Security
What protects your workspace.
SynapseOrch runs the steps you approved, with credentials you stored, over data you gave it. That deserves a plain description rather than a wall of badges: what’s in place on Cloud, what happens to your data, and what changes when you run it yourself.
In place
Six things that protect it today.
- Workspaces kept apart
- Every workspace is separated in the database with row-level security, so one customer’s query can’t reach another’s rows. The database enforces it, not application code remembering to filter.
- Secrets encrypted one by one
- Connection secrets and API keys are each encrypted with managed keys, and decrypted only to make the call you asked for. A copy of the database on its own doesn’t give up your credentials.
- Code runs in a sandbox
- Python tools run apart from the engine. On Cloud, each runs in an AWS Lambda environment that has never served another workspace.
- Limits on what code can reach
- On Cloud, a Python tool has no network at all until your workspace lists domains for it, and even then it reaches only the public internet, never our network or another workspace. Every web fetch refuses private addresses and the cloud’s own metadata service.
- Encrypted on the way and at rest
- TLS on every connection from the internet, encryption at rest for stored data, and file storage separated per workspace.
- A record of who did what
- Significant actions are recorded, such as who invited whom, who changed a setting and who deleted what, so an admin can see what happened. On Business, owners and admins export it as CSV or JSON.
Your data
The four questions people ask first.
- Is my data used to train models?
- No, not by us. Our models run on Amazon Bedrock, whose terms prohibit training on your prompts or outputs. With your own key, that provider’s terms apply.
- Where does it live?
- SynapseOrch Cloud runs in AWS us-east-1, in the United States. A self-hosted install keeps everything in your own infrastructure.
- Who can read my workspace?
- The members you invite. We don’t read workspace content except when you ask us to look at something specific in support, or where the law compels us.
- What happens when I leave?
- An owner deletes it in Settings → Data. It locks at once: nobody can sign in, and its runs, schedules, chat channels, widgets and API keys stop. Its workflows, agents, files, knowledge and logs are deleted for good 30 days later, or when a paid period ends if that’s later, and until then support can restore it. Take a copy first from Import / Export. Billing records are kept as long as tax rules require; those are usage totals, not your content.
Who processes what, and where, is in the privacy policy. Anything your own workflows call, such as your model provider, your APIs or an MCP server you connected, is governed by that provider’s terms, not ours.
Disclosure
Found something? Tell us.
Report a vulnerability to info@synapseorch.com, or privately through GitHub Security Advisories on the repository. Please give us a reasonable window to fix it before you disclose it publicly.
We publish advisories for security issues in the open-source project rather than quietly patching them, and a release that fixes one says so in its notes.
Security advisories on GitHubSelf-hosting
What changes when you run it yourself
Everything above describes SynapseOrch Cloud. When you self-host, none of it is ours to provide: your data never reaches us, we collect no telemetry, and there is no license check. In exchange, isolation, encryption, patching and backups are yours to set up. The engine gives you the tools; how you run it is your decision.
A question this page doesn’t answer?
Write to us before you sign up. We answer security questions plainly, including the ones whose answer is “not yet”.
Free plan, no card needed.