Security

Synapse is operated as a multi-tenant SaaS platform. This page summarizes our security posture for agency customers and technical evaluators. It is an engineering outline—not a certification or legal warranty. See Terms of Service and Privacy Policy for contractual terms.

Production traffic is served over HTTPS with TLS termination at the edge. Django debug mode is disabled in production. Session and CSRF cookies use secure flags when TLS is enabled.

Application databases (Postgres) and Redis are not exposed to the public internet. Internal services communicate on private networks.

Production API keys (Stripe, Linear, OpenAI, Django signing key, database credentials) are supplied via environment variables or a secret manager—not committed to git or stored in legacy JSON/YAML config files.

Linear OAuth tokens for organizations are encrypted at rest. Operators rotate provider keys per the production security runbook after exposure or personnel changes.

Authenticated app access uses organization-scoped roles (owner, admin, member). Billing, invitations, integrations, and audit logs enforce org boundaries.

Org-scoped admin APIs require owner or admin membership. Support and impersonation flows (when enabled) are gated and audited separately.

Organization audit logs record membership, billing, Linear connect/revoke, and automation actions (distill, summary, sync preview/apply). Entries are append-only at the ORM layer.

HTTP requests carry correlation IDs echoed to clients and propagated to background jobs for cross-service tracing.

Redis-backed burst limits protect login, registration, per-org distill automation, and outbound Linear GraphQL. Plan quotas (monthly distill limits) are enforced separately.

Per-org feature kill switches can disable distill, summary, or sync automation without a full outage.

Structured logs include correlation_id and org context where known—never raw OAuth tokens or payment card data. Sensitive fields (tokens, passwords, Authorization headers, provider secrets) are not written to logs.

Synapse integrates with subprocessors required to deliver the service, including Stripe (billing), Linear (issue sync), OpenAI (distillation when enabled), email delivery, and cloud hosting.

A detailed subprocessor list and DPA terms are maintained in the Privacy Policy and updated when vendors change.

Report suspected vulnerabilities or incidents to the security contact below. Do not disclose issues publicly before we have had a reasonable window to investigate.

We aim to acknowledge reports within two business days for production-impacting issues.