--- title: "Compliance: SOC 2, ISO 27001, GDPR, HIPAA | Stacksync" description: "Stacksync is SOC 2 Type II, ISO 27001, GDPR, HIPAA, CCPA, and DPF certified. Enterprise data sync with audited controls at every layer." canonical: https://www.stacksync.com/compliance last_modified: 2026-07-05 --- COMPLIANCE # Enterprise-grade compliance, without compromise. Stay ahead of regulatory requirements with globally recognized certifications and data protection standards. [Start syncing now](https://app.stacksync.com/) [Talk with a cloud architect](https://www.stacksync.com/book-a-demo) Last audit 2026 Q1 Sub-processors 12 Trust center Live DPA Self-serve Stacksync is SOC 2 Type II audited, ISO 27001 certified, HIPAA-aligned (BAA supported), GDPR and CCPA compliant, and EU-US Data Privacy Framework registered. The [plan comparison](https://www.stacksync.com/pricing#compare) shows which frameworks come with each plan, and the Trust Center shares the SOC 2 Type II report under NDA. FRAMEWORKS ## Compliance you can trust Our certifications and frameworks ensure your business data remains safe, compliant, and reliable at every scale. 01 / 06 ### SOC 2 Type II Independently audited controls for security, availability, and confidentiality. Scope Annual audit Region Global 02 / 06 ### ISO 27001 Global standard for information security management systems. Scope Certified 2024 Region Global 03 / 06 ### GDPR Compliant with the EU General Data Protection Regulation. Scope Continuous Region EU · EEA · UK 04 / 06 ### HIPAA Safeguards for Protected Health Information (PHI). BAA available. Scope BAA on request Region United States 05 / 06 ### CCPA Meets California Consumer Privacy Act obligations end-to-end. Scope Continuous Region California, US 06 / 06 ### DPF · US-EU, UK, CH Certified under the Data Privacy Framework for cross-border transfers. Scope Cross-border Region US ⇄ EU · UK · CH RECOMMENDED RESOURCES ## Security at a glance As a data company, we understand the importance of keeping your data secure. Stacksync is built with security best practices to keep your data safe at every layer. - Policy ### [Privacy policy](https://docs.stacksync.com/security-and-other-resources/legal/privacy-notice) How we protect and manage your personal data. - Legal ### [Terms of service](https://docs.stacksync.com/security-and-other-resources/legal/terms-of-service-and-conditions-tc) Rules and guidelines for using our platform. - Whitepaper ### [Security whitepaper](https://www.stacksync.com/stacksync-comprehensive-data-protection-privacy-and-compliance-for-modern-automation-and-data-sync-across-enterprise-systems/overview) Our comprehensive data protection measures. - Legal ### [Data Processing Addendum](https://docs.stacksync.com/security-and-other-resources/legal/data-processing-addendum-dpa) Legal framework for GDPR-compliant data processing. TRUST CENTER ### Live status of every control Real-time evidence, current sub-processors, recent audits, and one-click access to our SOC 2 report, all in one place. [Visit Trust Center](https://security.stacksync.com/) FAQ ## Frequently asked questions ### Which compliance certifications does Stacksync hold? SOC 2 Type II, ISO 27001, GDPR, CCPA and the Data Privacy Framework (DPF) for US, EU, UK and Swiss transfers. Stacksync supports HIPAA-aligned deployments under a Business Associate Agreement (BAA). The /pricing comparison table lists SOC 2 Type II, ISO 27001, HIPAA and DPF US-EU-UK-CH on Pro and up; GDPR and CCPA on every plan. The SOC 2 Type II report and other audit documents are available under NDA through the Trust Center at security.stacksync.com. ### Is Stacksync HIPAA compliant for healthcare data? Stacksync supports HIPAA-aligned deployments under a Business Associate Agreement (BAA). HIPAA is on Pro and up in the /pricing comparison table. The BAA is signed at the start of any healthcare engagement. Common HIPAA use cases include EHR-to-CRM sync, claims sync between billing platforms, and lab-result routing. ### Where is Stacksync data processed and stored? In the processing region you select for your workspace. The choice widens by plan, up to every region including custom locations on Enterprise. If your policy requires data to stay in one region, ask for the current region list, the control-plane location and the egress IPs during your review, and write the requirement into your Data Processing Addendum (DPA). Where AI inference runs for Stacksync AI Copilot and Genies is confirmed separately in security review (see /security/ai-agents). The security page lists what Stacksync stores and for how long. ### Can I get a copy of the SOC 2 Type II report? Yes. Stacksync shares its SOC 2 Type II report under NDA through its Trust Center at security.stacksync.com, or through your account team. Check the audit period against what your own auditors need. Many buyers request the ISO 27001 certificate at the same time. ### Is Stacksync GDPR compliant for EU customer data? Yes. Stacksync acts as a data processor under GDPR and signs a Data Processing Addendum (DPA). It offers EU processing regions and is DPF-certified for US, EU, UK and Swiss transfers. If your policy requires EU-only processing with no US transit, ask for the current region list, the control-plane location and the egress IPs during your review, and write the requirement into the DPA. GET STARTED ## Syncing data at scale across all industries. - POC from integration engineers - Two-way, real-time sync - Workflow automation - White-glove onboarding [Book a demo](https://www.stacksync.com/book-a-demo) CUSTOMER · LIVE > "We've been using Stacksync across 4 different projects and can't imagine working without it." > Alex Marinov VP Technology, Acertus Delivers