Who this is for
IT and network administrators who need to allow SynapBridge through a firewall, proxy or browser policy before rolling it out.
Before you start
- SynapBridge is a web application. You open it in a browser at app.synapbridge.com. There is no client to install for the web app.
- This page lists only what can be confirmed from the product's own configuration. Where something could not be confirmed, it says so. For anything marked as unconfirmed, check with SynapBridge support before you depend on it.
- Have your proxy or firewall rules open so you can add the hosts below.
Browsers
- SynapBridge does not publish a supported-browser list, a minimum browser version or a browser support policy in its product configuration. This document cannot give you one.
- The automated browser tests run against desktop Chromium (the engine behind Chrome and Edge). Other browsers are not named in the test setup.
- Sign in with a passkey needs a browser that supports WebAuthn. The sign-in and passkey settings pages check for this and will not offer passkeys when the browser lacks it.
- JavaScript must be enabled. The app is built with Next.js and React.
- Cookies must be allowed for app.synapbridge.com. Sign-in sessions use cookies with the __Host- prefix, which browsers accept only over HTTPS. The session cookies are HttpOnly and Secure.
Screen size
The layout includes narrower-screen rules, but no minimum screen size or supported device list is published. Open the product on your target devices to check them, and do not assume a native mobile app: none is documented here.
Network access
The browser connects to the hosts below over HTTPS. All of them except api.workos.com are listed in the product's Content Security Policy, which controls what the browser may load and call. api.workos.com is reached by a browser redirect, not by a call from the page.
SynapBridge
- app.synapbridge.com: the application.
Sign-in and identity
- cognito-idp.us-east-1.amazonaws.com: email and password sign-in and MFA with Amazon Cognito. The sign-in page connects to it from the browser.
- api.workos.com: used when you sign in with Google, Microsoft or single sign-on through WorkOS. Your browser is redirected there (it is not in the Content Security Policy list), and then on to the identity provider you chose. The domains of that provider (for example your company's SSO provider) depend on your setup and are not listed here.
Payments
- js.stripe.com: Stripe script and payment form frame.
- hooks.stripe.com: Stripe card authentication frame.
- api.stripe.com and q.stripe.com: Stripe API calls and telemetry from the browser.
- Images from *.stripe.com (card brand logos).
The sign-up payment step loads Stripe. Check the billing screens in the product for further Stripe use.
Captcha
- js.hcaptcha.com, newassets.hcaptcha.com and api.hcaptcha.com: hCaptcha on the sign-up account step. It appears only when the deployment has a captcha site key configured.
Fonts
- fonts.googleapis.com and fonts.gstatic.com: the app loads IBM Plex Sans and IBM Plex Mono from Google Fonts. The sign-in pages use fonts bundled with the app instead. What the app looks like with these hosts blocked has not been verified.
File uploads and images
- *.s3.us-east-1.amazonaws.com: direct uploads (for example chat attachments) and some images load from Amazon S3 in the us-east-1 region.
Other
- When an operator configures a vendor status page, the status page can embed it in a frame. That host depends on the deployment.
- Wildcards matter. If your proxy cannot allow *.s3.us-east-1.amazonaws.com or *.stripe.com, ask your SynapBridge contact which exact names your workspace uses.
Region
The Amazon Cognito and Amazon S3 hosts above name the us-east-1 region. The product configuration does not show a way to pick a different region for the web app. The pricing page lists custom data residency under Enterprise, so ask SynapBridge support what applies to your workspace. A workspace entry in the sidebar switcher does not set a region.
Limits and notes
- This list reflects the product configuration at the time of writing. Hosts can change with releases, so re-check it when you plan a change to your network rules.
- The minimum TLS version for the application hosts could not be confirmed from the product code. Do not rely on a specific minimum from this document.
- No accessibility conformance statement was found in the product. Contact SynapBridge support for current accessibility information.
- Single sign-on, SCIM and your own SIEM or API endpoints need extra network rules that depend on your setup. Those are not listed here.
- Not confirmed: supported operating systems, minimum browser versions, bandwidth targets and mobile browser support.