Security &
Trust.

Request it under NDA through the Stacksync Trust Center at security.stacksync.com, which also holds the security whitepaper, the subprocessor list and audit reports. Ask for it when your evaluation starts, and check the audit period against what your own auditors need.

The two-way sync path passes records through: Stacksync reads a change, writes it to the other system and keeps no copy. Five things do persist for a time: undelivered payloads and events, logs for your plan's retention period, encrypted connection credentials, sync state (record IDs and change-detection fingerprints) and any database or event queue you choose to host on Stacksync. Stacksync encrypts data with TLS 1.2+ in transit and AES-256 at rest.

The compare table on /pricing lists SOC 2 Type II, ISO 27001, HIPAA and DPF US-EU-UK-CH on Pro and up; GDPR and CCPA on every plan. HIPAA workloads run under a Business Associate Agreement. If your review needs a framework on a specific plan, confirm it in your order form before you sign.

No. Per the /pricing compare table, MFA is on Pro and up, SSO and SCIM on Enterprise only, and IP allowlisting on Pro and up. Passwordless and social logins and role-based access control are on every plan.

Yes, Stacksync offers EU processing regions. You select the region for your workspace, and the choice widens by plan, up to every region including custom locations on Enterprise. Stacksync signs a Data Processing Addendum as a GDPR processor and is DPF-certified for US, EU, UK and Swiss transfers. If your policy requires EU-only processing with no US transit, ask for the current region list, the control-plane location and the egress IPs during your review, and write the requirement into the DPA.

Stacksync governs its AI features with the same platform controls as the rest of the product: role-based access, approval steps that hold a write until a person signs off, and the log explorer for each run. Stacksync AI Copilot builds integrations and workflows from a prompt, and Genies are AI agents that act across your connected systems. You can build two-way sync and workflows by hand when a policy keeps AI out of scope. The AI agent governance page at /security/ai-agents covers approvals, audit and the questions to raise in a security review.

Not as published: the processing region you select covers sync processing, and the site does not yet state where AI inference for Stacksync AI Copilot and Genies runs. Ask for the inference region, model providers and retention terms in writing during your security review and check them against the Data Processing Addendum and the sub-processor list in the Trust Center. /security/ai-agents lists these questions.

Through the integration user or OAuth app you create, scoped to the objects the sync needs. Stacksync stores its credentials encrypted, and revoking or rotating that user in the source system stops access. For the terms that govern Stacksync staff access, ask your account team and put them in your DPA or contract.

Raise FedRAMP and GovCloud requirements with Stacksync before a POC and get the answer in writing, because FedRAMP is not among the frameworks this page lists. For data that must stay in your own data center, on-premise deployment is on Enterprise only.

Ask for the SOC 2 Type II report with its audit period, the ISO 27001 certificate, the security whitepaper, the Data Processing Addendum and the subprocessor list. Then confirm three answers in writing: what the vendor stores, where it processes data, and which plan includes the controls you need. For Stacksync, the Trust Center holds the SOC 2 report, whitepaper and subprocessor list, and the DPA sits in the Stacksync docs.