Trust & Security

    Open-core doesn't mean open risk. Community auditing makes SyncedOffice safer than closed-source "black-box" ERPs — because transparency is the strongest encryption.

    Security controls

    AES-256 Encryption

    All data encrypted at rest and in transit using military-grade AES-256 encryption.

    Community Code Auditing

    Open-core means thousands of developers review every line. More eyes than any black-box ERP.

    Transparent Changelog

    Every security patch, every update — publicly documented and verifiable on GitHub.

    Role-Based Access Controls

    Granular RBAC with audit logging ensures the right people access the right data.

    SOC 2 Type II Certified

    Annual third-party audits verify our controls for security, availability, and confidentiality.

    GDPR & HIPAA Ready

    Built-in compliance tooling for data residency, consent management, and breach notification.

    Security questions, answered

    How is customer data isolated between tenants?

    Each tenant gets its own database, network policy, and identity realm. There is no shared-row multi-tenancy, so a query in one tenant cannot physically reach another tenant's data.

    Is SyncedOffice SOC 2 and GDPR compliant?

    We run annual SOC 2 Type II audits covering security, availability, and confidentiality, and ship GDPR tooling for data residency, consent management, and breach notification. HIPAA-ready controls are available on Enterprise.

    What encryption is used?

    AES-256 for data at rest and TLS 1.3 in transit, with per-tenant key separation and rotation.

    Can my team audit the code?

    Yes. The core is open source, so your engineers and any third-party auditor can read every line that touches your data — including the agent execution path and its audit log.

    How are AI agent actions controlled?

    Every agent action runs in a zero-trust sandbox, is scoped by role-based access controls, and is written to an immutable, replayable audit log. Human-in-the-loop approval can be required per workflow.