Enterprise-grade compliance,
without compromise.

SOC 2 Type II, ISO 27001, GDPR, CCPA and the Data Privacy Framework (DPF) for US, EU, UK and Swiss transfers. Stacksync supports HIPAA-aligned deployments under a Business Associate Agreement (BAA). The /pricing comparison table lists SOC 2 Type II, ISO 27001, HIPAA and DPF US-EU-UK-CH on Pro and up; GDPR and CCPA on every plan. The SOC 2 Type II report and other audit documents are available under NDA through the Trust Center at security.stacksync.com.

Stacksync supports HIPAA-aligned deployments under a Business Associate Agreement (BAA). HIPAA is on Pro and up in the /pricing comparison table. The BAA is signed at the start of any healthcare engagement. Common HIPAA use cases include EHR-to-CRM sync, claims sync between billing platforms, and lab-result routing.

In the processing region you select for your workspace. The choice widens by plan, up to every region including custom locations on Enterprise. If your policy requires data to stay in one region, ask for the current region list, the control-plane location and the egress IPs during your review, and write the requirement into your Data Processing Addendum (DPA). Where AI inference runs for Stacksync AI Copilot and Genies is confirmed separately in security review (see /security/ai-agents). The security page lists what Stacksync stores and for how long.

Yes. Stacksync shares its SOC 2 Type II report under NDA through its Trust Center at security.stacksync.com, or through your account team. Check the audit period against what your own auditors need. Many buyers request the ISO 27001 certificate at the same time.

Yes. Stacksync acts as a data processor under GDPR and signs a Data Processing Addendum (DPA). It offers EU processing regions and is DPF-certified for US, EU, UK and Swiss transfers. If your policy requires EU-only processing with no US transit, ask for the current region list, the control-plane location and the egress IPs during your review, and write the requirement into the DPA.