Skip to main content

    Security Practices

    Last updated: February 3, 2026

    At Sycra, security is a fundamental commitment. We implement comprehensive, industry-leading security practices to protect your data, social media accounts, and team information. This Security Practices document outlines how we safeguard Syncra and the systems entrusted to our platform.

    Contents

    1. Security Commitment & Overview

    Our Security Philosophy

    Syncra operates in a trust-based business model where customers entrust us with sensitive business data: social media accounts, content strategy, team collaboration, and performance analytics. This responsibility is central to everything we build.

    We apply defense-in-depth principles: multiple overlapping security layers ensure that no single vulnerability creates a critical exposure. We invest continuously in security technology, employee training, and compliance certifications.

    Security Governance

    Syncra maintains a dedicated security team responsible for:

    • •Developing and enforcing security policies and standards
    • •Conducting regular security audits and penetration testing
    • •Managing vulnerability assessment and patching
    • •Coordinating incident response and investigations
    • •Ensuring compliance with security standards and regulations
    • •Training employees on security awareness and best practices

    2. Data Encryption & Protection

    Encryption in Transit

    All communication between your device and Syncra infrastructure is encrypted using TLS 1.0+ with TLS 1.3 support (Google Cloud managed). This includes:

    • •Login credentials and authentication tokens
    • •Post content, drafts, and media uploads
    • •OAuth tokens and social media credentials
    • •API requests and responses (web and mobile)
    • •All form submissions and user interactions

    Note: We enforce HTTPS for all connections. Modern browsers show a secure padlock icon when connected to Syncra. We automatically redirect insecure HTTP connections to HTTPS.

    Encryption at Rest

    Data stored in our systems is encrypted at rest using industry-standard algorithms:

    • •Passwords: Hashed using bcrypt with strong salt, not stored in plaintext
    • •OAuth Tokens: Encrypted with AES-256-GCM before storage
    • •API Keys: Encrypted and stored securely with audit logging
    • •Payment Information: Not stored; processed through PCI-DSS compliant providers only
    • •Database encryption: Cloud SQL provides transparent disk encryption (Google Cloud managed) and application-level AES-256-GCM encryption for sensitive tokens

    Key Management

    Encryption keys are managed securely with restricted access:

    • •Automatic key rotation policies implemented quarterly
    • •Access to keys restricted to essential infrastructure personnel only
    • •All key operations logged and monitored for suspicious activity

    3. Infrastructure Security

    Cloud Infrastructure

    Syncra is built on Google Cloud enterprise infrastructure. We benefit from their security certifications, compliance programs, and continuous monitoring:

    • •Compute isolation: Each customer's workloads run in isolated containers with resource limits
    • •Database isolation: Multi-tenant databases use row-level security and encryption to isolate tenant data
    • •Storage redundancy: Automatic replication across multiple availability zones
    • •Data center security: Google Cloud maintains 24/7 physical security with access controls

    Network Security

    Network-level protections prevent unauthorized access and attacks:

    • •Web Application Firewall (WAF): Detects and blocks SQL injection, XSS, CSRF, and other web attacks
    • •DDoS Protection: Automatic mitigation for distributed denial-of-service attacks
    • •VPC Security: Private networking with restricted inbound/outbound rules
    • •Rate limiting: API rate limits prevent brute force attacks and resource exhaustion
    • •Intrusion detection: Network monitoring for suspicious patterns and security events

    Server Hardening

    All servers are hardened to minimize attack surface:

    • •Minimal OS installations with only required services
    • •Automatic security patch deployment for all systems
    • •SSH key-based authentication, no password login
    • •Mandatory two-factor authentication for all infrastructure access
    • •Host-based firewalls and SELinux/AppArmor for additional protection

    4. Authentication & Authorization

    User Authentication

    Syncra uses Auth0 for secure, standards-compliant authentication:

    • •Password hashing: User passwords are never stored or transmitted to Syncra; Auth0 handles all password verification
    • •Session management: Secure, httpOnly cookies with short expiration times
    • •OAuth 2.0/OIDC: Standards-compliant protocols for secure token exchange
    • •Account recovery: Secure email-based recovery with time-limited tokens

    Authorization & Access Control

    Workspace-based access control ensures users access only what they need:

    • •Owner: Full workspace control, billing, and user management
    • •Admin: Manage billing, members, workspace settings, and connected accounts
    • •Approver: Review submissions, approve content, and schedule approved posts
    • •Creator: Draft and edit content, then submit it for approval
    • •Viewer: Read-only access to workspace content and analytics
    • •Workspace isolation: Users cannot access workspaces they don't belong to

