Security at Sym

SOC 2 Type II – We have established processes and internal monitoring controls to give us the confidence that we’re operating at the highest standards. Externally, we undergo an annual SOC 2 Type II audit to ensure that our security program is appropriately managed and there is continuous improvement. Our report is available to all customers and prospects upon request.

We are deliberate in determining what information is collected and what is not collected. Our Privacy Policy outlines all of our customer’s rights with regards to GDPR and CCPA. Our goal is to minimize the amount of information collected, and have full transparency along the way.

Sym is fully hosted in Amazon Web Services (AWS), which provides industry-leading physical security and environmental controls. We utilize multiple availability zones, which guarantees that data is kept in separate physical locations, provides redundancy, and ensure systems are not subject to the same environmental risks. System automation is used heavily to minimize the likelihood of human error and ensure business continuity processes are sound.

We adopt a number of security best practices when it comes to data and access security. Our networks are segregated in VPCs with a minimal number of external endpoints. Network access is controlled by a firewall and key services require MFA. All sensitive system data is encrypted at rest using AES 256bit encryption. Data transmitted through our encrypted APIs or via the customer's browser is transferred over HTTPS/TLS 1.2. System administration occurs only over encrypted protocols.