Security Isn’t a Claim. It’s Certified.Synology cloud services and global operations follow internationally recognized security and privacy frameworks to protect data confidentiality, integrity, and availability across regulated environments.Synology Inc.The latest certificate applies to Synology's corporate information security management systems (ISMS).
ISO 27001
C2 Colocation Data CentersThe current scope covers Europe, US and APAC colocation data centers used for C2 services.
ISO 27001 (all C2 data centers)
SOC 2 Type II (US data centers)
Regulatory & Legal SupportSupporting enterprise privacy, security, and global regulatory requirements.
GDPR DPA (all C2 data centers)
HIPAA BAA (US data centers)
CCPA (US data centers)
Compliance & Certification Request audit reports
Certification Details
  • ISO 27001
  • SOC 2 Type II
Regulatory Framework Support
  • GDPR (General Data Protection Regulation)
  • HIPAA BAA (Health Insurance Portability and Accountability Act - Business Associate Agreement)
  • CCPA (California Consumer Privacy Act)
ISO 27001 ISO 27001 SOC 2 Type II GDPR (General Data Protection Regulation) HIPAA BAA (Health Insurance Portability and Accountability Act - Business Associate Agreement) CCPA (California Consumer Privacy Act)
Certification Details
ISO 27001ISO 27001:2022 is the premier international standard for Information Security Management Systems (ISMS), providing a robust risk-management framework for the protection of organizational information assets.
Synology maintains formal ISO/IEC 27001:2022 certification for its corporate operations, validated through rigorous independent audits. This certification confirms that Synology has established and maintains a comprehensive information security management system (ISMS), designed to protect the confidentiality, integrity, and availability (CIA) of data.
For its cloud services, Synology works with third-party colocation data centers that maintain ISO 27001–certified facilities, ensuring that physical infrastructure and facility-level security controls are managed in accordance with internationally recognized information security standards.
By maintaining this globally recognized standard, Synology ensures that security governance is an ongoing, systematic process, providing clients with verified assurance that their information is managed under the highest security protocols.
SOC 2 Type IISOC 2 (System and Organization Controls) is a framework developed by the AICPA to evaluate a service organization’s internal controls based on the Trust Services Criteria of security, availability, processing integrity, confidentiality, and privacy.

Synology C2 data center located in the United States is maintained to these high standards, including rigorous physical security protocols, multi-factor access controls, and advanced network monitoring. By selecting U.S.-based colocation data centers that are certified under SOC 2 Type II, Synology supports a secure and well-controlled hosting environment for users requiring certified management of their information assets.
Regulatory Framework Support
GDPR (General Data Protection Regulation)Synology handles personal information with the highest international standards. Our data governance framework is designed to align with the GDPR principles, ensuring lawfulness, transparency, and accountability throughout the lifecycle of consent, collection, processing, and retention. To safeguard this information, we implement multilayered technical and organizational security measures that ensure users maintain full control over their personal data.
Beyond the protection of personal information, Synology upholds a fundamental commitment to user data sovereignty. Synology does not access, use, or process data stored by users on their hardware appliances or cloud. Our systems are designed to ensure that digital assets remain exclusively under user control, protected by an architecture that prioritizes absolute autonomy and ownership.
HIPAA BAA (Health Insurance Portability and Accountability Act - Business Associate Agreement)The Health Insurance Portability and Accountability Act (HIPAA) was introduced by the U.S. Congress in 1996 to set regulatory standards for the lawful use and disclosure of electronic protected health information (ePHI). Under HIPAA regulations, healthcare providers and businesses are expected to meet a set of requirements aimed at ensuring the privacy and security of any ePHI that is created, managed, received, or transmitted.
Synology hardware appliances and applicable cloud services provide the essential technical capabilities required to build a HIPAA-compliant environment. These include advanced access controls, data integrity protections, and comprehensive audit logging. While the responsibility for final regulatory compliance rests with the covered entity, Synology solutions serve as a robust foundation, allowing users to deploy and manage their infrastructure in alignment with stringent administrative, physical, and technical safeguards.
CCPA (California Consumer Privacy Act)Synology upholds the privacy rights defined by the California Consumer Privacy Act (CCPA) for all California residents. Synology operates on a model of absolute data transparency, ensuring that personal information is never used for unauthorized third-party purposes.

