Security and data
In short
- Directory records (numbers, job titles, departments, companies, photos) are never saved on RingSync's servers: they pass from your directory to the phones.
- RingSync keeps the email address and name of the people who hold a seat, which sign-in and billing need.
- Access to your directory is read-only.
- The database and application servers are hosted in Ireland.
- Directory credentials are encrypted in Supabase Vault.
- Remote purge has limits: it needs the app to run on the phone (see below).
What RingSync never saves
- Directory records: phone numbers, job titles, departments, companies. RingSync reads your directory at sync time, passes the response on to the phone and writes it nowhere.
- Photos: passed on to the phone when it asks, without being saved.
- People's personal contacts: the app never changes or deletes them, and sends no contact from the phone to RingSync.
- Hardware identifiers of the phones: the app uses a random installation identifier.
What RingSync keeps, and for how long
| Data | Why | Retention |
|---|---|---|
| Email, display name and directory identifier of each person with a seat | Recognize the person when they sign in to the app, count seats | While the seat exists, then 90 days after the person leaves the directory (with the seat and its history) |
| App account (email, name) | App session | Deleted once it has neither seat nor device, 90 days after creation at the earliest |
| Devices: platform, app version, notification token, random installation identifier | Per-phone status, remote purge | 90 days without activity |
| Sync history: dates, status, counts of additions, updates and removals | Dashboard, diagnosis | 12 months |
| Detailed log: directory identifier, action, reason | Logs page | 30 days |
| Identifiers of the people present on at least one phone | Computing "synced contacts" usage | While they are synced, then 30 days after removal |
| Directory settings (including the names of the chosen groups) | Configuration | Lifetime of the directory |
| Directory credentials: Entra client secret, Google refresh token, Service Account key | Reading the directory | Encrypted; deleted with the directory or the organization |
| Dashboard accounts, organization activity log | Administration, traceability | Deleted with the organization |
After a suspension (trial expired or unpaid invoice), the organization's data is kept for 30 days (trial) or 90 days (unpaid invoice), then permanently deleted.
Where data is hosted
- Database (Supabase): region
eu-west-1, in Ireland. - Application servers for the dashboard and the app's API (Vercel): region
dub1, in Dublin.
The other subprocessors (payment, email, notifications) are listed in the privacy policy and the DPA.
Access to your directory: read-only
- Microsoft Entra ID: three read application permissions,
User.Read.All,GroupMember.Read.AllandApplication.Read.All. See Graph permissions. - Google Workspace: three
readonlyAdmin SDK Directory scopes. See Google permissions.
None of them allows writing to the directory, or access to email, calendars or files. The phone never contacts Microsoft or Google: it always goes through RingSync, with its session.
Secrets and sessions
- Directory credentials: encrypted in Supabase Vault, never shown again in the dashboard. With Sign in to Microsoft, you provide no secret at all.
- App sign-in: Microsoft or Google only prove the person's identity (
openid profile email). RingSync then issues its own session, valid for 30 days and renewed with a 90-day token, stored in the phone's secure storage. Personal Microsoft accounts are refused, and a Google account's address must be verified by Google. - Traffic: over HTTPS.
- Support: RingSync support can view your dashboard read-only to help you. Any action it takes on your organization shows in Account → Activity as "RingSync (support)".
RingSync holds no certification at this time (SOC 2, ISO 27001 or other).
Remote purge and its limits
What triggers a purge:
- a seat is removed: assignment removed in Entra ID, or person taken out of the Google Authorized seats. RingSync detects it within 15 minutes;
- the directory is deleted (Settings → Danger zone → Delete the directory);
- a directory share is stopped.
How it works: RingSync marks the access as withdrawn and always sends a notification to each of the person's phones. The phone then removes only that directory's contacts and confirms the purge. You can follow it in Users → the person → Phones: Purge pending, Purge confirmed or Nothing to purge.
Limits to be aware of
- The notification is handled only when the app is in the foreground. Otherwise the purge happens the next time the app is opened or at the next sync, including an automatic one when the system allows it.
- A phone that no longer opens the app, and whose automatic sync does not run (sync turned off, background refresh disabled, phone switched off), keeps the contacts until then.
- A phone signed out of the app, or on which the app was uninstalled, no longer contacts RingSync: RingSync can no longer guarantee that the contacts are removed.
- A subscription suspension stops syncs without removing the contacts already there.
- Signing a person out of all their phones remotely (lost phone) is not available from the dashboard.
On the phone
- iPhone: RingSync writes contacts to the device's local container when iOS offers one. Otherwise iOS uses the default container, which is iCloud when iCloud Contacts is on. The directory is then copied into the person's iCloud account.
- Android: contacts are written to the device's local account. If the person turned on backup and sync of device contacts in Google Contacts, they can be copied into their personal Google account.
- These copies happen outside RingSync's control and yours. Factor them into your risk assessment.
- The app keeps, in its private storage, a mapping between directory identifiers and contact identifiers, along with the incremental sync cursor. These are identifiers, with no other personal data.
Sign-out, uninstall, deletion
- Sign out (app Settings): affects this phone only. Synced contacts stay. To remove them, first tap Remove synced contacts (section Data on this device): only the contacts RingSync wrote are deleted.
- Uninstalling the app does not delete the contacts: they live in the phone's address book, not in the app. If the app is reinstalled, it recognizes its contacts by the "RingSync" link on each card and does not create duplicates.
- Deleting the directory (dashboard): deletes its seats, syncs, settings and encrypted credentials. Phones purge its contacts, within the limits above.
Was this page useful?
Report what is missing →