8. Regulatory & Compliance
Syncora is built to handle some of the most sensitive data on earth: medical records, financial transactions, and enterprise behavioral logs. From day one, we designed the system with compliance at its core.
8.1 GDPR (Europe)
Data minimization: Raw records are never shared; only synthetic copies leave the system.
Right to erasure: Contributors can request deletion of accounts and metadata at any time.
Lawful basis: Explicit consent from contributors when uploading data.
Cross-border safeguards: Synthetic datasets are non-identifiable, which exempts them from many GDPR transfer restrictions.
8.2 HIPAA (U.S. Healthcare)
Business Associate role: Syncora functions as a Business Associate when handling Protected Health Information.
Deletion of PHI: All raw PHI is deleted post-synthesis.
Synthetic dataset safety: Synthetic datasets contain no identifiers and cannot be traced back to individuals.
Auditability: Logging and deletion proofs are anchored on-chain to meet audit requirements.
8.3 SOC2 & Enterprise Standards
Certification goal: Targeting SOC2 Type II by Q1 2026.
Encryption: In transit and at rest.
Audit trails: Automated for all dataset lifecycle events.
Access control: No human access to raw data at any stage.
8.4 Token Compliance
Utility-first design: Token is used for licensing, royalties, staking.
Regulatory alignment: U.S. and EU legal counsel engaged to align with digital asset frameworks.
Royalties, not securities: Contributor payments are structured as royalties for synthetic dataset licenses, not as “profit-sharing.”
Syncora is not trying to “work around” regulations, it is designed to work with them. Compliance is a moat, not a burden.
Last updated