Skip to content
SyncedOffice
Menu

Platform

Security and client isolation

How SyncedOffice keeps each customer organization apart: its own namespace, database, sign-in realm and ERP instance, reached only through a Cloudflare Tunnel and hosted in the US.

How is each customer organization kept apart?

Six facts, each from our claims register with its evidence and the date it was last verified.

  • Its own namespace

    Every customer organization's workspace runs in its own Kubernetes namespace, with its own resource quota.

  • Its own database

    Every customer organization's workspace has its own PostgreSQL database cluster. No database is shared between organizations.

  • Its own sign-in realm

    Every customer organization's workspace has its own sign-in realm, so its users and roles are kept apart from every other organization's.

  • Its own ERP instance

    Every customer organization's workspace runs its own ERP instance, built on Moqui and MarbleERP. No ERP is shared between organizations.

  • No public web ports

    Web traffic reaches our servers only through an encrypted Cloudflare Tunnel. The servers publish no public web ports.

  • Hosted in the United States

    SyncedOffice runs on servers in the United States.

How does sign-in work?

Workspace users sign in to their ERP with single sign-on (OpenID Connect). (Beta)

Two gaps remain in the pilot: the website editor has its own separate login, and signing out through single sign-on is not finished. (Beta)

Each workspace is created by a Kubernetes operator from one definition, running the same steps in the same order every time.

What is not in place yet?

We would rather you hear it here than find it later.
  • Scheduled backups of every workspace, with restores that are tested. (Roadmap)
  • The platform runs on a single server today, with no second region and no uptime commitment.
  • SyncedOffice claims no security certification, such as SOC 2. None is on record.
  • We have not measured encryption of stored data, so we do not claim it.

Every fact, with its status and date

Questions and answers

What is shared between clients?

Customer organizations share the server, the identity server (each organization with its own realm on it) and the web edge. Each organization's namespace, database, realm and ERP instance are its own.

Are an agency's clients kept apart the same way?

Not yet. Today the boundary is between customer organizations. An agency's clients are planned as business profiles inside the agency's workspace; a profile will separate records inside one ERP instance, which is a lighter boundary than a separate workspace. (Roadmap) A separate environment for each of an agency's clients is also planned. (Roadmap)

Is client data backed up?

Not on a schedule yet. Scheduled backups with tested restores are planned, and until they exist we ask pilot clients to keep their own copy of records they cannot lose. (Roadmap)

Do you have SOC 2 or another certification?

No. SyncedOffice claims no security certification, such as SOC 2. None is on record. We describe only controls we have measured, and name the gaps.

How do I report a security issue?

Email security@syncedoffice.com. The site also publishes a security.txt file at /.well-known/security.txt with the same contact.

Have a security questionnaire? Send it to us with your pilot request.

Join the pilot