    Session Security

    Sessions are protected with multiple security measures:

    • •Automatic timeout after 30 minutes of inactivity
    • •Session data stored server-side, not in cookies
    • •CSRF tokens required for all state-changing requests
    • •Session invalidation on suspicious activity or logout

    5. Access Controls & Permissions

    Multi-Tenant Data Isolation

    Syncra uses multi-tenant architecture with strong isolation between workspaces:

    • •Database-level isolation: Row-level security ensures queries return only authorized workspace data
    • •API authorization checks: Every API endpoint verifies user has access to requested resources
    • •Workspace membership validation: Users cannot bypass role restrictions through direct API calls
    • •Token scoping: API tokens are scoped to specific workspaces and actions

    OAuth Token Security

    Social media OAuth tokens are protected with strict controls:

    • •Encrypted storage: Tokens encrypted with AES-256 before database storage
    • •Limited exposure: Tokens only decrypted when needed to make API calls
    • •Never logged: Tokens are excluded from all logs and error messages
    • •Revocation support: Users can disconnect accounts and immediately revoke token access
    • •Regular rotation: Tokens are refreshed automatically to limit exposure window

    Employee Access Controls

    Internal access to customer data is strictly limited:

    • •Principle of least privilege: employees access only systems needed for their role
    • •Support staff cannot access customer data without explicit authorization and audit logging
    • •Background checks and security training required for all employees
    • •Offboarding procedures ensure immediate access revocation when employees leave

    6. Security Monitoring & Logging

    Continuous Monitoring

    Syncra infrastructure is continuously monitored for security threats:

    • •Real-time alerts: Security team receives immediate notifications of suspicious activity
    • •Intrusion detection system (IDS): Network traffic analyzed for attack patterns
    • •Endpoint detection: Server logs analyzed for anomalies and unauthorized activities
    • •Performance monitoring: Automated detection of resource anomalies that may indicate attacks

    Audit Logging

    Comprehensive logging enables security investigations and compliance:

    • •Authentication events: All login attempts, MFA challenges, and session creation/termination
    • •Data access: When users view, download, or export content
    • •Administrative actions: User management, permission changes, settings modifications
    • •API access: All API calls with user, endpoint, and action details
    • •Security events: Failed authentication, rate limit violations, suspicious patterns

    Log Security

    Logs are protected to prevent tampering:

    • •Logs stored in write-once, read-many (WORM) storage
    • •Cryptographic signatures prevent undetected modification
    • •Replicated to geographically separate systems for backup
    • •Access to logs restricted and monitored

    7. Vulnerability Management

    Vulnerability Assessment

    We proactively identify and remediate security vulnerabilities:

    • •Automated scanning: Daily vulnerability scans of all systems and dependencies
    • •Static analysis: Code analysis tools detect common vulnerabilities during development
    • •Dependency tracking: Monitoring of open-source libraries for known vulnerabilities (CVEs)
    • •Configuration review: Regular audits of cloud configurations and access policies

    Patch Management

    Security patches are deployed rapidly:

    • •Automated testing ensures patches don't break existing functionality

    Vulnerability Tracking

    All vulnerabilities are tracked through resolution with documented remediation plans and timelines.

    8. OAuth & Third-Party Integrations

    OAuth 2.0 Implementation

    Syncra uses OAuth 2.0 to securely connect to social media platforms:

    • •Authorization code flow: Most secure OAuth flow, never exposes tokens to browser
    • •Scope limitation: We request only the minimum permissions needed (publish posts, read analytics)
    • •Token encryption: Tokens encrypted before storage and in transit
    • •Refresh token security: Automatic rotation of refresh tokens with revocation tracking
    • •State parameter: CSRF protection during OAuth redirect flow

    Social Platform Security

    We maintain secure relationships with all connected platforms:

    • •Official APIs only: We use only official, documented platform APIs
    • •Compliance: All usage complies with each platform's terms of service
    • •Rate limiting: Respecting platform rate limits prevents account suspension
    • •Token validation: Automatic detection and handling of revoked or expired tokens

    Third-Party Vendor Assessment

    All vendors and integrations are assessed for security:

    • •Security questionnaires and SOC 2 reports required for critical vendors
    • •Data processing agreements with encryption and confidentiality requirements
    • •Regular security reviews and updates to vendor status

