Skip to content

Security

Security

Synapse is built with security at every layer. API key scoping, role-based access control, and database-level tenant isolation protect your data.

Two authentication layers

API key auth

For server-to-server integrations and event ingestion.

  • Format: psk_{env}_{hex32}
  • Bcrypt-hashed, prefix-indexed for fast lookup
  • 4 scopes: data, reporting, management, full
  • Environment-specific: test or live

JWT auth (dashboard)

For dashboard users, issued by pyrx.auth.

  • RS256 signed, verified via JWKS endpoint
  • JWKS cached 6 hours (stale cache on fetch failure)
  • Enriched with RBAC permissions from tenant_members
  • Multi-workspace support via org switcher

Role-based access control (6 roles)

Synapse owns authorization. pyrx.auth handles identity only. Every dashboard request resolves the user's role and permission set before executing.

RoleAccess
OwnerAll permissions + billing, workspace deletion, ownership transfer. One per workspace (DB-enforced).
AdminAll CRM permissions + user management. No billing access.
DeveloperFlows, templates, segments, contacts, logs, dev tools.
MarketingFlows, templates, segments, analytics.
OperationsContacts (read), email logs, analytics.
ViewerAnalytics read-only.

Multi-tenant data isolation

Every business table includes a tenant_id column. PostgreSQL Row-Level Security (RLS) policies enforce isolation at the database level, ensuring one workspace can never access another's data — even in the event of an application bug.

  • •RLS policy on every business table: USING (tenant_id = current_setting('app.current_tenant_id')::uuid)
  • •Tenant context set per-request via middleware (SET LOCAL app.current_tenant_id)
  • •Defense-in-depth: application queries always include WHERE tenant_id = :tid in addition to RLS
  • •Tenant-scoped unique constraints prevent cross-tenant collisions (e.g., external_id uniqueness is per-workspace)

Environment isolation

Test and live environments within a workspace are fully isolated. Test API keys (psk_test_) can only read and write test data. Live keys (psk_live_) can only access live data. This isolation extends to contacts, events, flows, email logs, and all other tenant-scoped resources.

Deep dives

API Key Management

Key lifecycle, rotation strategies, revoking compromised keys, and environment-specific keys.

Role-Based Access Control

Six roles with granular permissions. Full permission matrix for owner, admin, developer, marketing, operations, and viewer.

Data Isolation

Multi-tenant architecture with PostgreSQL Row-Level Security, tenant_id scoping, and workspace isolation.