Trust Center

We can share our data flow diagram, network diagram, and security policies on request.

Completed CAIQ v4 and CAIQ-Lite self-assessments are available on request.

Customer data is encrypted in transit (TLS 1.2+) and at rest (AES-256) in Postgres, S3, and ClickHouse Cloud. Each customer's data is logically isolated, and authorization is enforced on every request. Production data is never used in non-production environments.

Every change is peer-reviewed through pull requests on protected branches and must pass automated tests before release. GitHub CodeQL code scanning, secret scanning with push protection, and Dependabot run on every change, container images are vulnerability-scanned on push, and each pull request receives an AI-assisted security review.

AI features use the model providers listed as subprocessors, under commercial terms that do not allow them to train on customer data. AI analysis runs in isolated, short-lived sandboxes, and the assistant can access only data the user is authorized to see.

We prioritize and take environmental, social, and governance (ESG) considerations seriously in our operations and decision-making processes.

We comply with GDPR and CCPA. We process customer data as a processor under our Data Processing Agreement, publish our subprocessors, do not sell personal information, and respond to data subject requests within 30 days.

Every team member uses a unique account with multi-factor authentication enforced on Google Workspace, AWS, and GitHub. Access follows least privilege, is reviewed at least annually, and is revoked promptly at offboarding. Customer users sign in through Auth0 with organization-scoped, role-based permissions.

Hosted on AWS in us-east-1, with ClickHouse Cloud connected over AWS PrivateLink. Workloads and databases run in private subnets, infrastructure is defined as code and peer-reviewed, and all AWS account activity is recorded in CloudTrail.

Company laptops are monitored daily by the Drata agent for full-disk encryption, automatic screen lock, automatic OS updates, anti-malware, firewall, and password manager use.

Public traffic passes through Cloudflare's proxy and DDoS protection. Inside AWS, private subnets and least-privilege security groups restrict traffic, and connections are TLS-encrypted.

New personnel undergo background checks (where permitted by law) and sign confidentiality agreements. Everyone acknowledges our security policies and completes security awareness training every year.

We are constantly monitoring the security of our website. We will post our grades from public security rating agencies when they become available.

We maintain a documented incident response plan with defined severity levels, roles, and customer and regulator notification procedures, and test it at least once a year.

Security risks are assessed at least annually using a documented methodology and tracked in a risk register. Critical vendors are reviewed every year.

All cloud resources are defined as code and inventoried automatically. Company laptops are inventoried and monitored through Drata.

Postgres runs with automated backups, point-in-time recovery, and storage replicated across three availability zones. ClickHouse Cloud runs replicated with daily backups, and source files are versioned in S3. Our BC/DR plan, including backup restores, is tested at least once a year.

We provide security awareness training to all employees to ensure that they are aware of security best practices.

All code and infrastructure changes go through peer-reviewed pull requests on protected branches, pass automated tests, and are deployed through CI/CD. Infrastructure is managed as code, so changes can be rolled back.

Syncopate is fully remote and operates no data centers. Physical security is provided by AWS, whose facilities hold SOC 2 and ISO 27001 attestations.

Drata continuously tests our cloud configuration, endpoints, and personnel controls. GitHub and Amazon ECR continuously scan code, dependencies, and container images, and Datadog monitors availability and errors.