SyncEzy provides Integration platform as a Service(IPaaS) products to hundreds of users worldwide to solve their business problems. Security is a key component in our offerings, and is reflected in our people, process, and products. This page covers topics like data security, operational security, and physical security to explain how we offer security to our customers.
How Secure is your data?
At SyncEzy, we take security very seriously – just ask the hundreds of companies that trust us with their integration processes. The highest information security and privacy standards are part of our product and our company’s integrity:
Compliance Certifications and Memberships:
We use best practices and industry standards to comply with industry-accepted general security and privacy frameworks, helping our customers meet their compliance standards.
Integrating with best security standards practices in the industry:
SyncEzy constantly invests in protecting your data. We put security measures and maintain policies and procedures in place to comply with required data security standards. We continue to take all the measures needed to improve our information security level. SyncEzy is SOC2 Type 2 certified.
Complete control over role-based segregated data:
We only access your data for the explicit purpose of providing support to your users. We consciously limit the amount of data stored by SyncEzy to the bare minimum that is required to provide the integration service. Depending on integrations this is done by storing just IDs of records and the metadata instead of actual files and content, stripping PII information from employee tables, and storing just IDs and names and other such means..
What is SyncEzy doing to meet security standards?
As a SaaS company, we work tirelessly to meet the ideal security standards to protect our customers from security vulnerabilities.
- SOC 2 Type I We undergo routine audits to receive updated SOC 2 Type II reports, available upon request and subject to a signed NDA.
- Industry Best Practices
We build integrations to industry best practice
What kind of certificates and resources are available to me?
Our certificates and resources are available upon request. Some of these assets may require an NDA. All options are below:
Resources subject to an NDA
- SOC 2 Type II Report
- Penetration Test Summary
Who can access my data?
We should look at two types of parties that can get access to your data:
You and your staff – your staff will have access to the data per data access credentials that you will provide them. You can control who can view, edit, upload and download any information or document based on his/her role credentials. This is managed from within the SyncEzy portal. We have options to sign on using Google or Microsoft.
A very limited number of periodically trained authorized senior SyncEzy personnel (Development Teams) can gain access to your data. This is only done on an as needed basis based on your support requests. Any SyncEzy team member doing so has signed all the relevant contracts, NDAs and is bound to restrict access only for support purposes.
Is my data backed up?
Our data centers backup all the integration data in our platforms between hourly and at least once a day. The data is fully restorable for disaster recovery purposes. However, we recommend periodically backing up your data in your individual applications.
Why, Where and how is my data stored and secured?
As an integration provider, we need to store the data regarding your applications to provide the service. In all cases our solution architects make a conscious and concentrated effort to reduce our data and permission footprint to only save the data that is required to support the functionality of the integration.
Different integrations have diferent data storage requirements. For example something like a PowerBi integration requires SyncEzy to store the actual data in our servers, whereas for other integrations Procore integrations for exp where we can simply store the meta data (Created Date ,time, UserID, File id, Modified time etc), we only store the metadata.
Your data is stored in the following ways:
SyncEzy hosts data and compute primarily in AWS data centres that have been certified as SOC 2 compliant. Learn more about compliance at AWS.
AWS infrastructure services include backup power, HVAC systems, and fire suppression equipment to help protect servers and, ultimately, your data. Learn more about Data Center Controls at AWS.
AWS on-site security includes several features such as security guards, fencing, security feeds, intrusion detection technology, and other security measures. Learn more about AWS physical security.
Data Hosting Location
SyncEzy uses AWS data centres in Australia (Sydney main) and Australia/Melbourne & Singapore (backup).
All customer data stored in our integration platform is deleted 30 Days after the integration has been cancelled.
What type of network security do you have?
SyncEzy protects your data with a secure network and other multiple security protection and technology measures, including:
Dedicated Security Team
Our globally distributed security team is on call 24/7 to respond to security alerts and events.
Our network is protected using key AWS security services, regular audits, and network intelligence technologies, which monitor and/or block known malicious traffic and network attacks.
Our network security architecture consists of multiple security zones. More sensitive systems, like database servers, are protected in our most trusted zones.
Network Vulnerability Scanning
Network security scanning gives us deep insight so we can quickly identify out-of-compliance or potentially vulnerable systems.
Third-Party Penetration Tests
In addition to our extensive continuous internal vulnerability scanning and testing program done each year. SyncEzy works with third-party security platforms to perform a broad penetration test across the SyncEzy production and corporate networks.
