How SecureSync keeps your data safe

SecureSync brings your CRM, billing, support desk, projects and files into one place, then puts that data in front of your clients through branded portals. That only works if the data is kept safe, and if every client can be sure they see their own information and nobody else's.

This article explains how we do that. It covers the main controls without going into every implementation detail. If your team needs the full picture for a vendor review, you can request our security whitepaper.

Your data stays yours

You stay in control of the data you sync into SecureSync. We process it only to run SecureSync for you, acting on your instructions as your data processor.

• We never sell your data.
• We never share it with advertisers.
• We never use it to train AI models.

You can export or delete your data whenever you need to. Our Privacy Policy sets out how we process it, and the FAQ explains what happens to it if you cancel.

A database of your own

Each SecureSync customer gets a dedicated database. Your business data is never stored in a table shared with another customer, so one customer's records can't turn up in another customer's account.

Encrypted in transit and at rest

• In transit: every connection to SecureSync uses TLS 1.2 or higher.
• At rest: data is encrypted with AES-256, and that includes the files you and your clients upload.
• Passwords: we keep only salted, one-way hashes. Nobody at SecureSync can read a password.
• Your Zoho connection: SecureSync connects to Zoho through OAuth, so we never see your Zoho password. The connection tokens stay in your own database.

Each client sees only their own records

A client portal is only as safe as its permissions. In SecureSync, each portal user is linked to their own contact and account, and every list, report, file and AI client assistant answer is filtered to those records before it reaches the page. The check runs on every request.

• Profiles decide which pages each type of client can open.
• Field and section rules hide what a client shouldn't see, and allow edits only where you choose.
• A safe default: if a check can't pass, nothing is shown. A report that can't tell whose records are whose shows no rows, rather than all of them.
• Approval: new sign-ups can wait for your approval before they get in.

Sign-in that fits how your clients work

• Two-factor sign-in with an authenticator app or an email code. You can make it required for a portal.
• Google, Microsoft and Apple sign-in for clients who would rather not keep another password.
• SSO / SAML for your team, so they sign in with your own identity provider. It's included on Enterprise and available as an add-on on Standard and Professional.

AI that only sees what it should

SecureSync's AI features run on enterprise AI models within our cloud provider's infrastructure, not on a public AI service. Nothing sent to them is used to train models or shared with anyone else.

• The AI page builder sees your field names and the page you're building, never your records' values. Its previews use sample data.
• The AI client assistant reads only the records that client is allowed to see in the portal. If a client can't open a record, the assistant can't either.

A record of who did what, and when

Sign-ins, record views and changes, exports, restores and syncs all land in one audit log. When our team helps one of your clients, that session is recorded as on behalf of that client, so it's always clear who made a change. You can filter the log and export it as a CSV file.

Compliance

• SOC 2 Type II: our audit is in progress, covering the controls in this article.
• GDPR: you remain the data controller and we act as your processor. A Data Processing Agreement is available on request.
• HIPAA: HIPAA configuration and a Business Associate Agreement are available on the Enterprise plan.

Reporting a vulnerability

If you think you've found a security issue in SecureSync, email security@securesync.ai. We acknowledge every report within two business days. The same address takes security questionnaires and requests for our whitepaper or Data Processing Agreement.

In short

• Your data is yours, processed only to run SecureSync, and never sold or used to train AI.
• It lives in a database of your own, encrypted in transit and at rest.
• Each client sees only their own records, checked on every request.
• Sign-in supports two-factor, social sign-in and SSO / SAML.
• Every change, sign-in, export and restore is recorded.

For an overview with screenshots of these controls in the product, see how we protect your data.