Your team's data: where it lives, who can reach it, how it is protected.

SYSWERX screens researchers' ties to listed entities using public sources, and keeps each team's screenings, cases and documents private to that team. This page says where that data lives, who can reach it and how it is protected. Questions go to [email protected].

Who we are

SYSWERX LLC, a South Carolina limited liability company, owned and operated in the United States. Security contact: [email protected].

Where it runs

• Application: Render, Oregon, behind Cloudflare.
• Database, sign in and documents: Supabase on AWS, U.S. West (Oregon).
• Email: Resend sends sign in links and notifications. It receives the address and the message, nothing from a case.
• Billing: Stripe. It never receives researcher data.

Who can get in

• Accounts are issued by SYSWERX to the people your office names. Each sign in uses a link sent to that person's work email; it works once, and there are no passwords to lose.
• One active session per person, with automatic sign out after 60 minutes idle.
• Team roles: Lead, Analyst and Viewer, who can read but not change. Restricted cases are visible only to the teammates named on them.
• Travelers and researchers who receive a secure link see only their own disclosure, briefing or request, and never need an account.

How a team's data is walled off

• Every read and write goes through the SYSWERX server and is scoped to the team. Browsers have no direct access to the database.
• Other teams never see whom you screen, your cases or your documents.
• The scoring engine and the watchlist run only on the server. Neither is sent to the browser.

Integrity

• The watchlist feed is human verified, cited and digitally signed (ECDSA P-256). If the signature does not verify, screening stops rather than report a false all clear.
• Each case's history is a chained, keyed audit trail (HMAC). A Verify check shows any change made after the fact.
• Each record keeps its inputs, so it can be run again later and compared line by line.

What we keep for your team

• Screening records (your audit log), the monitoring roster, cases (findings, notes, requests, decisions) and identity review decisions.
• Documents only when a user chooses to keep them (below).
• The work email and role of each team member.

Documents: CVs, biosketches and disclosures

• Read in the analyst's browser by default. A copy is kept only when the user ticks "Keep copies".
• Kept copies sit in private, per team storage, are opened only through the server, and carry a SHA-256 fingerprint so any copy can be proven identical.
• PDF, Word or plain text, checked by content, up to 20 MB. Every upload, download and deletion is logged. A Lead can delete a file; its name and fingerprint stay on record.

Public records, and what the services behind them see

Screenings read public scholarly, funding, patent and registry records. Screenings query from SYSWERX servers; name searches, the Network Analyzer and some funding lookups query from the analyst's browser. The services behind those records see the lookup, a name or an identifier, never your team's records.

Retention and deletion

Records are kept while your team's account is active. Deleting the team deletes its records and stored documents. On written request at the end of an agreement, SYSWERX returns a team's data in a commonly used format and then deletes it; copies held in routine backups are deleted on their normal schedule and kept confidential until then.

Use and fairness

• SYSWERX screens ties to listed entities, not people. Nationality, ethnicity, national origin and name are never scoring inputs.
• Output is a prioritization aid for human review, not a finding of wrongdoing, and never a clearance.

Certifications and questionnaires

SYSWERX does not hold a SOC 2 report or a FedRAMP authorization at this time. We answer institutional security questionnaires in writing; ask at [email protected]. Report a security concern to the same address and it reaches a person the same day.