Security & trust
Security & trust at SyncFlowHR
Your HR, payroll and employee records are some of your organisation's most sensitive information. Protecting them isn't an afterthought — it's the foundation the platform is built on, on infrastructure located entirely in the European Union.
Your data stays in Ireland
Your workspace's data is stored in the European Economic Area and never leaves it.
100% hosted in AWS Dublin
SyncFlowHR runs on Amazon Web Services in the Dublin region (eu-west-1). The application, every customer database, uploaded files and backups are all kept in Dublin.
Certified infrastructure
Our hosting runs in AWS data centres that are independently audited against ISO 27001, ISO 27017, ISO 27018 and SOC 1, 2 and 3. These are AWS's certifications for the infrastructure underneath SyncFlowHR.
Signed, secure email
Invitations, password resets and notifications are sent through Amazon Simple Email Service in Dublin and signed with DKIM, with SPF and DMARC published, so mail claiming to be from us can be checked.
Protected before traffic reaches us
All traffic to SyncFlowHR passes through Cloudflare's global network first.
DDoS protection & filtering
Cloudflare absorbs denial-of-service attacks and filters malicious traffic at the edge. Our servers are locked to Cloudflare: their firewall accepts web traffic only from Cloudflare's network, and each connection must present our own client certificate (Cloudflare Authenticated Origin Pulls), so they can't be reached directly.
Encrypted connections
Your browser connects to Cloudflare over TLS 1.2 or 1.3 (1.3 where your browser supports it), and Cloudflare connects to our servers over TLS too, checking our servers' certificate ("Full (strict)"). HTTP Strict Transport Security tells browsers to use HTTPS only.
Hardened web pages
A strict Content Security Policy, anti-framing and other browser security headers protect against cross-site scripting, clickjacking and content sniffing.
Built to help you meet GDPR
You are the data controller for your employees' data; SyncFlowHR acts as your data processor under the GDPR and the Irish Data Protection Acts 1988–2018.
Data Processing Agreement
We provide an Article 28 GDPR data processing agreement on request, covering our sub-processors, breach notification and the return and deletion of your data. Ask us for a copy.
Role-based access
Decide who can see pay, documents and reports. Managers see their own teams; staff see only themselves. Reviews and recruitment notes stay private to the people involved.
Supports data subject rights
HR can view and correct an employee's records, and download one person's whole file — every record, plus their documents, receipts and CV — as a zip to answer an access request. The account owner can export the whole workspace at any time. We delete a workspace on request.
Questions, answered
How is each customer's data separated?
Each customer is a "tenant" with its own address (yourcompany.syncflowhr.com), database and uploads folder. Every request is tied to exactly one tenant from the address it arrives on, and everything that request does can only reach that tenant's database and files. A sign-in token records the workspace that issued it and isn't accepted by any other.
How are passwords and sign-in handled?
Passwords are stored as salted hashes, never in plain text. New users choose their own password from an emailed link. Repeated failed sign-ins are throttled. The people who manage your billing don't have a separate platform password: they sign in with a one-time link sent to their email.
Who can see my data at SyncFlowHR?
We process your data only to run the service. Operational support that needs to look at a workspace is limited to the minimum needed to fix a problem you've asked us about.
Is my data encrypted at rest?
Yes. The server's disks and its snapshots are encrypted at rest by AWS with AWS-managed keys (Amazon Lightsail data protection), and the off-site backups are encrypted twice: by us before they leave the server, and by Amazon S3 when they are stored.
How is my data backed up?
Every workspace's database and uploaded files are backed up automatically every night and kept on the server for 14 days, with server snapshots as a second copy. An off-site copy of each night's backup is encrypted before it leaves the server (the key that can decrypt it is kept offline, never on the server), stored in Amazon S3 in Dublin and locked against changes or deletion for 35 days. Everything stays in the AWS Dublin region.
How long do you keep my employees' records?
You decide. HR sets how long time, leave and pay records, leavers' files and job applicants are kept, gets a warning in the app and by email before anything is deleted, and can export the records first or put a person on a legal hold. Nothing is deleted automatically unless you switch that on.
What happens to my data if I cancel?
Your workspace becomes read-only and stays available for you to look at and export for a limited period. After that it can be deleted. You can also ask us to delete it sooner.
Can I see your hosting provider's audit reports?
AWS publishes its SOC and ISO reports for the infrastructure we run on through AWS Artifact. For anything else your security review needs, contact us and we'll help.
Need something for your review?
We're happy to help your security, legal or procurement team.
Need our DPA?
Ask for our Article 28 data processing agreement and we'll send it over for signature.
Security questionnaire?
Send us your vendor security questionnaire and we'll complete it, including details of our hosting, sub-processors and controls.
Report a vulnerability
We welcome reports from security researchers. Please tell us privately and give us a reasonable chance to fix the issue before sharing it.
Report a security issue
If you think you have found a security problem in SyncFlowHR, email [email protected] with what you found, where, and the steps to reproduce it. Please:
- tell us privately and give us a reasonable time (normally 90 days) to fix it before you share it;
- only test against your own trial workspace or the public demo, never another customer's workspace;
- don't access, change or keep anyone else's data, and stop as soon as you see any;
- don't run denial-of-service, spam or social-engineering tests.
We will confirm we have your report within 3 working days, keep you updated while we fix it, and credit you if you would like. We will not take legal action against research done in good faith within these rules. Our security.txt has the same contact details (RFC 9116).
Talk to us
Questions about security?
We’re happy to answer them before you sign up, and to help with your review.