Security

Sinculate never changes a client's billing on its own. Every quantity change needs your approval, and each one is logged with who approved it and when. Sinculate also checks that nobody has edited the line since it last looked, so it never overwrites someone else's change.

• All customer data is stored in Canada.
• The marketing site you're reading is separate from the Sinculate app. It holds no customer data and has no logins.

• You sign in with your existing work account. Your organization's MFA applies.
• Sinculate never stores your password.
• Connections to vendors and your PSA use their official, scoped access methods. We never ask for or keep the passwords for those accounts.

• Data is encrypted in transit and at rest, and backups are encrypted.
• Connection tokens and other secrets are kept in a dedicated key vault, not in the database or code.
• Each MSP's data is kept apart from every other MSP's at the database level.
• Changes are written to an audit log that shows who did what and when.

• We follow Canada's privacy law (PIPEDA) and Quebec's private-sector privacy law. See our privacy policy.
• We're building toward a SOC 2 audit and will share its status here.
• Before launch we'll publish a list of the service providers (subprocessors) that handle customer data.

If you think you've found a security problem with sinculate.com or Sinculate, email hello@sinculate.com with the subject "Security report". We'll reply within two business days. Please don't test against other people's data or disrupt the service.