Information Security and Privacy
We treat data protection and privacy with the utmost importance. We apply stringent privacy and protection measures at application architecture level, right through to business process and policy level to secure and safeguard your data, and that of your clients.
Synnch is entrusted with confidential data and commercially sensitive IP and we take this responsibility extremely seriously. Understanding the intricacies of IT security, this document outlines our commitment to keeping your data secure. Please see an overview below or download our detailed information security framework.
User Authentication
Multi-factor Authentication
Yes (Google Authenticator or other 2FA app)
Customisable Password Policies
Yes
Restricted Access
Yes (Role Based)
Logging
Access, create, delete, change, login
Data
Encryption
Yes (at rest and in transit)
Sanitisation and Verifcation
Yes (preventing XSS, injection etc. attacks)
Vectors
Ports
Port 80 forward to 443
SSL
Yes (HTTPS enforced)
Headers
Prevention of XFrames, cross-origin security etc.
Firewall
Traffic is controlled and blocked
Integrations
Encryption
Yes (only using encrypted APIs)
System
Management
Yes (ongoing patches and updates)
Backend
AWS
Synnch uses a distributed and redundant cloud application architecture to deliver the highest uptime and availability possible, even in the event of a natural disaster of other significant even affecting public and private infrastructure. Details on our business continuity planning, including data recovery and other key items are outlined below.
BIA
RPO
Single system backup every 24 hours
RTO
< 24 hours (to be restored within business hours)
Synnch has a global scope and works with international clients. GDPR from the European Union is a key consideration for the team at Synnch.
Lawful Basis and Transparency
What information we collect?
Name, email address, general information about the company you work for, phone number, along with data about your company's R&D activities.
Data
Limitation
Only data from individuals essential to providing the Synnch service is collected. This is limited to name, email address and phone number.
Data Protection by Design and by Default
Synnch is developed with proactive data protection, privacy and security in mind. Data by default is encrypted, minimised, essential in nature, and protected behind user roles and access permissions in the system.
Encrypt, pseudonymize, or anonymize personal data wherever possible.
Data is encrypted at rest and in transit within the Synnch platform, and is also encrypted when interacting with third party APIs, such as Xero.
Create an internal security policy for your team members, and build awareness about data protection.
Synnch follows strict security and privacy policies. Synnch employs multiple person approval mechanisms, MFA, password complexity, and encryption to ensure the risk of accidental or malicious data breaches.
Know when to conduct a data protection impact assessment, and have a process in place to carry it out.
The Synnch DIPA can be accessed here.
Have a process in place to notify the authorities and your data subjects in the event of a data breach.
As an Australian company, the Synnch policies and procedures align with the Australian Privacy Principals and Notifiable Data Breach framework. This also maps onto the GDPR notification process and Synnch adheres to all notification requirements in the event of a data breach.
Accountability and Governance
Designate someone responsible for ensuring GDPR compliance across your organization.
Adam Stead, Chief Technology Officer - adam@synnch.com.au
Does Synnch sign a data processing agreement between your organization and any third parties that process personal data on your behalf?
Yes
If your organization is outside the EU, appoint a representative within one of the EU member states.
TBC
Appoint a Data Protection Officer (if necessary)
Adam Stead, Chief Technology Officer - adam@synnch.com.au
Privacy Rights
It's easy for your customers to request and receive all the information you have about them.
Yes
It's easy for your customers to correct or update inaccurate or incomplete information.
Yes
It's easy for your customers to request to have their personal data deleted.
Yes
It's easy for your customers to ask you to stop processing their data.
Yes
It's easy for your customers to request and receive all the information you have about them.
Yes
It's easy for your customers to receive a copy of their personal data in a format that can be easily transferred to another company.
Yes
If you make decisions about people based on automated processes, you have a procedure to protect their rights.
Yes
As an Australian company, Synnch closely follows the Australian Privacy Principals and Notifiable Data Breach requirements.
APP 1
Open and transparent management of personal information
Synnch collects your name, email address and other contact details relevant to your relationship with your employer. We do not collect sensitive personal information about you as an individual. You can see the Synnch privacy policy here.
APP 2
Anonymity and pseudonymity
Synnch users have the ability to edit their Synnch user profile, including name.
APP 3
Collection of solicited personal information
Synnch collects your information in a lawful and fair way, limited to your name, role, contact details and other information about you as it relates to the company you work for.
APP 4
Dealing with unsolicited personal information
In the unlikely event that Synnch receives unsolicited information about an individual, it does not store, share or use that information. It is not retained in the Synnch system as Synnch requires only a limited and narrow scope of information in order to verify and authorise your use of Synnch on behalf of your company.
APP 5
Notification of the collection of personal information
You can contact us at hello@synnch.com.au to enquire about the personal information collected. We collect your name and phone number, along with your email address and other data related to the company you work for. This data is collected for the purpose of verifying your identity and permissions to use the Synnch software on behalf of your employer.
APP 6
Use or disclosure of personal information
Synnch may use or disclose your information to authorised third parties. These include integration partners, such as Xero, to enable features in the Synnch software.
APP 7
Direct marketing
From time to time Synnch may use your information to send your marketing or communications, such as software update notifications to your email address.
APP 8
Cross-border disclore of personal information
Synnch takes care to ensure any third parties your data is disclosed to have robust privacy and data protection policies, and further comply with the APPS. This data is only disclosed for the purposes of providing the services offered by the Synnch platform.
APP 9
Adoption, use or disclosure of government related identifiers
Synnch does not collect or store government related identifiers.
APP 10
Quality of personal information
Synnch encourages regular and accurate updates of personal information with users able to edit their user profile at any time in the Synnch platform.
APP 11
Security of personal information
Synnch uses robust and sophisticated data protection methodologies and technologies in the Synnch application architecture. Your data is encrypted at rest and in transit, all user accounts require MFA and you can read more about data protection in the Security tab. If you require your personal information deleted or de-identified you can do so using your Synnch login or by email, contacting hello@synnch.com.au
APP 12
Access to personal information
Synnch users are able to see and access all personal information stored about them in the Synnch platform by navigating their user profile.
APP 13
Correction of personal information
Synnch users can update their information by navigating to their user profile in the Synnch platform, or by emailing hello@synnch.com.au
Notfiable Data Breach
Our role and responsibilities
Synnch takes great care in securing your data. In the unlikely event a data breach occurs Synnch commits to investigate, re-secure and notify possibly affected parties of a data breach within the NDB requirements and timelines.
