How Synchro protects your team's data.
Synchro manages professional schedules, not patient charts. We take security seriously without over-promising.
What we actually do
Access control
Authentication is required for every action. Roles are granular (administrator, manager, physician, nurse, other professional). Each user only sees what is relevant to them. Sessions time out automatically.
Audit logging
Administrative actions are logged: schedule generation, publication. Useful traceability if a question ever comes up about who did what.
Backups
Automatic daily backups. Retained 30 days for restoration. Restore tests run periodically.
Infrastructure
Synchro runs on established cloud infrastructure providers, each with their own security measures and independent certifications. The technical details of our stack are available on request, under a confidentiality agreement if needed.
Law 25 and privacy
Quebec's Law 25 applies to any organization that processes personal information, including that of employees or professionals. Synchro does not process patient data (EMRs do that, under a stricter framework), but we do process information about your team: names, availability, absences, preferences.
We apply the basic principles: collection limited to what is necessary, a clear purpose (running the schedule), data security, and a right of access and correction for every user.
What we don't claim
We are a young company, founded in 2025. We do not yet hold an externally audited certification (SOC 2, ISO 27001). We would rather be transparent about that than claim one we don't have.
If an incident happens
If a security breach occurs:
- Immediate containment
- Notification of affected customers as quickly as possible
- A post-incident analysis shared with you
To report a vulnerability: [email protected].
Frequently asked questions
Is my data used to train AI?
No. Your data is used solely to provide you the Synchro service.
Can I export my data?
Yes. CSV and iCal exports at any time. If you cancel, you can retrieve all of your data before the account closes.
What happens if I cancel?
Data is kept 30 days after cancellation so it can still be retrieved, then deleted.
Where is the data physically?
Our providers operate mainly in North American regions. The exact regions depend on the current configuration. If your context requires a specific region (for example a CIUSSS contract requiring Canadian hosting), contact us and we can discuss it.