Trust & Security
Open-core doesn't mean open risk. Community auditing makes SyncedOffice safer than closed-source "black-box" ERPs — because transparency is the strongest encryption.
Security controls
AES-256 Encryption
All data encrypted at rest and in transit using military-grade AES-256 encryption.
Community Code Auditing
Open-core means thousands of developers review every line. More eyes than any black-box ERP.
Transparent Changelog
Every security patch, every update — publicly documented and verifiable on GitHub.
Role-Based Access Controls
Granular RBAC with audit logging ensures the right people access the right data.
SOC 2 Type II Certified
Annual third-party audits verify our controls for security, availability, and confidentiality.
GDPR & HIPAA Ready
Built-in compliance tooling for data residency, consent management, and breach notification.
Security questions, answered
How is customer data isolated between tenants?
Each tenant gets its own database, network policy, and identity realm. There is no shared-row multi-tenancy, so a query in one tenant cannot physically reach another tenant's data.
Is SyncedOffice SOC 2 and GDPR compliant?
We run annual SOC 2 Type II audits covering security, availability, and confidentiality, and ship GDPR tooling for data residency, consent management, and breach notification. HIPAA-ready controls are available on Enterprise.
What encryption is used?
AES-256 for data at rest and TLS 1.3 in transit, with per-tenant key separation and rotation.
Can my team audit the code?
Yes. The core is open source, so your engineers and any third-party auditor can read every line that touches your data — including the agent execution path and its audit log.
How are AI agent actions controlled?
Every agent action runs in a zero-trust sandbox, is scoped by role-based access controls, and is written to an immutable, replayable audit log. Human-in-the-loop approval can be required per workflow.