Security at Syncendio

1. Our approach

Syncendio handles business-critical data — inventory, purchasing, and sales records — so security isn't optional. This page summarizes how we protect that data in plain language, and what we have not done yet. Our commitments on incidents and breach notification are set out in section 8 below and, for business customers, in our Data Processing Agreement.

2. Encryption

All traffic between your browser and Syncendio is encrypted in transit via HTTPS/TLS. Your data is also encrypted at rest: the databases that hold it and the storage that holds our backups both encrypt what they store, as standard, using keys managed by the hosting providers. Backup files are written encrypted, and the credentials we hold for services you connect are encrypted separately before they are stored.

3. Payment security

We do not collect or store payment card details. The 14-day trial needs no card, and a paid subscription is arranged with you directly rather than bought through this website — so there is no card number for us to hold, and none passes through our systems. If we add card payment, we will name the processor here before we do.

4. Access controls

Access to production systems and customer data is limited to people who need it to do their jobs. Everyone has their own login — accounts are never shared — and what each person can see and do is set by their role.

Multi-factor authentication is available on staff accounts and on our own administrator accounts, and we recommend turning it on. Sign-in attempts are rate-limited and an account locks after repeated failures.

When our support staff need to look at your workspace, they do not use a shared password. Access is granted for a limited time, is recorded, and can be made read-only or withdrawn by you at any time. Every session ends on its own.

5. Infrastructure & hosting

Syncendio runs on Microsoft Azure in Canada, and customer databases are hosted on Azure too. It is an established provider with independent security certifications, which it publishes itself.

Each workspace gets its own database rather than a shared one with a column marking which rows belong to whom. One workspace's records are not reachable from another's connection. Backups are written to storage kept in a separate region from the databases, so a problem in one place does not take both.

Where your data is stored is set out in our Data Processing Agreement, which is the authoritative statement and is kept current.

6. Backups & availability

Every database is backed up daily, encrypted, and kept for 30 days before it is removed. Backups go to storage in a different region from the live databases.

Backups exist so we can put data back, which means a restore has to be something we have actually done rather than something we assume will work. Our hosting providers also keep their own short-term recovery points, which is a second route back and not a replacement for ours.

7. Vulnerability management

We keep our dependencies current and apply security updates promptly. Every change runs through an automated suite before it can be released, and changes to anything touching money, stock or access are reviewed before they ship.

We would rather tell you where we are than imply more: we have not yet commissioned an independent penetration test, and we do not currently run an external bug-bounty programme. If either matters to your own security review, please ask — we would rather have that conversation than have you assume.

8. Incident response

If something goes wrong, our first steps are to contain it, work out what was affected, and tell the people who need to know.

Where an incident affects personal data we meet the notification requirements that apply, including the GDPR's 72-hour deadline for telling a supervisory authority where that applies, and United States state breach-notification laws where they apply. If you are a business customer, we will tell you without undue delay so that you can meet your own obligations — the specific commitment is in our Data Processing Agreement, which is what binds us.

We will tell you what we know when we know it, including when the picture is still incomplete.

9. Subprocessors

We use a limited set of third-party providers ("subprocessors") to operate the Service:

• Microsoft Azure — application hosting, backup storage, and hosting of this website.
• Resend — email delivery, including the documents you send to your own customers and suppliers.
• Cloudflare — telling a person from an automated script on our sign-up and contact forms.
• Google Analytics — understanding how the public website is used.
• Anthropic — reading documents and photographs you upload, and answering questions you type into the in-app help assistant.

If you connect your workspace to another system, that provider receives what you send it: ShipStation for shipping, Xero or QuickBooks Online for accounting, and Shopify for catalogue and stock. Nothing goes to any of them unless you set the connection up.

Our public marketing website uses Google Analytics to understand how it is used; it is not used inside Syncendio itself. We also count visits ourselves, on our own systems, storing no IP address and sharing nothing. We use no advertising provider and run no advertising.

We review subprocessors for appropriate security practices before onboarding them. The authoritative list, with each provider's purpose and location, is Annex 3 of our Data Processing Agreement.

10. Report a security issue

If you believe you've found a security vulnerability in Syncendio, please report it to security@syncendio.com. We ask that you give us a reasonable opportunity to investigate and address any issue before public disclosure, and that you avoid accessing or modifying data that isn't yours during testing.