Where it runs
The server and the database run in the European Union, in the Netherlands.
The service is hosted on infrastructure providers with SOC 2 reports (Railway / Google Cloud, EU – Netherlands). That describes the providers. SyncERP itself is not SOC 2 certified.
What it can do in Soft1
The connection is read-only by default: the AI reads Soft1 and does not write.
Writes happen only if the company enables them.
Customer personal data
Customer personal data is masked before it reaches the AI. Phone, email, address and VAT number show as asterisks.
Reveal is limited to a user with permission. The company decides who sees full details and who sees masked data.
Credentials and sign-in
Soft1 connection credentials are encrypted at rest. Each company is isolated.
The AI client signs in with OAuth 2.1, using Dynamic Client Registration (DCR) and PKCE. No client ID is required and no API key is exchanged: the company signs in with its account at mcp.syncerp.gr.
Model training
SyncERP does not store or train models on your data. There is no training on customer data.
Subprocessors
Subprocessors involved in running the service and the site:
- Railway — infrastructure hosting.
- Google Cloud — infrastructure hosting.
- Cloudflare — site hosting and CDN.
- Viva Wallet — payments.
- Anthropic and OpenAI — only as your own AI client (Claude or ChatGPT). We do not send them data for training.
Data processing agreement (DPA)
To request a data processing agreement, email hello@syncerp.gr.