Security at SyncShip
Last Updated: May 1st , 2026
SyncShip is committed to protecting the business, order, shipment, recipient, payment-related, and integration information processed through our platform. We maintain administrative, technical, and organizational safeguards designed to prevent unauthorized access, acquisition, disclosure, alteration, loss, misuse, or destruction of information.
Our security program applies to SyncShip's website, hosted platform, application programming interfaces, marketplace and carrier integrations, databases, file storage, administrative systems, approved employee endpoints, and service providers that process information on our behalf.
Cloud and Network Protection
SyncShip operates using controlled cloud infrastructure designed to restrict unauthorized public access to systems that process or store customer and marketplace information.
Network segmentation between public-facing services and protected internal resources
Firewalls, cloud security groups, network access-control rules, and restricted ports
Databases and internal file-storage systems that are not intended to be directly accessible from the public Internet
Restricted administrative access through approved authentication methods
Separation of production, testing, and development environments, where appropriate
Web application, intrusion, anomalous-activity, malware, and threat-detection controls
Monitoring of service APIs, storage interfaces, administrative systems, and user-facing applications
Regular operating-system, application, dependency, and infrastructure updates
Access to production systems is limited to authorized personnel and services with a documented business need.
Encryption and Key Management
SyncShip protects information in transit using TLS 1.2 or higher and other secure transmission protocols appropriate to the applicable connection.
Personally identifiable information, integration credentials, access tokens, databases, file storage, and protected backups are encrypted at rest using AES-128 or an equivalent or stronger industry-standard encryption method.
Encryption keys and credentials are maintained through controlled key-management processes. Access to keys is restricted according to job responsibilities and least-privilege principles. Encryption keys, access keys, and integration credentials are inventoried and rotated at least annually or promptly following a suspected compromise.
Credentials and access tokens are not intentionally stored in plaintext or exposed in client-side code, public repositories, ordinary support tickets, or application logs.
Identity, Password, and Access Management
SyncShip uses role-based access controls and least-privilege principles to limit access to customer and marketplace information.
Workforce and privileged accounts are assigned to individual authorized users. Shared, generic, and default administrative credentials are prohibited except where a controlled technical service account is necessary and independently secured.
Applicable password controls require:
A minimum of 12 characters
Uppercase and lowercase letters
Numbers and special characters
Restrictions against using the user's name
Prevention of reuse of the previous 10 passwords
A minimum password age of one day
A maximum password lifetime of 365 days
Account lockout after no more than 10 unsuccessful authentication attempts
Multifactor authentication is required for workforce, privileged, administrative, and other sensitive system access using approved authentication factors.
Personnel and service access is reviewed at least quarterly. Access is adjusted when responsibilities change and disabled within 24 hours following employment termination, contract termination, or another loss of authorization.
Approved Devices and Removable Media
Access to systems containing restricted information is limited to approved users and authorized devices.
SyncShip prohibits employees and contractors from storing personally identifiable marketplace, buyer, recipient, or shipment information on:
Personal computers or mobile devices
Personal email accounts
Personal cloud-storage accounts
USB flash drives or other removable media
Publicly shared folders
Other unapproved applications or storage locations
Approved devices are protected through endpoint security, anti-malware, device-management, access-control, logging, data-loss-prevention, or comparable controls appropriate to the device and risk.
Suspected unauthorized copying, storage, transfer, or disclosure is escalated as a security event. Security personnel investigate the event, restrict access where necessary, preserve relevant evidence, and take corrective action under the incident-response process.
SyncShip maintains and reviews an inventory of approved devices, systems, applications, and services that handle restricted information at least quarterly.
Data Minimization, Retention, and Secure Deletion
SyncShip collects and retains only the information reasonably necessary to provide authorized services, protect the platform, comply with source-platform requirements, or satisfy applicable legal obligations.
Restricted buyer or shipment-recipient information used for merchant-fulfilled shipping is deleted no later than 30 days after order delivery unless a longer retention period is required by a specific legal, tax, or regulatory obligation.
Non-personally identifiable marketplace information is retained for no longer than 18 months unless applicable law requires otherwise. Security logs are retained for at least 12 months.
Information reaching the end of its approved retention period is deleted, anonymized, or securely isolated through documented procedures designed to prevent ordinary recovery. Secure deletion and media sanitization follow recognized industry practices appropriate to the relevant system and storage medium.
Any legal retention exception is documented, limited to the necessary information and period, access-restricted, and not used for unrelated purposes.
Backup, Recovery, and Business Continuity
Backups containing protected information are encrypted and access-restricted. SyncShip maintains a geographically separated backup or recovery capability and documented restoration procedures.
Recovery Time Objectives and Recovery Point Objectives are established according to the criticality of the applicable service and supporting system. Backup restoration and recovery procedures are tested at least quarterly, and identified deficiencies are documented and remediated.
Expired restricted information remaining temporarily in protected backups is not restored for ordinary business use. It is deleted, overwritten, or rendered inaccessible through the documented backup lifecycle unless continued restricted retention is required by law.
Security Logging and Monitoring
SyncShip centrally collects and protects security-relevant logs from systems that access, process, transmit, or store protected information.