The governance framework is designed to provide consumers with clear visibility into the categories of personal information collected and the specific purposes for which it is used. To facilitate these protections, Synology implements robust technical and organizational measures that empower users to exercise their statutory rights, including the right to know, the right to delete, and the right to opt out, ensuring full authority over their digital identity.
Shared ResponsibilitySynology is committed to ensuring platform security, while users are responsible for access control, device configuration, and internal management-together creating a secure and resilient environment.Synology Responsibilities
  • Physical security of data centers and C2 cloud infrastructure.
  • Maintenance and patching of hardware, OS, firmware, and software packages.
  • Secure cryptographic modules for data at rest and in transit.
Customer Responsibilities
  • Implementation of access control and strong password policies.
  • Configuration of network security, firewalls, and VPNs.
  • Management of user data lifecycle and privacy requests.
Beyond Compliance: C2 Encryption KeySynology C2 adopts a no-view architecture to prevent unauthorized access and ensure customer data control. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256), with customer-managed keys not stored by Synology. As a result, Synology is unable to access or decrypt customer data.
Trust and GovernanceC2 Infrastructure White PaperThe white paper outlines the secure design, data protection, compliance, and resilience of Synology C2 infrastructure.Learn moreSynology C2 Terms of ServiceRead the terms and conditions that govern use of the Synology C2 platform and individual C2 services.Learn morePrivacy StatementSee how we handle and process users' personal information, including what data we collect and how long we retain it.Learn moreC2 White PapersExplore the technical foundations of Synology C2. Learn how our solutions prevent unauthorized access while ensuring you retain control over your sensitive data.
  • C2 OneStorage
    C2 Storage for Hyper Backup C2 Storage for Hybrid Share
  • C2 Identity
    Learn more
  • C2 Object Storage
    Learn more
  • C2 Backup for Business
    Learn more
  • C2 Backup for Surveillance
    Learn more
Evaluating C2 for your organization?Get our latest audit reports and certifications to support your compliance reviewsRequest audit reports
Frequently Asked QuestionsWhat third-party compliance requirements does Synology C2 meet?

Synology and its C2 colocation data center facilities across Europe, APAC, and the United States have obtained ISO 27001 certification, one of the most widely recognized international standards for information security management systems. In addition, the U.S. data centers are also SOC 2 Type II certified, demonstrating the implementation of stringent security controls and operational processes to ensure the protection of user data. Furthermore, Synology processes payment information in accordance with the PCI DSS standard and handles the processing and storage of billing data through a PCI Level 1 Service Provider.

Does Synology C2 offer Business Associate Agreements (BAA)?

Yes. BAAs are currently available for C2 Object Storage, C2 OneStorage, C2 Backup for Business, C2 Backup for Surveillance, C2 Identity and Active Insight. Requests can be filed through the above request audit reports link. A representative will contact you to confirm the details and supply a digital copy of the agreement for you to sign.

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) was introduced by US Congress in 1996 to set regulatory standards for the lawful use and disclosure of electronic protected health information (ePHI). Under HIPAA regulations, healthcare providers and businesses are expected to meet a set of requirements aimed at ensuring the privacy and security of any ePHI that is created, managed, received, or transmitted.

What are the HIPAA rules?

HIPAA legislation consists of five rules. Each rule lays out different requirements for HIPAA compliance:

  1. Privacy Rule: How, when, and under what circumstances ePHI can be used and disclosed
  2. Security Rule: Technical, physical, and administrative standards to safeguard the integrity of ePHI
  3. Omnibus Rule: Integration of HITECH’s provisions into HIPAA to strengthen protection of ePHI
  4. Breach Notification Rule: Terms and conditions for the notification of data breaches involving ePHI to interested parties and the public
  5. Enforcement Rule: Investigation and penalties applied following a data breach involving ePHI

Over the years, the requirements have been integrated and expanded in response to technological advancements in healthcare and other industries.

What is a no-view architecture?

A no-view architecture means a Cloud Service Provider (CSP) securely maintains encrypted data like ePHI on behalf of a client without ever having access to the decryption key. Under this framework, the backend processes state transitions independently of data visualization or content decryption, relying strictly on secure channels to handle data without "viewing" it.

Global - English