Security
Global Office: Sync handles financial records, tax IDs, bank activity and the documents behind them. That information needs more than a reassuring badge and a vague promise that we take security seriously.
Here's what Global Office: Sync actually does.
Signing in
Every account, in every edition, signs in with two steps. After the right password, Global Office: Sync asks for Face ID, a fingerprint or the device's PIN on a device you've set up. On any other device it emails you a six-digit code. The code works for that sign-in only, it runs out after ten minutes, and five wrong tries end it.
After a code sign-in, Sync offers to set that device up, so next time it's your face or your finger. A device that's set up can sign in with Face ID alone, because the device and the person holding it are already two steps.
Your face and your fingerprint never leave the device. The device keeps a private key behind them and gives Global Office: Sync only the public half, which can check a signature but can't make one. And that key only answers to go-sync.app, so a fake sign-in page gets nothing from it. An emailed code is different: somebody could be tricked into typing it into a fake page. That's the weak spot, and it's why connecting a bank asks for more.
Connecting a bank always takes Face ID or a fingerprint. An emailed code alone never opens Plaid's window, in the app or on the bank link a bookkeeper sends a business owner. The owner doesn't need a Sync account. The first time on a device, they confirm with a code sent to the business's email, then set up Face ID for the business on that page.
Every time a device is added, Global Office: Sync emails the account to say which device and when. If it wasn't you, the email's "This wasn't me" button removes that device and signs out every session on the account. It asks before it does anything, so a mail filter that opens links can't set it off. Settings, Security & Credentials lists your devices with a Remove button beside each, and every add and remove goes in your account's record.
Lose your phone and you aren't locked out. Your password and an emailed code still get you in, and then you can remove the lost phone.
Bank connections
Bank connections are handled through Plaid. You connect through Plaid's secure process, and your bank username and password never enter Global Office: Sync.
Sync receives the permission needed to read the accounts you choose. It can't move money, make payments or change anything at your bank.
The access token Plaid issues for your connection is encrypted with its own key, separate from the keys that protect tax IDs and accounting software logins, and that key isn't stored in the database.
Documents
Receipts, invoices, tax forms, insurance certificates and other uploaded files are stored privately. They don't have permanent public addresses.
When Global Office: Sync needs to show you a document, it creates a temporary link for that specific file. The link stops working within 12 hours, or sooner when you sign out.
Documents are never attached to the emails Global Office: Sync sends. Its own notices also avoid client names, dollar amounts and file names. Document requests and the messages you write and send through Sync are the exceptions, and the privacy page says what they carry.
None of the storage keys Sync holds can erase a file for good. Removing a document hides it, and the storage service clears it later on its own schedule. A stolen key couldn't wipe out your receipts.
Artificial intelligence
Global Office: Sync uses Google's Gemini models for specific parts of the work: reading uploaded documents, understanding what was bought or billed, identifying likely vendor types and proposing matches to a chart of accounts.
It does not turn an AI loose on your books. Missing-document checks, duplicate detection, Account Coverage, reminders and comparisons between dates, amounts and records are handled by Sync's rules and the records themselves, not AI.
AI doesn't decide whether something is deductible, make the final bookkeeping decision or send anything to your accounting system. Sync proposes. A person approves.
Before a photo is uploaded, Sync checks its sharpness and brightness right on your device. That check uses the pixels in the image, not AI, and nothing is sent to a server merely to decide whether the picture is usable. If the photo looks questionable, Sync asks. It never refuses the document.
Sharing with a bookkeeper
Connecting a business to a bookkeeper doesn't simply open the doors to everything.
The business owner chooses:
Either side can end the connection. If bank sharing is turned off, the bookkeeper loses access on the next request.
Global Office: Sync doesn't trust the browser to decide who should see a record. That decision is made by the server every time information is requested.
Your account
Every part of the database the app can reach carries a rule of its own. Each request is tied to the person who's signed in, and the database hands back that account's records and nobody else's. A request that doesn't say who's asking gets nothing at all.
That holds even if a question Global Office: Sync asks forgets to say whose records it wants. The database answers for the signed-in account and nobody else. It's a second lock, not the only one. The server still checks every request before it gets that far.
