Syntica for Enterprise
Your cloud, your rules.
Run your apps in your own AWS account and decide exactly who can do what in every environment. Your teams keep building the same way, in a chat with Claude. Some apps better off with us? They can stay on our hosting.
At a glance
Where it runs
Your AWS account
In Frankfurt (eu-central-1) today. Need another region? Talk to us. Our hosting in Frankfurt stays available too.
Our access
One fenced role
Only resources made for Syntica. It can't touch your IAM users or your own roles.
Billing
On your AWS invoice
In your own account, AWS bills machines and traffic. The platform price is agreed with you.
Who can do what
Your own roles
Built from single permissions, given per app and environment.
The same Syntica, in a place you control
Your account runs the apps. Syntica runs the workflow.
Each environment gets its own server in your account, behind a load balancer in your account, with HTTPS certificates issued there. Syntica keeps what it needs to run the workflow: the chat connection, deploys, who can do what, the activity log, app logs, settings that are not secret, and the organisation-wide secrets and connection credentials, encrypted.
On hosted Syntica, the same apps run on their own servers, one per environment, in our AWS account in Frankfurt. You can mix both in one organisation.
Agents build inside the limits your admins set.
Your admins choose which databases an agent may create in your account, and how large. Anything outside that becomes a request one of them approves or declines, with an estimate of what it costs.
Every database is encrypted, only accepts SSL connections, is never public, and takes a final snapshot before it is deleted, unless it never held data.
Choose where each environment runs.
Make your account the default for the whole organisation, or pick it for one app's production and keep development with us. Your own domain works too, with the certificate issued in your account.
Your account connects in Frankfurt (eu-central-1) today. Need another region? Tell us. Pick from the same machine sizes as on our hosting, and AWS bills you for what runs.
Custom roles
Roles that match how your company works
Build your own roles from individual permissions. Then give each one to a person or a group, for one app and environment or for all of them.
Pick exactly what a role may do
A role works in one environment or across the organisation. Tick the permissions it needs and leave the rest out. For example:
Release managerPer environment
Deploys and promotes to production, but never reads secrets
Database auditorPer environment
Reads the production database, but can't change it
Support leadPer environment
Reads logs and restarts the app, nothing else
Security officerOrganisation
Views the audit log and manages the security checks
Change a role once and everyone who holds it changes with it. Nobody can give access they don't hold themselves, and every change lands in the activity log.
What your security team will check
Connecting is one CloudFormation stack. The limits are in the template, for anyone to read.
Access
Only what Syntica made
- ✓Changes only resources tagged for Syntica, in the network the stack created. It can list, not change, your other servers and databases in that region
- ✓No access to your IAM users or your own roles. It can only create roles named syntica-env-*, each fenced by a fixed permission boundary it cannot change
- ✓Trusted only with an external ID unique to your connection
Servers
Known images, no open server ports
- ✓Servers start only from Amazon's images or Syntica's published one
- ✓Each server connects out to Syntica with its own certificate. The key never leaves it
- ✓Patching runs through AWS Systems Manager, in your account
Control
You decide, and you can leave
- ✓Each template update explains what it allows. You apply it, when you choose
- ✓Remove the stack and our AWS access ends. The servers stay yours. Stop or remove the Syntica agent on them to close the last connection
- ✓Default addresses stay 7 days, and your admins hear from us on day 1 and day 5
How it starts
From a first call to an app in your account
1
Talk to sales
We go through your AWS setup, your regions, the roles you need and what your security team wants to see first.
2
Connect the account
Open the link, review the stack in the AWS console and create it. Syntica shows each step as it completes.
3
Pick it per environment
As the default for everyone, or only for the environments that need it.
4
Build as you already do
Ask Claude for a change and it goes live on your own server. Nothing changes for the people building.
Questions IT asks first
Can we read the template before we connect?
Yes. It is public and versioned, and every update comes with a plain-language note on what it lets Syntica do and why.
Where does our data live?
Syntica itself runs in the EU, in Frankfurt. With your own AWS account, your apps and their data run in your account, in Frankfurt (eu-central-1) today. Talk to us if you need another region.
Does Syntica keep a copy of our data?
Your servers and databases stay in your account, and so do the secrets you set for an app or an environment. Syntica keeps what runs the workflow: who can do what, the build history, the activity log, app logs and settings that are not secret. Secrets you set for the whole organisation and the credentials for connections are kept encrypted in Syntica's AWS account in Frankfurt.
What happens if we stop?
Remove the stack and our AWS access ends. The servers, the databases and the code are yours. Stop or remove the Syntica agent on the servers to close the last connection. Default addresses keep working for 7 days so you can move your own domain over.
What does it cost?
In your own account, AWS bills you for the servers, databases and traffic. Syntica's part is agreed with you. Talk to us about pricing for your setup.
Talk to us about Enterprise
Tell us about your AWS setup and how your teams work. Every message is read by the people who build Syntica.
Get your spot in the beta.
We open spots from the waitlist, oldest first. When yours opens, the free tier is a real environment with a real URL. No card.
We use cookies
We use essential cookies to run the site and optional ones to understand usage. See our Privacy Policy.