepted only in permitted formats and sizes, served only to authorised persons and always as downloads, never rendered in the browser.
• Messages to the Intake Address are imported automatically only from Verified Senders; others wait for confirmation in the app. Sender, subject, time of receipt and attachments are deleted after 90 days.
• Agents do not treat the content of price lists, specifications, attachments or e-mails as instructions (protection against prompt injection).
• For prospective suppliers we keep only generic company contacts.

6. Operations, backups and logs

• The application and database run at the hosting provider listed in section 9. The database is backed up regularly; backups are overwritten in the regular cycle within 90 days at the latest.
• Operational logs (including IP addresses) and Webhook delivery records are kept for at most 90 days, Audit Chain entries for 10 years.
• Access to the production environment is limited to authorised Operator personnel bound by confidentiality.
• Dependencies are pinned to exact versions. On every change we automatically test security invariants: separation of Organisations, compliance with Agent limits and confidentiality of ceilings and minimums.

7. Incidents and breach notification

1. We assess every security incident, contain its impact, remove its cause and document it.
2. We inform affected customers without undue delay. We notify the Controller of a personal data breach concerning data we process as processor within 48 hours of becoming aware of it at the latest (Article 5 of the Data Processing Agreement).
3. Where we are the controller, we notify a personal data breach to the Czech Office for Personal Data Protection within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to the rights and freedoms of natural persons (Art. 33 GDPR); where the risk is high we also inform the affected persons without undue delay (Art. 34 GDPR).
4. After an incident is closed, we provide affected customers on request with a summary of its causes and the measures taken.

8. Vulnerability reporting

Please report vulnerabilities to inquiry@negotiq.synqflows.com. Contacts and rules are also available in the machine-readable file https://app.negotiq.synqflows.com/.well-known/security.txt.

• Include a description of the vulnerability, the affected address or interface, steps to reproduce and the potential impact; Czech and English are accepted.
• We will acknowledge your report without undue delay, keep you informed of progress and, with your consent, publicly thank you after the fix. We do not pay monetary rewards (bug bounty).
• Rules: test only with your own accounts and data; access other persons' data only to the extent necessary to demonstrate the vulnerability, do not modify or delete anything and do not retain data obtained; do not perform denial-of-service attacks, social engineering, phishing or physical attacks; do not send bulk messages to Intake Addresses; do not disclose the vulnerability until we have fixed it or 90 days have passed since your report, unless we agree otherwise.
• Safe harbour: We consider research conducted in good faith and in accordance with these rules to be authorised, and we consent to access within that scope. We will not take legal action against you or file a criminal complaint, and if a third party initiates such action we will confirm that you acted in accordance with these rules. We cannot give consent on behalf of third parties (e.g. the hosting provider or Third-Party Services).

9. Data location and sub-processors

The binding list and the rules for changes (notice at least 14 days in advance with a right to object) are in the Data Processing Agreement (Article 4). Systems chosen by the Organisation (ERP, product feeds, Webhook endpoints, third-party agents) are not our processors; we transmit data to them on its instruction.

10. Business continuity

We strive for continuous availability, but without a service level agreement (SLA) agreed in writing we do not guarantee any level of availability or recovery time. We back up the database regularly and announce planned maintenance in advance where possible. You can export your Organisation's data at any time free of charge (JSON), and download Receipts and AP2 Records and verify them with the public key even without access to the Platform.

11. Contact

• Security and vulnerabilities: inquiry@negotiq.synqflows.com
• Data protection: inquiry@negotiq.synqflows.com
• Other enquiries and DSA point of contact: inquiry@negotiq.synqflows.com