Security

How we protect your data

Syncroly coordinates referrals across dental, veterinary, mental health, and other service categories. Regardless of your industry, every referral on the platform is protected by the same encryption, access controls, and audit infrastructure. We built to the standard that regulated healthcare demands, and every customer benefits.

This page describes exactly what we do. We do not claim certifications we have not earned or controls we have not implemented.

Table of Contents

1. Encryption

All data in transit is encrypted using TLS 1.2 or higher. All data at rest is encrypted using AES-256, provided by our infrastructure partners Neon (Postgres) and AWS.

In addition to infrastructure-level encryption, Syncroly applies application-layer field-level encryption (AES-256-GCM) to designated high-risk free-text fields, including referral notes, referral message bodies, and provider-to-provider direct messages. This provides a second layer of protection independent of the database provider.

2. Access Controls

Authenticated access to the platform is managed through role-based user sessions. Each user is authenticated against their organization and can only access data belonging to their practice. Account passwords are never stored in plain text; they are hashed using bcrypt before storage.

For referral recipients, access is controlled through token-scoped links. Each token encodes the referral, recipient type, and provider context, and is validated on every request. Tokens cannot be used to access data outside their defined scope, and there is no broad data access mechanism available to any user role.

3. Tenant Isolation

All data queries are scoped to a tenant (your organization) at the application layer. Every database query that touches referral or practice data includes a tenant filter. There is no API endpoint or internal pathway that permits cross-tenant data access.

This isolation is enforced in the data access layer, not just the API layer. Internal services and background processes are scoped to the correct organization for every operation they perform. As an additional safeguard, tenant boundaries are also enforced at the database level: a constraint rejects any write that would associate a record with the wrong organization, independent of the application code.

5. Audit Trails

Every meaningful action within the platform is recorded in a structured activity log. Logged events include referral views (both by recipients and referred individuals), consent acceptance, status changes, messages and file transfers, login attempts, team management actions, and settings changes. Each entry captures the actor, timestamp, event type, and relevant context.

Audit logs are retained for a minimum of six years and are available to account administrators. They can support compliance audits, incident investigations, or internal record-keeping regardless of your industry.

7. US Data Residency

All application data, including database records and file storage, is hosted in the United States. Our database infrastructure runs on Neon (backed by AWS US regions) and file storage uses AWS S3 US regions.

No customer data is stored outside the United States. Sub-processors that handle data in transit, such as email delivery and error monitoring, are US-based. Some requests are evaluated at the nearest network edge for routing, framing, and bot-protection checks; this edge processing is transient and does not store or expose referral content.

Sub-processors

Syncroly relies on the following sub-processors to operate the platform. Each is bound by data-protection terms, and those that store customer data do so in the United States.

  • Vercel — application hosting and serverless functions (United States)
  • Neon — managed PostgreSQL database (United States)
  • Amazon Web Services (S3) — file and attachment storage (United States)
  • Upstash — rate limiting and edge configuration cache (United States)
  • Postmark — transactional email delivery (United States)
  • Sentry — application error monitoring (United States)
  • Cloudflare Turnstile — bot and abuse protection (processed at the network edge)
  • Stripe — subscription billing and payment processing

8. For Healthcare Customers

The platform-wide controls described above are designed to support the administrative, physical, and technical safeguards of the HIPAA Security Rule (45 CFR Part 164, Subpart C). For customers whose referral data constitutes Protected Health Information, Syncroly operates as a Business Associate under HIPAA.

Business Associate Agreement

A Business Associate Agreement is available for all paid plans. The BAA covers permitted uses and disclosures of PHI, breach notification requirements, subcontractor obligations, and the handling of PHI upon termination. You can review the standard BAA on our BAA page.

Non-Healthcare Categories

Veterinary referral data does not constitute Protected Health Information under HIPAA, and the BAA does not apply to veterinary or general-category referrals. However, all customer data submitted through the platform, regardless of category, is subject to the same encryption, access controls, isolation, audit logging, and data handling protections described on this page and in our Terms of Service (Section 5.6) and Privacy Policy.

Responsible Disclosure

If you believe you have found a security vulnerability in Syncroly, we want to hear from you. Email security@syncroly.co with details and steps to reproduce. We investigate every report and ask that you give us a reasonable opportunity to remediate before any public disclosure.

Questions?

If you have questions about our security practices, need documentation for a compliance review, or want to report a security concern, contact us:

Syncroly Inc.

Security Team

security@syncroly.co

For privacy-related inquiries, see our Privacy Policy. For HIPAA-specific questions, see our Business Associate Agreement.

Last updated: June 9, 2026

Security | Syncroly