Depending on the system, logs may record:
User and service identities
Authentication successes and failures
Access attempts
Administrative activity
Permission and configuration changes
API activity
Data changes
System and application errors
Security alerts
Timestamps and event status
Unusual access or request patterns
Access to security logs is restricted, and controls are used to protect log integrity. Personally identifiable information is excluded from logs unless it is necessary for a documented legal or security purpose.
Automated monitoring and alerting are used to identify suspicious access, repeated authentication failures, unusual API requests, unexpected request volume, privilege changes, data-exfiltration indicators, malware, and other anomalous behavior.
Where continuous automated review is not used, documented security-log reviews are performed at least every two weeks. Alerts and monitoring findings are investigated, documented, escalated, remediated, and closed through the security-event or incident-response process.
Vulnerability Management
SyncShip maintains a vulnerability-management program covering systems that process or store customer and marketplace information.
The program includes:
Vulnerability scanning at least every 30 days
Annual penetration testing by qualified internal personnel or an independent security provider
Testing of internet-facing and internal systems, as appropriate
Application-code testing before production release
Dependency and open-source component scanning
Secret and credential scanning
Cloud and infrastructure configuration review
Tracking and retesting of identified findings
Each finding is recorded in a controlled tracking system with its severity, affected asset or component, assigned owner, detection date, required completion date, remediation status, supporting evidence, and retest result.
Critical-risk vulnerabilities are remediated within seven days after discovery. High-risk vulnerabilities are remediated within 30 days after discovery. A shorter period is followed when required by law, contract, or a connected-service provider.
A finding is closed only after the correction has been implemented and appropriately verified. Any temporary risk acceptance requires documented justification, compensating controls, an expiration date, and approval from authorized management.
Secure Software Development
SyncShip integrates security into its software-development lifecycle.
Security practices may include:
Documented security requirements
Peer review of material code changes
Static application-security testing
Dependency and software-composition analysis
Secret and credential scanning
Infrastructure and configuration review
Preproduction testing
Separation of development and production access
Release approval and change management
Runtime vulnerability and threat monitoring
Critical or material code vulnerabilities may block a release until they are corrected or formally addressed through an approved risk-management process.
Runtime findings are triaged, assigned, remediated, retested, and documented through the same vulnerability-management process.
Incident Response
SyncShip maintains a documented incident-response plan covering suspected or confirmed:
Database compromise
Unauthorized access
Credential or access-token theft
Malware or ransomware
Data exfiltration
Accidental disclosure
Loss of protected information
Misuse of an integration or administrative account
The incident-response process includes preparation, identification, analysis, containment, access and credential revocation, evidence preservation, eradication, recovery, required notifications, and post-incident review.
SyncShip maintains defined incident roles, internal escalation procedures, current response contacts, evidence-handling procedures, and customer-communication processes.
The incident-response plan is reviewed at least every six months and following a material incident, significant infrastructure change, or lessons learned from testing.
When a security incident affects information received from a connected platform, SyncShip will notify the affected platform through its current reporting channel within 24 hours after detection. SyncShip will also notify affected customers, individuals, regulators, law-enforcement authorities, or other parties when required by applicable law, contract, or platform policy.
Security Awareness and Personnel Responsibilities
Personnel with access to protected information are required to complete security and data-protection awareness training at least annually.
Personnel are required to:
Protect credentials and authentication factors
Use approved systems and devices
Follow data-classification and handling requirements
Report suspected phishing, malware, unauthorized access, or disclosure
Avoid placing sensitive information in unapproved communication channels
Comply with confidentiality and acceptable-use obligations
Access to restricted information is limited to approved personnel who have completed applicable training and acknowledged their security responsibilities.
Service Provider and Subcontractor Security
SyncShip uses service providers where necessary to operate, secure, support, and maintain the platform.
Before allowing a provider to process protected information, SyncShip performs risk-based due diligence and requires appropriate contractual obligations concerning:
Confidentiality
Data protection
Security safeguards
Access restrictions
Permitted use
Incident notification
Retention and deletion
Legal and platform-policy compliance
Providers may use protected information only to perform contracted services or satisfy applicable legal requirements. They may not use the information for independent advertising, marketing, sale, data brokerage, or unrelated commercial purposes.
Providers and subcontractors that process protected information are risk-assessed before access is granted and at least annually thereafter.
Customer Security Responsibilities
Customers contribute to platform security by:
Using unique credentials
Enabling available multifactor authentication
Protecting access tokens and API keys
Limiting user permissions
Reviewing authorized users regularly
Using approved and secure devices
Promptly revoking unnecessary access
Monitoring connected stores and integrations
Reporting suspected compromise without delay
Customers must not share marketplace usernames, passwords, credentials, or tokens through unapproved channels.
Reporting a Security Concern
If you believe you have identified a security vulnerability, unauthorized access, data exposure, or another security concern involving SyncShip, contact:
SyncShip LLCSecurity: info@sync-ship.comWebsite: https://sync-ship.com
Please provide sufficient information for SyncShip to understand and investigate the issue. Do not access, alter, download, retain, or disclose information that does not belong to you. Do not perform testing that may disrupt the platform, affect another customer, or violate applicable law.
SyncShip may update this Security page as its services, infrastructure, security practices, legal obligations, or connected-platform requirements change.
END OF SECURITY PAGE