Security
Global Office: Sync handles financial records, tax IDs, bank activity and the documents behind them. That information needs more than a reassuring badge and a vague promise that we take security seriously.
Here's what Global Office: Sync actually does.
Bank connections
Bank connections are handled through Plaid. You connect through Plaid's secure process, and your bank username and password never enter Global Office: Sync.
Sync receives the permission needed to read the accounts you choose. It can't move money, make payments or change anything at your bank.
The access token Plaid issues for your connection is encrypted with its own key, separate from the keys that protect tax IDs and accounting software logins, and that key isn't stored in the database.
Documents
Receipts, invoices, tax forms, insurance certificates and other uploaded files are stored privately. They don't have permanent public addresses.
When Global Office: Sync needs to show you a document, it creates a temporary link for that specific file. The link stops working within 12 hours, or sooner when you sign out.
Documents are never attached to the emails Global Office: Sync sends. Its own notices also avoid client names, dollar amounts and file names. Document requests and the messages you write and send through Sync are the exceptions, and the privacy page says what they carry.
None of the storage keys Sync holds can erase a file for good. Removing a document hides it, and the storage service clears it later on its own schedule. A stolen key couldn't wipe out your receipts.
Artificial intelligence
Global Office: Sync uses Google's Gemini models for specific parts of the work: reading uploaded documents, understanding what was bought or billed, identifying likely vendor types and proposing matches to a chart of accounts.
It does not turn an AI loose on your books. Missing-document checks, duplicate detection, Account Coverage, reminders and comparisons between dates, amounts and records are handled by Sync's rules and the records themselves, not AI.
AI doesn't decide whether something is deductible, make the final bookkeeping decision or send anything to your accounting system. Sync proposes. A person approves.
Before a photo is uploaded, Sync checks its sharpness and brightness right on your device. That check uses the pixels in the image, not AI, and nothing is sent to a server merely to decide whether the picture is usable. If the photo looks questionable, Sync asks. It never refuses the document.
Sharing with a bookkeeper
Connecting a business to a bookkeeper doesn't simply open the doors to everything.
The business owner chooses:
Either side can end the connection. If bank sharing is turned off, the bookkeeper loses access on the next request.
Global Office: Sync doesn't trust the browser to decide who should see a record. That decision is made by the server every time information is requested.
Your account
Every part of the database the app can reach carries a rule of its own. Each request is tied to the person who's signed in, and the database hands back that account's records and nobody else's. A request that doesn't say who's asking gets nothing at all.
That holds even if a question Global Office: Sync asks forgets to say whose records it wants. The database answers for the signed-in account and nobody else. It's a second lock, not the only one. The server still checks every request before it gets that far.
The only crossings are ones you set up yourself: a bookkeeper you've connected sees what you chose to send them, and an Account Coverage account you share is seen by the person you shared it with.
Disconnecting
Disconnecting a bank does more than hide it from the screen.
When you disconnect a bank, Global Office: Sync stops using and sharing it right away. It deletes the imported transactions and the stored access information, and your bookkeeper can't see that bank's accounts or transactions anymore.
It also tells Plaid to end the connection, and if Plaid doesn't confirm, Sync keeps trying until it does.
Tax IDs and passwords
Social Security numbers and Employer Identification Numbers are encrypted before they're saved, whether they come from a W-9 or from a 1099 you receive. The database refuses to store one that hasn't been encrypted.
A W-9 is never asked for by email. Every W-9 request carries a secure upload link made for that one person, whether it goes by text, from your own email or through Sync, and the message asks them not to email the form.
Connections to QuickBooks, Xero and FreshBooks are also encrypted. The Plaid access token Sync uses to read connected accounts is encrypted with its own key.
Passwords are never stored in readable form. They're protected using a slow, one-way process designed specifically for passwords. There's no button anyone at Sync can press to reveal your password.
The audit trail
When you file a scanned document, the audit trail keeps what Global Office: Sync read beside what you approved.
Every later correction records:
This history means a corrected figure can be explained later without having to trust anyone's memory.
Backups
Every change is sent off site within about six minutes, and a full copy is made every night and every week. The nightly copy automatically retries if one fails.
Global Office: Sync keeps:
Backups are only useful if they can actually be restored, so restores are practiced, not assumed. A real backup is restored into a separate copy, and the protected information in it is confirmed to open with keys that are kept apart from the backups.
Each backup is locked for its first 30 days. Nothing on the server can delete one, and when that was tested, even the storage account's master key was refused.
The network
The database can't be contacted from the public internet. The automation and administration tools behind Sync aren't reachable from the public internet without an administrator's sign-in, and the administration tools check that sign-in themselves.
The automation that does the app's work signs in to the database with a login that can read and write records and nothing more. It can't change how the database is built.
Public traffic passes through Cloudflare before reaching Global Office: Sync. Requests that attempt to bypass that path are refused. Repeated wrong passwords from one address stop being accepted for a while, and repeated failed attempts to log in to the server itself are blocked.
The web server strips sign-in passes, access keys and the signatures on document links out of its logs, for every site it runs, before anything is written. And the app refuses to run any script that's written into a page rather than loaded from an approved source, so code slipped into a page doesn't run.
Privacy
Global Office: Sync keeps the information needed to operate the service and protect your account. The app doesn't record which screens you visit and doesn't collect information about your device. This website counts page views, and that's all.
A sign-in ends after a stretch without use that you choose in Settings, from 15 minutes to 8 hours (an hour unless you change it), and never lasts more than 12 hours. Within an hour of it ending, the record of that sign-in is boiled down to an anonymous count of how many people signed in that day. The audit trail does keep the network address beside each change to your records, because that's what the trail is for.
Outside services
Global Office: Sync uses outside services where they're necessary to provide a specific part of the product:
Connecting one service doesn't automatically connect the others. Information is sent only where it's needed to perform the feature you chose to use.
No system connected to the internet can honestly claim that nothing could ever happen to it.
What Global Office: Sync can do is reduce what's exposed, encrypt the most sensitive information, limit who can reach it, preserve the history behind every change and maintain tested backups if something goes wrong.
That's what has been built.