Security & privacy

2sync is built with privacy and security at its core. We process your data transiently, store only what's necessary, and give you full control over access.

How does 2sync process data?

Transient architecture

2sync doesn't store your calendar events, emails, tasks, or contacts. Data flows through our servers in memory and is discarded after each sync cycle:

1. Fetch data from source (e.g., Google Calendar)
2. Compare with destination (e.g., Notion)
3. Apply necessary changes
4. Discard all content from memory

Your data is never written to disk or retained after processing.

What we store

We retain only the minimum metadata required to maintain your sync connections.

How does authentication work?

OAuth 2.0

2sync uses OAuth 2.0 for all service connections. We never see or store your passwords.

How it works:

1. You authorize 2sync through the service's login page
2. The service issues a limited-access token
3. 2sync uses this token for sync operations
4. You can revoke access anytime from your account settings

Permission scopes

We request only the permissions necessary for sync:

Each service is authorized separately. Connecting Google Calendar doesn't grant access to Gmail. See How sync works for more on how 2sync connects to your services.

Where is 2sync infrastructure hosted?

Server location

All 2sync infrastructure is hosted in Germany (EU) by Hetzner, an ISO 27001 certified data center provider.

Encryption

All communication between your browser, our servers, and connected services is encrypted.

What compliance standards does 2sync meet?

GDPR rights

As a user in the EU, you have the right to:

• Access your data
• Export your data
• Delete your account and all associated data
• Revoke consent at any time

Contact help@2sync.com to exercise these rights.

How do I revoke access?

You can disconnect 2sync at any time:

From 2sync:

1. Go to your 2sync dashboard
2. Delete the automation or disconnect the service

From the service:

• Google: myaccount.google.com/permissions
• Notion: Settings → Connections → Remove 2sync
• Todoist: Settings → Integrations → Revoke access
• Microsoft: account.microsoft.com/privacy

Revoking access immediately terminates 2sync's ability to read or write your data.

What security best practices should I follow?

1. Review permissions regularly: Check which apps have access in your Google/Notion security settings.
2. Enable 2FA: Use two-factor authentication on all connected accounts.
3. Revoke unused connections: Remove access for services you no longer use.
4. Monitor sync status: Map the Sync Status field to track automation health.

Related

• How sync works for understanding the sync architecture
• Safety limits for safeguards that protect your data
• Error codes for troubleshooting authentication and permission errors
• Rate limits and retries for how 2sync handles API rate limits
• Glossary for definitions of security and sync terminology

FAQ