    9. Compliance & Certifications

    CCPA & Privacy Laws

    We comply with California Consumer Privacy Act (CCPA) and similar state privacy laws:

    • •Supports consumer rights requests (access, deletion, opt-out)
    • •Does not sell personal information
    • •Provides privacy notices and clear disclosure of data practices

    10. Incident Response & Breach Notification

    Incident Response Plan

    We maintain operational runbooks for infrastructure incidents with structured logging and Cloud Logging integration:

    • •Detection: Automated alerts and manual reviews identify security incidents
    • •Response: Incident response team assembles and begins containment immediately
    • •Investigation: Forensic analysis determines scope and impact
    • •Remediation: Systems are patched, secured, and restored
    • •Review: Post-incident review identifies root causes and preventative measures

    Breach Notification

    In the unlikely event of a data breach, we follow strict notification procedures:

    • •Notification timeline: Affected customers notified without undue delay (within six hours)
    • •Transparency: Clear information about what data was involved and impact assessment
    • •Support: Complimentary credit monitoring or security remediation services offered
    • •Regulatory compliance: Notifications to regulators as required by law (GDPR, CCPA, etc.)

    Business Continuity

    Our incident response plan includes business continuity measures to restore service during major incidents. Recovery time objectives (RTO) and recovery point objectives (RPO) vary by incident type but prioritize customer service restoration.

    11. Backup & Disaster Recovery

    Backup Strategy

    We maintain multiple backup copies to protect against data loss:

    • •Frequency: Continuous incremental backups; full backups multiple times daily
    • •Geographic distribution: Backups stored in multiple regions to protect against regional disasters
    • •Encryption: All backups encrypted with the same standards as production data
    • •Access control: Backup access restricted and monitored
    • •Retention: Backups retained for six months for recovery purposes

    Recovery Testing

    We regularly test our disaster recovery capabilities:

    • •Backup restoration tests performed quarterly
    • •Disaster recovery drills validate failover procedures
    • •Recovery time objectives (RTO) and point objectives (RPO) documented and monitored

    Data Export & Portability

    You retain full control of your data:

    • •Users can export content at any time through the dashboard
    • •Bulk export API available for enterprise customers
    • •Data provided in standard formats for portability
    • •Upon account deletion, data can be exported for thirty days before permanent deletion

    12. User Security Best Practices

    Password Security

    Protect your Syncra account with a strong password:

    • •Use a unique password not used on other services
    • •Minimum 16 characters including uppercase, lowercase, numbers, and symbols
    • •Never share your password with colleagues or support staff
    • •Use a password manager to securely store complex passwords
    • •Change your password if you suspect it has been compromised

    Account Access Management

    Manage who has access to your Syncra workspace:

    • •Review team members regularly and remove users who no longer need access
    • •Use role-based permissions to grant minimal necessary access
    • •Immediately revoke access when employees leave
    • •Use workspace audit logs to monitor account activity

    Social Media Account Security

    Secure the social media accounts connected to Syncra:

    • •Use strong, unique passwords for each social platform account
    • •Enable two-factor authentication on social platform accounts
    • •Review connected apps regularly and revoke access to unused applications
    • •Immediately disconnect Syncra if you suspect your social account is compromised

    Phishing & Social Engineering

    Be cautious of phishing attempts targeting Syncra credentials. Syncra employees will never ask you to provide passwords or OAuth tokens via email. Verify suspicious emails by contacting support directly.

    13. Vulnerability Disclosure

    Responsible Disclosure Program

    We welcome security researchers to responsibly disclose vulnerabilities. Please follow our responsible disclosure policy:

    How to Report

    If you discover a security vulnerability, please email our security team:

    -

    Please include: description of vulnerability, affected components, potential impact, and any proof-of-concept code (if safe to share).

    Do not post the vulnerability publicly or in social media before we've had a chance to address it.

    Our Commitment

    When you report a vulnerability responsibly:

    • •We will acknowledge receipt within six hours
    • •We will investigate and provide a timeline for fix deployment
    • •We will keep you updated on progress
    • •We will recognize your contribution in our security hall of fame (if you wish)
    • •We will grant you a reasonable period for coordinated disclosure before public announcement

    Out of Scope

    The following are not considered vulnerabilities and we cannot provide bounties: information disclosure through source control, physical security bypasses requiring facility access, attacks on social platforms or third parties, employee social engineering, and issues already known by our team.

    For questions about this Security Practices document, contact:

    -

    This Security Practices document is subject to change. We will notify customers of material changes via email.