Security Overview

01Introduction

Synclo is a modular ERP that may hold sensitive business information, including employee, payroll, finance, recruitment, customer, vendor and document records, and AI-assisted workflows. This overview describes how we protect it. Please read it together with our Privacy Policy, Cookie Policy and your agreement with us.

02Our approach

We use layered security across the platform, infrastructure, users, access controls, data handling, monitoring and operations, guided by role-based access, least privilege, traceability and continuous improvement.

Security is a shared responsibility. Synclo secures the platform and services. Each client manages its users, roles, integrations, exports, devices and internal policies.

03Product security

Synclo includes role-based access, module-level permissions, administrator-managed user access, approval workflows, audit logs, activity history, configurable settings and workspace-level controls. Administrators give each person permissions based on their job, department and modules.

When clients use Synclo for recruitment, candidate applications, CVs, profiles, interview feedback, screening records, offers and referrals are accessible only according to the client's roles and permissions.

04Data security

We apply reasonable technical, administrative and organisational safeguards against unauthorised access, loss, change, disclosure or destruction. These include encryption where applicable, secure transmission, access controls, tenant and workspace separation, audit logs, backups, monitoring, restricted internal access and confidentiality obligations.

Data is protected in transit between users, the platform and supported services, and encrypted at rest where applicable depending on the type of data, infrastructure and configuration. Synclo does not claim ownership of client data and does not use workspace data to train public AI models.

05Access control and internal access

Role-based controls govern access to modules, records, workflows, reports, documents and administrator settings, and clients decide who holds each role. Synclo staff access client data only when reasonably needed for support, troubleshooting, security, maintenance, legal or operational reasons. That access follows least privilege, may be logged and is covered by confidentiality obligations.

06Authentication and account security

Synclo provides secure sign-in, password protection, password reset, session controls, account status controls and two-factor or multi-factor authentication where available. Users should keep credentials private, use strong passwords, turn on the protections available, remove access promptly when it is no longer needed and report any suspected compromise.

07Infrastructure and hosting

Synclo runs on trusted cloud and hosting providers that maintain physical, environmental and network safeguards. Our practices aim for secure hosting, availability, controlled access and monitoring. Hosting locations depend on technical requirements, providers, client configuration and legal or contractual obligations.

08Application security

We use input validation, access checks, secure coding, testing, code review where applicable, vulnerability assessment and patch management. Permissions are enforced inside the application, so people can reach only the information and actions their role allows.

09Monitoring, logging and audit trails

Synclo records sign-in activity, administrator actions, permission changes, workflow and approval history, module activity, system events, errors and security events. These logs support audits, troubleshooting and the detection of suspicious or unauthorised activity.

10Backups and business continuity

We maintain backup and recovery practices to support continuity and restore service after technical failure, accidental loss or disruption. Backup frequency, retention and recovery times may vary by configuration, provider and subscription.

11Third-party providers

Providers may support hosting, infrastructure, email, SMS, analytics, monitoring, support, billing, security and AI infrastructure. They may process data only to provide services to Synclo and are bound by confidentiality, security, contractual and data protection obligations. Clients are responsible for reviewing and approving any third-party integrations they enable.

12Alci and AI security

Alci works within each user's permissions, role, enabled modules and workspace settings. It can summarise, recommend, classify and draft, and people should review its outputs before making business, HR, financial, legal or customer decisions. Client data, including employee, candidate, customer, vendor, financial and document data, is not used to train public AI models, and third-party AI providers must meet confidentiality and data protection obligations.

13Incident response and vulnerability reporting

We investigate, contain, fix and learn from suspected or confirmed security incidents. Where the law or our agreements require, we notify affected clients and help with their investigation and notifications. Clients, users and security researchers can report suspected unauthorised access, compromised accounts, misuse or vulnerabilities to legal@synclo.com.

14Security documentation

Eligible clients can request additional material, such as compliance documentation, audit summaries and security questionnaire responses. Access may be subject to confidentiality terms and review.

15Retention and deletion

We keep client data while the account or subscription is active. After cancellation, data may be kept briefly for export, migration, backup or recovery, and is then deleted, de-identified or made inaccessible, subject to legal exceptions. Our Privacy Policy has the details.

16Your responsibilities

To keep your workspace secure, please:

• give each person only the role they need
• remove access when people leave or change roles
• use strong passwords and turn on multi-factor authentication
• review integrations, exports and downloads carefully
• protect the devices your team uses
• train your users and follow the laws and policies that apply to you

17Changes to this overview

We may update this overview as our platform, infrastructure, practices, providers or legal requirements change. We will update the effective date and may notify clients by email, in the app or on our website.