Security that earns trust
Your pipelines move important data. This page explains how we protect it, where it lives and what we are still working on.
Security by design
Infrastructure
Synchronoid runs on a major cloud provider in isolated production accounts. Workers run in separate, short-lived containers. Infrastructure is defined as code and changes are peer reviewed.
Encryption
All traffic uses TLS 1.2 or higher. Stored data, including raw payloads, backups and secrets, is encrypted at rest with AES-256. Secrets are kept in a dedicated secrets manager and never written to logs.
Access control
Role-based access applies per workspace and project. Our own staff have no standing access to customer data. Support access needs a ticket, is time-limited and is logged.
Single sign-on
Team workspaces support Google SSO. Enterprise workspaces support SAML, which our team sets up with you. Self-service setup is on our roadmap. API tokens are scoped and can be rotated at any time.
Audit logs
Enterprise workspaces get an audit log of sign-ins, permission changes, secret updates and source changes. Every value in your data also carries provenance.
Backups and recovery
Databases are backed up continuously with point-in-time recovery for 14 days. Backups stay in the same region as the primary data. We test restores every quarter.
You choose where your data lives
Each workspace is created in one region. Raw, staged and published data, run metadata and backups stay in that region.
- EU (Frankfurt, Germany) for teams with European data requirements.
- US (Virginia) for teams that prefer North American hosting.
- Dedicated regions and private networking are available on Enterprise.
Where we are today
- SOC 2 Type II: in progress. The audit window opened in Q3 2026. We have not yet received a report.
- GDPR: we offer a Data Processing Agreement.
- Penetration tests: independent tests run at least once a year and after major changes. A summary is available under NDA.
- Vulnerability management: dependencies are scanned continuously and critical fixes ship within days.
Found a vulnerability?
We appreciate reports from security researchers. Email security@synchronoid.com with steps to reproduce. We will acknowledge your report within two business days and keep you updated.
- Give us reasonable time to fix an issue before you disclose it.
- Do not access data that is not yours, and do not disrupt the service.
- Do not run automated scans that generate heavy traffic.
We will not take legal action against good-faith research that follows these rules. We do not currently run a paid bounty program.
Companies that help us run Synchronoid
We use the following subprocessors to deliver the service. We will notify customers of changes under the DPA.
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloud infrastructure provider | Hosting of compute, storage and databases | Germany (EU), USA (US) |
| Managed database provider | Run metadata and application database | Same region as workspace |
| Email delivery provider | Transactional email and alerts | EU |
| Error and log monitoring provider | Service logs with personal data removed | EU |
| Customer support platform | Support tickets and conversations | EU |
| Payment processor | Billing for paid plans | EU, USA |
Live availability: System status · Questions: contact us