Trust is the product
Synx Connect includes concrete controls for sensitive consultations: scoped access, expiring links, private storage, rate limits and auditable actions. Deployment and organizational compliance remain operator duties.
Role-based access control
Protected workflows apply role checks, active-membership checks and organization scoping; authorization regressions are covered by automated tests.
Expiring join links
Join links are random tokens; only their SHA-256 hash is stored. Links expire a few hours after the appointment ends, and rotate on every reschedule.
Encryption & secrets
Secure httpOnly session cookies (signed JWTs), hashed passwords (bcrypt), one-time tokens stored only as hashes — never in plaintext.
Signed file access
Files live in a private bucket. Upload and download happen only through short-lived signed URLs.
Audit & consent
Sensitive actions create application audit events. Consent records include their type, timestamp and request metadata.
Rate limiting
Authentication and join endpoints are rate-limited to resist brute force and abuse.