Security

This page covers workspace security: two-factor authentication, single sign-on with allowed email domains, and webhook signature validation. Use these controls to limit who can join your workspace, how they authenticate, and whether incoming webhook traffic is genuine.

For compliance documents, subprocessors, and security controls, visit the Trust Vault. Some documents are private and require Login/Get Access on the vault.

Certifications

Synthflow maintains independently verified security controls across the platform. To request certification documents, review subprocessors, or view control details, visit the Trust Vault.

Synthflow is compliant with:

• ISO 27001:2022
• SOC 2
• GDPR
• HIPAA
• PCI DSS V4.0.1

For HIPAA customers, see the Business Associate Agreement. SSO and additional enterprise security features are available on the Enterprise plan.

Two-factor authentication

Two-factor authentication (2FA) adds a second verification step at sign-in using a Time-based One-Time Password (TOTP) from an authenticator app such as Google Authenticator, Authy, or Microsoft Authenticator. When your workspace requires 2FA, you must enable it to create and view API keys.

Enable 2FA in Settings > Log in credentials:

After 2FA is enabled, you are prompted for a code each time you sign in. Backup codes are generated once during setup, can only be used once, and should be stored in a password manager or secure note.

In Settings > Security, workspace admins can require 2FA for all team members. Users who have not enabled 2FA must set it up at their next sign-in.

Single sign-on

SSO lets your team sign in through your identity provider instead of separate Synthflow credentials. Only Super Admins and Admins can configure SSO. See roles for details. Synthflow uses WorkOS as the SSO infrastructure provider.

Allowed email domains

Restrict which email domains can receive workspace invitations. When one or more domains are configured, only matching addresses can be invited. If no domains are configured, invitations are open to all domains. The restriction applies to invite creation only; existing users are unaffected.

Super Admins and Admins manage allowed domains under Settings > Security > Whitelist Domains. Members cannot manage domains or invite users.

Enable SSO

Navigate to Settings > Security and provide:

• Organization name (defaults to your workspace name)
• At least one domain from your whitelist policy

After you submit the form, Synthflow creates an organization in WorkOS and redirects you to the identity provider connection list. You can return later to finish provider setup. Until the connection is completed, SSO remains pending and inactive.

Supported providers include Okta, Entra ID, Google SAML, Auth0, and others shown in the setup flow. Each provider has different setup requirements, so follow the in-app instructions for your identity provider.

Workspace admins can disable SSO when needed. Disabling SSO blocks sign-in through your identity provider but does not remove the WorkOS organization or external provider connection.

Webhook security

Synthflow signs every webhook with an HMAC-SHA256 signature using your shared secret key. The signature is sent in the HTTP_SYNTHFLOW_SIGNATURE header so your server can confirm the request came from Synthflow and was not altered in transit. HTTPS alone does not prove the sender is Synthflow; without signature validation, anyone who discovers your webhook URL could send forged payloads.

Generate a secret key under Settings > Security > Webhooks. Synthflow signs the call_id with that key and includes the base64-encoded result on both the inbound webhook and the post-call webhook.

Verify the signature on your server using the same secret key and the received call_id:

1
import hmac
2
import hashlib
3
import base64
4
5
def generate_hmac_signature(secret_key: str, payload: str) -> str:
6
    signature = hmac.new(secret_key.encode(), payload.encode(), hashlib.sha256).digest()
7
    return base64.b64encode(signature).decode()
8
9
def verify_hmac_signature(secret_key: str, payload: str, received_signature: str) -> bool:
10
    expected_signature = generate_hmac_signature(secret_key, payload)
11
    return hmac.compare_digest(expected_signature, received_signature)
12
13
call_id = "123456789"
14
secret_key = "your-secret-key"
15
signature = "abc123"
16
is_signature_valid = verify_hmac_signature(secret_key, call_id, signature)
17
print(is_signature_valid)

If verification returns True, the webhook originated from Synthflow and the payload was not modified in transit. Use constant-time comparison (as shown above) to avoid timing attacks.

FAQ