The only crossings are ones you set up yourself: a bookkeeper you've connected sees what you chose to send them, and an Account Coverage account you share is seen by the person you shared it with.
Disconnecting
Disconnecting a bank does more than hide it from the screen.
When you disconnect a bank, Global Office: Sync stops using and sharing it right away. It deletes the imported transactions and the stored access information, and your bookkeeper can't see that bank's accounts or transactions anymore.
It also tells Plaid to end the connection, and if Plaid doesn't confirm, Sync keeps trying until it does.
Tax IDs and passwords
Your records and documents are encrypted where they're stored. The database sits on an encrypted storage volume of its own, apart from the server's main disk, and every document you upload is stored encrypted at Backblaze (AES-256). So is every backup made since early October 2026. The server's main disk, which holds the programs and their logs, isn't encrypted. That's why this says records and documents, not everything.
On top of that, Social Security numbers and Employer Identification Numbers are encrypted before they're saved, whether they come from a W-9 or from a 1099 you receive. The database refuses to store one that hasn't been encrypted.
A W-9 is never asked for by email. Every W-9 request carries a secure upload link made for that one person, whether it goes by text, from your own email or through Sync, and the message asks them not to email the form.
Connections to QuickBooks, Xero and FreshBooks are also encrypted. The Plaid access token Sync uses to read connected accounts is encrypted with its own key.
Passwords are never stored in readable form. They're protected using a slow, one-way process designed specifically for passwords. There's no button anyone at Sync can press to reveal your password.
The audit trail
When you file a scanned document, the audit trail keeps what Global Office: Sync read beside what you approved.
Every later correction records:
This history means a corrected figure can be explained later without having to trust anyone's memory.
Backups
Every change is sent off site within about six minutes, and a full copy is made every night and every week. The nightly copy automatically retries if one fails.
Global Office: Sync keeps:
Backups are only useful if they can actually be restored, so restores are practiced, not assumed. A real backup is restored into a separate copy, and the protected information in it is confirmed to open with keys that are kept apart from the backups.
Each backup is locked for its first 30 days. Nothing on the server can delete one, and when that was tested, even the storage account's master key was refused.
The network
The database can't be contacted from the public internet. The automation and administration tools behind Sync aren't reachable from the public internet without an administrator's sign-in, and the administration tools check that sign-in themselves.
The automation that does the app's work signs in to the database with a login that can read and write records and nothing more. It can't change how the database is built.
Public traffic passes through Cloudflare before reaching Global Office: Sync. Requests that attempt to bypass that path are refused. Repeated wrong passwords from one address stop being accepted for a while.
The server's maintenance door can't be reached from the internet at all. It opens only through Cloudflare, after Cloudflare has checked who's asking, and even then it needs the right key. The hosting account itself signs in with a passkey.
The web server strips sign-in passes, access keys and the signatures on document links out of its logs, for every site it runs, before anything is written. And the app refuses to run any script that's written into a page rather than loaded from an approved source, so code slipped into a page doesn't run.
Privacy
Global Office: Sync keeps the information needed to operate the service and protect your account. The app doesn't record which screens you visit. This website counts page views, and that's all.
A sign-in ends after a stretch without use that you choose in Settings, from 15 minutes to 8 hours (an hour unless you change it), and never lasts more than 12 hours. Sync keeps a record of each sign-in: when it happened, the network address it came from, and the browser and kind of device. That's so a sign-in that wasn't yours stands out, and you'll find them on your Audit Trail, in every edition. The audit trail also keeps the network address beside each change to your records, because that's what the trail is for.
Outside services
Global Office: Sync uses outside services where they're necessary to provide a specific part of the product:
Connecting one service doesn't automatically connect the others. Information is sent only where it's needed to perform the feature you chose to use.
No system connected to the internet can honestly claim that nothing could ever happen to it.
What Global Office: Sync can do is reduce what's exposed, encrypt the most sensitive information, limit who can reach it, preserve the history behind every change and maintain tested backups if something goes wrong.
That's what has been built.