Trust & Security

Sensitive fields — Medicare numbers, private health details, DVA numbers — are encrypted at rest with AES-256-GCM before they're ever written to the database, and decrypted only for the specific role that's authorised to see them. Financial data (billing, payer information) is stripped from every API response for staff and doctor accounts that shouldn't see it — this is enforced server-side, not just hidden in the interface.

ZyncoAI is designed around the Australian Privacy Principles: we collect only what's needed to run your front desk, we don't sell or share patient data with third parties, and every sensitive-record view, download, or send is written to an audit log your practice can review. Compliance with the Privacy Act for how your practice uses ZyncoAI is a shared responsibility — we recommend your practice's compliance officer reviews your own configuration.

Our database and file storage — business records, contacts, appointments, invoices, and call recordings — are hosted in Sydney, Australia (ap-southeast-2). That's the honest scope of the claim: it covers where your data is stored, not every step of how a call is handled. To answer a call in real time, audio and transcript text are sent to overseas AI providers (speech-to-text, the conversational AI, and text-to-speech) and carried by our telephony provider — see the full named subprocessor list at /privacy#subprocessors for exactly which providers, what each receives, and where.

• AES-256-GCM for sensitive fields at rest (Medicare/DVA/private health numbers, OAuth tokens).
• TLS in transit for every connection to the dashboard, API, and voice platform.
• Separate encryption keys for different data classes, so rotating one never affects another.

• ZyncoAI doesn't store clinical data — no diagnoses, results, or My Health Record content. Scan and pathology entries track metadata only (type, date, ordering doctor, status); uploaded reports are opaque files, never parsed into structured data.
• No AHPRA practitioner registration numbers are captured or stored anywhere in the platform.

Role-based access (Owner / Admin / Staff / Doctor) is enforced on every API route, not just hidden in the UI. Doctors only ever see their own patients and schedule; Staff never see financial or payer data; only Owner/Admin can manage integrations, billing, and staff.

If we identify a security issue affecting your data, we notify affected practices directly and provide a clear timeline and remediation. We don't currently publish a public bug-bounty program, but we take reports seriously — email support@zyncoai.com if you find something.

ZyncoAI is not yet SOC 2 certified — formal certification is on our roadmap as we scale. Our data-handling practices are built around GDPR principles (data minimisation, purpose limitation, encryption), but we don't claim formal GDPR certification today. We'll update this page as our compliance posture matures.