Trust & Compliance

Built for teams that can't
afford to get this wrong.

Enterprise adoption of synthetic data hinges on one question: can we trust this? Here is exactly how SynthPipe works, what we store, and what regulations it satisfies.

Methodology

How the data is generated.

SynthPipe uses rule-based statistical generation — not generative AI models — to produce synthetic records. This is deliberate: deterministic rules produce verifiably correct outputs with no hallucinated values, no model bias inherited from training corpora, and no possibility of memorized real data leaking into outputs.

Statistical distributions

Numerical fields (age, salary, lab values, scores) are drawn from realistic distributions — normal, log-normal, or bounded uniform — calibrated to real-world ranges. A patient's HbA1c value will fall in a clinically plausible range for their stated diagnosis.

Domain-specific rules

Each category ships with bespoke logic: job titles match their industry vertical, medication names match diagnoses, salary ranges match seniority levels, and addresses are geographically coherent. These rules are maintained and extended continuously.

Contextual consistency

Fields within a record are generated together, not independently. A record with diagnosis "Type 2 Diabetes" will have elevated HbA1c, age-consistent demographics, and plausible medications — not random values that happen to share a row.

No real data — ever

SynthPipe does not ingest, train on, or reference any real individual's data. Names, addresses, SSNs, and identifiers are algorithmically constructed. There is no database of real people that outputs could accidentally match.

Quality

What "realistic" actually means.

Realistic synthetic data must pass the same validations your real data does. Here are the properties SynthPipe guarantees on every output.

100%

Field completeness

Every requested field is populated on every record. No nulls unless you explicitly request nullable fields.

20+

Domain schemas

Each schema has been manually reviewed for field-level realism: plausible value ranges, correct formats, and domain vocabulary.

0

Real PII in outputs

Verified by construction: no lookup tables of real individuals. All identifiers are algorithmically generated.

Bias controls

By default, SynthPipe applies balanced demographic distributions: names are drawn from diverse multi-cultural pools, gender representation is even unless specified otherwise, and geography is distributed across regions rather than concentrated. Demographic fields are generated together (name, gender, ethnicity if applicable) to maintain internal consistency and avoid the compounding bias that appears when fields are generated independently.

Example: Medical record output

Each field is independently realistic and consistent with the others.

Sample record — medical category
{
  "patient_id":    "PT-00491",
  "name":           "Maria Chen",
  "age":            58,
  "gender":         "Female",       // consistent with name
  "diagnosis":      "Type 2 Diabetes",
  "hba1c":          7.9,            // plausible for diagnosis
  "medications":    ["Metformin", "Glipizide"],  // matched to condition
  "blood_pressure": "138/88",       // age-appropriate range
  "last_visit":     "2025-11-03",
  "insurance":      "Blue Cross PPO"
}
Privacy

What we store. And what we don't.

SynthPipe's privacy model is simple by design: the less we hold, the less there is to protect.

What SynthPipe stores

  • Your account email address
  • A hashed password (bcrypt)
  • Your API key (used for authentication)
  • A usage counter (records generated this month)
  • Custom templates you explicitly save

What SynthPipe never stores

  • The data you generate — discarded after response
  • Your query history or request logs
  • IP addresses beyond rate limiting (cleared hourly)
  • Any third-party tracking or advertising cookies
  • Payment card details (handled entirely by Stripe)

Data flow summary

You send a query → SynthPipe generates records in memory → the response is returned to you → the records are gone. Nothing is written to disk, logged to a database, or passed to a third party. Your generated data is yours and only yours for the duration of the HTTP response.

Compliance

GDPR and HIPAA — what applies.

These are the two regulations enterprise buyers ask about most. Here is the precise answer for each.

GDPR (EU General Data Protection Regulation)

GDPR applies to the processing of personal data — information relating to an identified or identifiable natural person (Article 4(1)).

SynthPipe outputs contain no real natural persons. They are algorithmically generated and cannot be traced back to any individual. They are therefore not personal data and fall outside GDPR's scope.

SynthPipe's own data processing (your account) is minimal: email, hashed password, API key. This is covered by our privacy policy and handled under legitimate interest for service delivery.

HIPAA (Health Insurance Portability and Accountability Act)

HIPAA's Privacy and Security Rules protect Protected Health Information (PHI) — health data linked to a real individual.

SynthPipe medical records are created without any real patient data. They are not derived from, linked to, or traceable to any real person. They do not constitute PHI and are outside HIPAA's jurisdiction.

You do not need a Business Associate Agreement (BAA) to use SynthPipe medical data for ML training, testing, or development. If your use case requires a formal legal opinion, we recommend consulting your own counsel.

Enterprise procurement note: If your legal or security team requires a written data processing agreement, security questionnaire response, or compliance attestation, email us at support@synthpipe.com. We're happy to work through procurement requirements directly.

Get started

Ready to try it?

500 records free. No credit card. No commitment.

View pricing Talk to us