Data Handling
Your data, your control
Where your data lives, how it is protected, how you can export it, and how you can delete it. No fine print, no lock-in.
Where your data lives
All data is stored on Google Cloud Platform infrastructure in the Singapore region (asia-southeast1).
- Database: PostgreSQL with row-level security on every business table. All data is tenant-scoped.
- Encryption in transit: TLS 1.2+ enforced on all connections. TLS 1.3 supported. HTTPS everywhere via Cloudflare.
- Encryption at rest: AES-256 encryption via GCP default managed encryption. All database storage and backups are encrypted.
- Secrets management: Production credentials stored in GCP Secret Manager. No secrets in application code.
- Caching layer: Redis for rate limiting, circuit breaker state, and idempotency keys. Redis holds transient operational data, not contact PII.
Automated daily backups
The database is backed up daily with a 7-day retention window. Backups are encrypted and stored within the same GCP region.
Backup schedule
- Daily automated backup at 03:00 UTC
- 7-day retention window
- Encrypted at rest
What is backed up
- All contacts, events, and email logs
- Templates, flows, and segments
- Workspace settings, API keys (hashed), RBAC configuration
Export your data anytime
Your data is accessible through the API in standard formats. No proprietary export process, no waiting for support tickets.
Export contacts via the API in CSV or JSON format. For datasets under 5,000 contacts, the export streams synchronously. For larger exports, an async job processes the export and makes the file available for download.
What you can export
- Contact records with all custom properties
- Column and filter options for targeted exports
- Events, email logs, and analytics via API endpoints
Data deletion
Synapse provides multiple levels of data deletion, from soft delete with recovery to permanent erasure.
Standard contact deletion marks the record as deleted without removing it from the database. The contact can be recovered if the deletion was accidental.
The GDPR hard-delete endpoint permanently removes a contact and all related data. This is a destructive, irreversible operation designed for right-to-erasure requests. The API returns a count of all related records that were deleted.
POST /v1/contacts/by-id/{id}/gdpr-delete
# Requires settings:write permission
# Returns { "deleted_related_records": 42 }Workspace owners can delete the entire workspace. Deletion is scheduled with a 30-day grace period. During the grace period, the owner can cancel the deletion. After the grace period, all workspace data is permanently removed.
No vendor lock-in
We built Synapse because we were tired of being locked into vendors that made it hard to leave. Here is how we make sure you never feel trapped.
- API-first architecture: Every capability is accessible through the REST API. Nothing is dashboard-only. If you need to migrate, you can script the entire extraction.
- Standard data formats: Contacts export as CSV or JSON. Events and email logs are accessible via API. No proprietary binary formats.
- No proprietary template language required: NLT (Natural Language Templating) is our recommended syntax, but Synapse also supports standard Jinja templates. If you leave, your Jinja templates work elsewhere without modification.
- Full export capability: Export all your data — contacts, properties, segments, and event history — at any time through the API. No export fees, no waiting period, no support ticket required.
Built with GDPR data rights in mind
Synapse provides the technical capabilities needed to fulfill GDPR data subject requests. These are built into the platform, not bolted on as an afterthought.
| Right | How Synapse supports it |
|---|---|
| Right to access | Full contact data export via API (CSV, JSON) with all custom properties |
| Right to erasure | GDPR hard-delete endpoint permanently removes contact and all related records |
| Right to rectification | Contact properties are fully editable via API and dashboard |
| Right to data portability | Standard format exports (CSV, JSON) through the API |
Synapse has the technical capabilities for GDPR compliance, but has not undergone a formal GDPR compliance assessment. If you require a signed Data Processing Agreement, please contact us to discuss our timeline.
What we do not have yet
| Capability | Current state |
|---|---|
| Automated data retention cleanup | Plan-level retention periods are defined, but no automated cleanup job runs yet. Data is retained until manually deleted. |
| Multi-region deployment | All data is stored in a single GCP region (Singapore). Multi-region is on the roadmap. |
| Data Processing Agreement (DPA) | No standalone DPA document is available yet. Contact us to discuss. |
Start building with full data control
Free tier includes full export capabilities, GDPR endpoints, and test/live environment isolation. No credit card required.