Security & data handling

API authentication

Public map preview is proxied from intel-service /public/grip-map. Paid delivery uses X-Intel-Api-Key on /api/v1/*.

Data processed

• Open-source conflict and event data (ACLED, UCDP, GDELT)
• Country-level sanctions programme flags (not entity lists)
• Aggregated risk scores and narrative synthesis
• No policyholder PII in the intelligence feed

LLM subprocessors

Narrative synthesis may use xAI (Grok) and Anthropic (Claude Haiku) under strict daily budget controls. Paid live search is gated by tripwire and score thresholds. Full subprocessor list provided in enterprise DPA pack.

Transport & hosting

• HTTPS enforced in production (TLS at reverse proxy, HSTS enabled)
• Baseline security headers on app responses (X-Frame-Options, nosniff, Referrer-Policy)
• PostgreSQL and Redis on private infrastructure (intel-service)

GDPR & contracts

Data Processing Agreement and standard contractual clauses available for EU insurers on request. GRIP_ins is a B2B intelligence feed — clients remain data controller for underwriting decisions.

Enterprise delivery

• API key rotation supported
• Alert routing via email / Slack — enterprise contract (default: Synlogica ops configuration)
• Audit trail via daily snapshot tables
• Incident contact: sales@synlogica.pl