Encryption Vault

Credentials That Can't Be Leaked

Every credential you add to Synapse Flow AI — API keys, SMTP passwords, OAuth tokens, webhook secrets — is encrypted with AES-256-GCM before it touches the database. Each workspace gets its own isolated encryption key derived via HKDF, so a breach of one workspace mathematically cannot expose any other.

Why This Architecture Matters

Most marketing tools store integration credentials as plain text in a configuration table. Any engineer with database access — at the vendor, not just at your own company — can read them in a single SQL query. Encryption Vault was designed to make that impossible from day one.

The security model has three layers:

1. 1Encryption at creation — credentials are encrypted before transmission and never exist in plaintext on Synapse Flow AI servers
2. 2Per-workspace key isolation — each workspace uses a uniquely derived key; there is no master key that decrypts everything
3. 3Zero-read architecture — credentials are decrypted only in-memory at send time, for the duration of a single API call, then immediately discarded

Compliance Without the Overhead

SOC 2 Type II audits, HIPAA security reviews, and GDPR data protection assessments all ask the same question: where do your integration credentials live and who can read them? Encryption Vault makes the answer simple and auditable.

Without it, enterprise deals stall in security review. With it, InfoSec becomes an enabler of growth. Read our deep dive on credential security in marketing tools.

What Gets Vaulted

• AWS SES, SendGrid, and Postmark SMTP credentials
• OAuth tokens for CRM and analytics integrations
• Webhook signing secrets
• Custom HTTP API keys and authorization headers