Trust centre

What a careful buyer asks us, in one place.

How SYNC treats the people it researches, where your data is stored, who can see it, and what we do not have yet. Each part is a short summary of a longer page, and links to it. Where a fact is not confirmed yet, it stays in brackets until it is.

Workspace data: Stored in the EU (Ireland)
Before anything is sent: A person approves
Security contact: security@isyncso.com
Certifications: None yet

How SYNC treats the people it researches.

The rules SYNC works by, as the product holds them today.

Sources: Company facts come from careers pages, the company's own site, LinkedIn, the press and public register pages. Email addresses and phone numbers come from a lookup provider.
No dossier, no message: A message needs a dossier with a sourced case behind it: a reason SYNC can cite, with a source you can open. Accounts without one are left alone.
A person approves: Nothing is sent until a person approves it. Every account starts with approval on each send, follow-ups included. You can relax that per account.
Pace: At most three messages to one person, and three to one account, in any seven days. Never twice to the same person within 48 hours.
Your own mailbox: SYNC sends email from your own Outlook or Gmail. LinkedIn messages and calls are tasks for you.

Full pageOur commitments Full pageWhat SYNC reads

Your data.

Where it is stored, who at iSyncSO can see it, and how you leave.

Where it is stored: Dossiers, drafts, sent messages and replies, in your own workspace, stored in the EU (Ireland). Some sub-processors process data outside the EU; the list below shows where each one is confirmed.
Your mailbox: You sign in on Microsoft's or Google's own screen. The connection is held by Composio, our connection provider. SYNC never sees your password.
iSyncSO staff: We cannot work in your workspace and cannot change anything in it. Through an admin view, our staff can look at items such as dossiers, to support you and keep the service running.
Leaving: Ask us, and we export or delete your workspace data. We answer within one month.

Full pageSecurity & data

Sub-processors.

The companies that process personal data on our behalf to run SYNC: what each one does, and where. This is the same list as the sub-processor page.

Workspace data is stored in the EU (Ireland). A location stays in brackets until it is confirmed.

Which model handles a task depends on the task; all are reached through our own routing layer.

Sub-processors, what each one does, and where it is
Sub-processor	Purpose	Location
Anthropic	AI models that read sources and draft text	United StatesData is stored in the US. By default a request may be processed in any region; Anthropic’s API has no EU option.
OpenAI	AI models that read sources and draft text	Via Groq and Together AISYNC runs OpenAI’s open models (gpt‑oss) on Groq and Together AI; no data goes to OpenAI.
Google	AI models that read sources and draft text	No fixed regionGoogle may process requests in any country where it has facilities. An EU region exists on Google Cloud (Vertex AI), which we do not use.
Moonshot AI (Kimi)	AI models that read sources and draft text	Via Together AIKimi runs on Together AI’s servers; no data goes to Moonshot AI.
Together AI (hosts open models)	AI models that read sources and draft text	No fixed regionTogether picks the data centre for each request. EU-only hosting needs a dedicated endpoint, which we do not use.
Supabase	Database and storage	EU (Ireland)
Vercel	Hosting of the app and site	United StatesFunctions run in Washington, D.C.; pages are served from the nearest edge. EU region available; not yet selected.
Resend	Email notifications	United StatesEmails are sent from the EU (Ireland). Resend stores account data, logs and email metadata in the US.
Bright Data	Web search and reading public pages	[location to confirm]Based in Israel. Bright Data does not publish where it hosts data.
Composio	Mailbox, calendar and CRM connections	[location to confirm]Composio does not publish where it hosts data.
BetterContact	Finding email addresses and phone numbers	EUServers in the EU; the company is based in France.
Groq	Transcription of calls	United StatesGroq may also process in other countries where it operates. An EU region is offered on its Enterprise plan only; not used.

Full pageSub-processors

If someone asks to be left alone.

Anyone can ask not to be written to.

The address is blocked: In every workspace, not only the one that wrote. Messages queued to that address are cancelled. A reply that says stop does the same.
How to ask: On the public opt-out page, app.isyncso.com/opt-out, or by writing to innovate@isyncso.com.
What is held: A person SYNC has researched can ask what is held about them, or ask for it to be removed. We answer within one month.

Full pageBeing left alone

Reporting a security issue.

Found something that looks wrong? Write to us privately first.

Write to: security@isyncso.com
What to include: What you found and where, the steps to see it again, and how we can reach you.
When we answer: We answer [response time to confirm].
Disclosure policy: [Responsible disclosure policy to publish]

Full pageReport an issue

Documents.

What your privacy officer will ask for before the first send.

Data processing agreement[PDF to publish]Privacy noticelegal/privacy Termslegal/terms Sub-processorslegal/subprocessors

The legal pages are being finalised. Until they are, a fact nobody has confirmed stays in brackets.

What we do not have yet.

Said plainly, so you do not have to find out later.

01No SOC 2 or ISO 27001 certification.We hold neither today.

02No self-service export or scheduled deletion.Both run on request. Ask us, and we export or delete your workspace data. We answer within one month.

03No published uptime figure.We do not publish one yet.