Regulated industries
Training data, compute and weights stay in your AWS account.
Banks, insurers, healthcare providers and public bodies often can't send records to a hosted model provider at all. SynqTune runs every step on instances in your own AWS account and writes every file to your own bucket.
The problem
Records can't leave your environment
Policies and contracts often rule out sending data to third-party model providers, for training or for inference.
Security reviews take months
A new vendor with access to production data means a long review. A role you create and can delete is easier to approve.
You need to show what happened
Auditors ask where data went, who touched it and what model was trained on it.
What stays in your account
- Compute runs on EC2 instances in your account and terminates when the run ends
- Datasets, checkpoints and model weights are written only to your S3 bucket
- Access is one IAM role with a per-organization External ID, revocable by deleting it
- Provider API keys, if you use LLM grading or comparison, are encrypted with AWS KMS
What you can show an auditor
Each run is recorded with the model version it produced.
- The comparison with your current LLM is optional and sends only held-out inputs, to the provider you choose
- Every run records its settings, data location and evaluation with the model version
What you need
Any supported file in an S3 bucket the role can read: JSONL, JSON, CSV, TSV or Parquet.
Security model
SynqTune coordinates the work. Your account does it.
Access is granted through one IAM role you create and can delete at any time. Datasets, compute and model weights stay in your AWS account.
Read the CloudFormation templateSynqTune control plane
Pipeline settings · run status · KMS-encrypted provider keys
Your AWS account
S3 data
raw/ · data/
EC2 workers
CPU + GPU, spot
S3 model
model/<run>/
Per-organization External ID
The IAM role can only be assumed by SynqTune together with your organization's unique External ID, so no other customer can point SynqTune at your account.
No long-lived keys
You never paste AWS access keys. SynqTune receives short-lived credentials from STS each time it acts.
IMDSv2 on every instance
Worker instances require session tokens for the EC2 metadata service, which blocks a common way of stealing instance credentials.
Scoped uploads
Upload links are signed by your own role, expire after an hour, and the bucket only accepts them from the SynqTune web app.
Encrypted provider keys
API keys for Claude, OpenAI or Gemini are encrypted with AWS KMS and are never shown again after saving.
Revocable at any time
Delete the CloudFormation stack or the IAM role and SynqTune can no longer act in your account. Your bucket and data stay.
Transparency
What runs where
Exactly what lives in your account and what SynqTune stores.
| Item | In your AWS account | Stored by SynqTune |
|---|---|---|
| Training data | Stays in your S3. Browser uploads go straight into your bucket. Only the optional LLM grading step and the optional comparison send records out, to the provider you pick. | The S3 path you chose. |
| Compute | EC2 instances in your account, terminated when the run ends. | None. SynqTune starts and stops instances through the IAM role. |
| Model weights | Written to your S3 bucket. | The storage path and evaluation results. |
| Pipeline settings | Copied to the instance for the run. | The settings you chose. Provider API keys are encrypted with AWS KMS. |
| Run status | — | Step progress and training metrics reported by the instance. |