Security and deployment
Synthesized runs in your environment, reads SAP with a read-only user and writes only to non-production systems. Nothing is installed in SAP, no data is sent to Synthesized, and your identity provider, keys and logs stay in charge.
At a glance
Architecture
Synthesized ships the runtime: a web UI, an API and a pool of workers. The database, identity, secrets and logs are yours.
Validation or one teamSingle serverDocker Compose or Podman on one Linux server: 8 vCPU, 32 GB RAM and 100 GB SSD, with your PostgreSQL 13+ database. RHEL with SELinux is supported.
Production and several teamsKubernetes or OpenShiftA Helm chart deploys the UI, API and workers; add workers for parallel runs. TLS at your ingress, optional mutual TLS inside.No internetAir-gappedImages and the chart arrive once through your registry mirror, the licence key is applied offline, and upgrades follow the same route.Also available through AWS Marketplace and Google Cloud Marketplace.
Connecting to SAP
RecommendedSAP OData servicesReads and writes through SAP's application layer with an SAP service user over HTTPS. No database access, so it works on RISE with SAP and wherever database access isn't allowed.AlternativeSAP HANA via JDBCA dedicated HANA user, read-only on the source schema and writing only to a non-production target, with TLS and certificate validation. For SAP HANA 2.0 and later that you run yourself.Both routes read full metadata and keep referential integrity across standard and custom Z-tables. Supported landscapes: S/4HANA and ECC, including RISE with SAP.
Controls
Sign-inIdentitySAML 2.0, OIDC, LDAP or Active Directory, or Kerberos, through your IdP. MFA and conditional access stay there; the platform never sees passwords.
Separation of dutiesRolesOwner, Admin and Member across the platform, plus Viewer, Editor and Admin per project, so auditors can look without changing anything.In transit and at restEncryptionTLS 1.2 or later in transit. Connection credentials are encrypted with your key, or fetched from HashiCorp Vault, AWS Secrets Manager or GCP Secret Manager.
EvidenceAuditEvery authenticated API call and every run: who, when and what changed. Written to your database and sent to your SIEM.Nothing keptData minimisationSource and transformed datasets aren't persisted in the platform, and no source values reach the logs.SAP accessLeast privilege on SAPRead-only on the source, write only to non-production, with separate technical users per environment.Assurance
AttestationSOC 2 Type 2Audit in progress, with the report expected in December 2026.Under NDASecurity assurance packTen documents, from access control and secure development to incident response and business continuity, shared under NDA.DisclosureReport a vulnerabilityWrite to security@synthesized.io. Confirmed issues are fixed to stated timelines, and you install the update.
We've got you covered
No. The platform runs inside your boundary and sends nothing to Synthesized. With the optional AI assistant off, it makes no outbound calls.
No. Masked output can't be decrypted or reversed to source values, and unmasked values never land in the target.
No. Support is remote by default and your team keeps the keyboard. Staff get access only if you choose to grant it.
Yes. Images and the Helm chart arrive once through your registry mirror, and upgrades follow the same offline route.
S/4HANA and ECC, including RISE with SAP, through OData. SAP HANA 2.0 and later can also connect directly through JDBC.
Next step
We send the architecture, data flows and controls, plus the assurance documents under NDA, so your review starts on day one.
SAP, S/4HANA, SAP HANA, SuccessFactors, Ariba, Concur and other SAP products and services mentioned herein, as well as their respective logos, are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies.
