Every click is checked. Before any patient detail loads.
Syncroly checks practice, role and consent on the server for every read, message and download. The same protection runs on every plan, Free included.
- 1Encrypted in transit and at rest
- 2Database and files hosted in the US
- 3No patient details to a receiving practice before consent
- 4A BAA at setup for practices covered by HIPAA
One referral, start to finish.
- 1The referring practice sends a referral. Its files are scanned for malware, its notes are encrypted a second time, and the send is logged.
- 2The patient or pet owner gets an email with a secure link, never the referral itself. Notes and files stay in Syncroly.
- 3They give consent on their link, or the referring practice confirms it already has consent. Either way, it's on file before the receiving practice sees anything.
- 4The receiving practice signs in. Syncroly checks practice, role and consent before the referral opens, and again for every message and download.
Technical safeguards.
- 01
Only the practices on a referral can open it.
On every request, Syncroly checks that your practice sent or received the referral and that you're still on its team. A receiving practice also needs consent on file.
- 02
Two layers of encryption.
Connections use TLS 1.2 or higher, and the database and files are encrypted at rest with AES-256. Notes, messages and drafts get a second layer in the app, AES-256-GCM, before they're stored.
- 03
Every link has one job and an end date.
Patient and practice links open one referral and expire within weeks. Reset and invite links work once. Download links last minutes. We store each referral, reset and invite link only as a one-way SHA-256 fingerprint.
- 04
Every file is malware-scanned.
Files are stored under an ID, never their name, and encrypted with AES-256. A flagged file is blocked twice: by the app, and by the file vault itself.
- 05
We store a bcrypt hash, never your password.
You confirm your email before your first sign-in. Idle sessions sign out on their own, and changing your password signs you out everywhere.
- 06
Who did what, and when. Kept 7+ years.
It records sends, first opens, consent, status changes, messages sent, file uploads and downloads, sign-ins, and team and settings changes.
The database has managed backups with point-in-time recovery.
Hosted in the US. Four vendors, each under a BAA.
No marketing analytics in the app, or in any email or link we send to patients, pet owners and providers. Our payment processor sees billing details, never patient details.
- 01VercelHostingRuns Syncroly
- 02NeonDatabaseStores referrals
- 03AWSFile storageStores and scans files
- 04MicrosoftEmailSends the links
- PaymentsBilling only
- Error reportsFiltered first
- Marketing analyticsPublic website only
Every vendor we use, and what it receives, is in our Privacy policy.
- 01Everyone sees by role.Admins and coordinators see the practice's referrals. Your practitioners see their own, or all, if you choose.
- 02One front desk login. A name on every send.On Teams, each front desk person has their own PIN, so every send, message and upload carries their name.
- 03An Activity Log for admins.Who did what and when, recorded on every plan. Admins view and export it on Solo, Teams and during your trial.
- 04A BAA at setup, on every plan.Practices covered by HIPAA accept it at setup, before sending any patient details. It sets out how we use and protect patient data, the subcontractors we use, and breach notice.
Vet practices get every protection on this page. HIPAA doesn't cover vets, so there's no BAA to sign.
Security question? Found a vulnerability?
Email security@syncroly.co. For a vulnerability, include the feature, what happened and the steps to reproduce it.
Revised October 2026