Security

Last updated 22 October 2026

Construction projects bring competing companies into one system. Syncsyte is built so that each person sees exactly what they are entitled to, and nothing else.

Access, decided on every request

Access is checked on the server for every request, in order: you, your organization, the project, the item, your role's permissions, then the file. Anything you may not see does not exist for you: lists, search, Ask AI, activity feeds, profiles and downloads all apply the same rules. Being an organization administrator never grants access to a project's content.

Classification

Items can be Normal, Internal, Restricted, Confidential or Highly confidential. Restricted and above stay within the organization that created them; the highest levels also require clearance. There is no administrator bypass.

Files

• Uploads are checked against an allow-list of file types and their actual content, hashed with SHA-256, and scanned for malware before anyone else can open them.
• Files that carry executables, launch actions or the EICAR test signature are blocked, including inside ZIP and Office files.
• Downloads use links that expire after five minutes, work only for the person they were issued to, and are re-authorized when used.

Accounts

• Passkeys, authenticator-app two-factor with recovery codes, or strong passwords with lockout after repeated failures.
• Sessions in an HttpOnly, Secure cookie, expiring after 7 days or 12 hours idle; you can sign out other devices.
• Bot protection on sign-in, sign-up and password reset.

Audit trail

Every change is recorded with who, which organization, when and from where. Each audit entry carries the hash of the one before it, and the database refuses edits and deletions of the log, so tampering is detectable.

Integrations

Webhooks send signed event notices (HMAC-SHA-256) to HTTPS endpoints that project administrators register. They carry identifiers and status only, never document content, and omit titles of classified items.

Recovery

The database supports point-in-time restore, and a restore drill (back up, restore into a fresh database, verify every table and the audit chain) is part of operations.