Security

Security at Syncademia

Last updated June 12, 2026

Sync holds education records for clinical training programs. We treat that as a design constraint, not a compliance checkbox. The strongest protections below are architectural, and they apply to every institution on the platform.

De-identified patient data, by construction

Sync’s case logging stores de-identified clinical attributes only. Patient names, dates of birth, record numbers, contact details, and other direct identifiers are not collected: the schema and input validation reject them at the point of entry. This isn’t a policy promise that depends on user behavior; the system has no place to put a patient identifier.

Tenant isolation

Every institution’s data lives in its own dedicated database, not in shared tables separated by a column. Offboarding is equally clean: when a contract ends, your data is exported on request and your database is destroyed, provably.

Encryption

All data is encrypted in transit (TLS) and at rest (AES-256 via AWS Key Management Service), including databases, document storage, and backups. Credential documents (immunizations, titers, licenses) are stored encrypted and served only through signed, time-limited URLs.

Access & authentication

Institutions sign in through their own identity provider via SAML single sign-on (Microsoft Entra ID, Okta, Shibboleth, and others), so your existing access and MFA policies apply. Inside the platform, role-based access controls what students, faculty, and preceptors each see. Internally, we operate on least-privilege access with multi-factor authentication, and administrative actions are audit-logged.

Infrastructure

Sync runs on Amazon Web Services in the United States, in private network segments behind a web application firewall. Static assets are delivered via CDN; secrets are managed in AWS Secrets Manager, never in code or configuration files.

Backups & continuity

Databases are backed up continuously with point-in-time recovery, and encrypted copies are maintained in a second AWS region for disaster recovery. Restores are tested as part of our operational routine, not assumed. Specific recovery objectives are available to institutions during security review.

Compliance posture

Student data in Sync is handled as FERPA-protected education-record data, with Syncademia acting under our customers’ direction. Because patient data is de-identified by construction, Sync does not store protected health information. We support institutional security reviews and complete HECVAT and security questionnaires as part of procurement.

Reporting a vulnerability

Email hello@syncademia.com with “Security report” in the subject. We acknowledge reports within one business day, and we do not pursue legal action against good-faith research conducted within reasonable bounds.

Questions from a security review team? Send your questionnaire to hello@syncademia.com. We’ll turn it around quickly.