Security
How keys, data, and access are protected.
- Keys are stored hashed. Synqed keeps only a SHA-256 hash of each secret; the plaintext is shown once at creation. Lost keys can't be recovered — rotate them.
- Least privilege by default. Every key carries explicit permissions and data access. Denied calls are logged to the workspace security log (Settings → Security).
- Audited writes. Every write through the API is attributed to the key's principal (
key_<id>) in the workspace audit trail. - Encryption. Data is encrypted in transit (TLS 1.2+) and at rest; free-text fields are additionally encrypted with a per-workspace key wrapped by Cloud KMS. Search indexes store hashed terms, not plaintext vocabulary.
- Tenant isolation. A key is bound to one workspace and one region. No endpoint can read across workspaces.
- Fast revocation. Revoking a key, disconnecting its agent, or removing the member who created it cuts access within 30 seconds.
Found a vulnerability? Email contact@synqed.dev.