Skip to main content

Data Sovereignty

The BYOK model is designed around a principle: your data is yours. This page covers the legal classification, security controls, compliance posture, and exit process for BYOK deployments.

Data Processing Classification​

The deployment model determines NearSync's legal relationship to your data:

BYOK Model​

NearSync acts as a software licensor. NearSync provides the application code. You host your own data. NearSync has no access to your data except the opt-in Sentinel metadata heartbeat. No Data Processing Agreement (DPA) is required for the NearSync-client relationship itself, though you may need your own DPA with Supabase for your database hosting.

Managed Model​

NearSync acts as a data processor under GDPR and relevant data protection laws. NearSync hosts and processes your data on your behalf. A DPA governs this relationship.

Data Residency​

With BYOK, you select your Supabase region during project creation. Your data resides exclusively in that region. Available regions span:

  • North America (US East, US West, Canada)
  • Europe (EU West, EU Central, UK)
  • Asia Pacific (Singapore, Sydney, Tokyo, Mumbai)
  • Middle East (Bahrain)

NearSync cannot move, replicate, or access your data across regions. The application code runs on Vercel's edge network, but all data operations go directly to your Supabase project in your chosen region.

Security Controls​

The NearSync application enforces security controls regardless of deployment model:

  1. Row-Level Security (RLS) - All all database tables have RLS policies enforced at the PostgreSQL level. Even with direct database access, data visibility is controlled by the authenticated user's context. See Row-Level Security.

  2. JWT Authentication - All API requests require a valid JWT. Edge Functions validate tokens before processing any request. See Authentication.

  3. CORS - Edge Functions only accept requests from configured origins (your deployed domains).

  4. Rate Limiting - Per-IP, per-endpoint rate limiting on all Edge Functions. See API Security.

  5. RBAC - Role-based access control with granular permissions per module and feature. See RBAC & Permissions.

  6. Audit Logging - All admin actions are logged to an audit table in your own database.

  7. MFA Support - TOTP-based multi-factor authentication available for all users.

  8. API Key Isolation - Third-party API keys (Google, Stripe, Twilio, etc.) are stored in your database and never transmitted to NearSync.

Sentinel Monitoring Scope​

The Sentinel v2 heartbeat is the only channel through which NearSync receives information from your deployment. It returns:

Data PointTypeContains PII?
Active user countNumberNo
Recent deal count (7 days)NumberNo
Pricing tierStringNo
Industry verticalStringNo
App versionStringNo
Heartbeat timestampTimestampNo

No names, emails, financial figures, message content, or document data is ever transmitted.

You can disable Sentinel at any time by removing the edge function from your Supabase project. The NearSync application continues to work normally without it.

Client Exit / Data Portability​

BYOK Clients​

BYOK clients already own everything. Your Supabase project, with all your data, remains fully under your control. You simply stop using the NearSync application. No data migration is needed because the data never left your infrastructure.

To fully disconnect:

  1. Remove the Sentinel heartbeat edge function (optional - it is inert without NearSync polling)
  2. Revoke any NearSync-created admin accounts in your Supabase Auth settings
  3. If using NearSync-managed Vercel: NearSync deletes the Vercel project. You can deploy your own frontend if desired.
  4. You retain: complete database, all files in Supabase Storage, all user accounts, all configuration

Managed Clients​

Managed clients can request a full data export in standard formats (CSV, JSON). NearSync provides this within 30 days of request per the service agreement. Alternatively, managed clients can upgrade to BYOK to take full ownership of their database.

Compliance​

  • The NearSync application code undergoes regular security audits
  • RLS policies are verified via an automated test suite (15-table isolation tests, 588+ total tests)
  • Supabase maintains SOC 2 Type II certification
  • BYOK clients inherit Supabase's compliance certifications for their own project
  • GDPR-ready: the system manifest includes compliance configuration with privacy URL, terms URL, DPA contact, and GDPR mode flags