Security Incident Event Management
Our Security Incident Event Management (SIEM) system gathers extensive logs from essential network devices and host systems. The SIEM alerts on triggers that notify the security team based on correlated events for investigation and response.
Intrusion Detection and Prevention
The SyncEzy application ingress and egress points are instrumented and monitored to detect anomalous behaviour. These systems are configured to generate alerts when incidents and values exceed predetermined thresholds and use regularly updated signatures based on new threats. This includes 24/7 system monitoring.
Threat Intelligence Program
SyncEzy participates in many threat intelligence-sharing programs. We monitor threats posted to these networks and act based on risk.
Access to the SyncEzy production network is restricted by an explicit need-to-know basis, utilizes least privilege, is frequently audited and monitored, and is controlled by our Technical Team. Employees accessing the SyncEzy production network are required to use multiple factors of authentication and use enterprise Single Sign On.
Security Incident Response
In case of a system alert, events are escalated to our 24/7 teams providing operations, network engineering, and security coverage. Employees are trained on security incident response processes, including communication channels and escalation paths.
Tell me about encryption
Encryption in Transit
All communications with SyncEzy UI and APIs are encrypted via industry-standard HTTPS/TLS (TLS 1.2 or higher) over public networks. This ensures that all traffic between you and SyncEzy is secure during transit.
Encryption at Rest
SyncEzy databases, compute and storage are encrypted at rest in AWS using AES-256 key encryption. In general, our data encryption has two layers:
- DB at rest – based on RDS data encryption using KMS AES256
- Application layer – all financial and salary data is encrypted using KMS AES256
Only a select few people have access to the database and the KMS for maintenance purposes and, of course, are bound by extreme legal and security safeguards (such as confidentiality and non-disclosure provisions, permission management, etc.).
Do you provide availability and continuity?
Our Disaster Recovery (DR) program ensures that our services remain available and are easily recoverable in the case of a disaster. This is accomplished through building a robust technical environment, creating disaster recovery plans, and testing activities. Our DR location is AWS Singapore
How do you protect the SyncEzy application?
Secure Code Training (SDLC)
Secure Code Training
Annually, engineers participate in secure code training covering OWASP’s top 10 security risks, common attack vectors, and SyncEzy security controls.
Framework Security Controls
SyncEzy leverages modern and secure open-source frameworks with security controls to limit exposure to OWASP’s top 10 security risks. These inherent controls reduce the exposure to SQL Injection (SQLi), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF), among others.
Testing and staging environments are logically separated from the production environment. No customer data is used in our development or test environments.
Vulnerability Management Dynamic Vulnerability Scanning
We employ third-party security tooling to continuously scan our core applications against the OWASP’s top 10 security risks. We maintain a dedicated in-house product security team to test and work with engineering teams to remediate any discovered issues.
Static Code Analysis
The source code repositories for our platform and mobile applications are scanned for security issues via our integrated static analysis tooling.
Third-Party Penetration Testing
In addition to our extensive internal scanning and testing program, SyncEzy employs third-party security experts to perform detailed penetration tests on different applications within our family of products.
What other security measures do you have in place?
Here are some of the additional security measures we use:
Customers can enable native SyncEzy authentication and/or Federated SSO for end-user authentication.
2-Factor Authentication (2FA)
SyncEzy recommends integrating with enterprise SSO 2-factor (2FA) authentication.
Role-Based Access Controls
Access to data within SyncEzy applications is governed by role-based access control (RBAC) and can be configured by the SyncEzy Portal user admin to define granular access privileges as needed.
SyncEzy has developed a comprehensive set of security policies covering a range of topics. These policies are shared with and made available to all employees and contractors with access to SyncEzy information assets.
All employees attend security awareness training sessions which are given upon hiring and annually after that. All engineers receive additional sessions for secure code training. The security team provides further security awareness updates via email, blog posts, and presentations during internal events.
What do you do about employee vetting?
SyncEzy performs reference checks on all new employees per local laws.
SyncEzy performs pre-onboarding and identity checks and stores relevant documentation on all employees per local laws.
All new hires and contractors are required to sign Non-Disclosure and Confidentiality Agreements.
Security of your data is your right and a never-ending mission of SyncEzy. We will continue to work hard to keep your data secure, like we always have. For any further queries on this topic, take a look at out FAQs or write to us at [email protected].