Identity & access for
humans and AI agents
The platform
One IAM control plane, every identity
Standards-native authentication and authorization for your workforce, your customers, and the machines in between — multi-tenant to the row.
OpenID Provider
A certified-shape OIDC issuer: /authorize, /token, JWKS, discovery. Point any OIDC library at the issuer — integration in minutes, not a project.
Workforce & customer IAM
Federation (SAML/OIDC), SCIM provisioning, passkeys, MFA, and fine-grained RBAC — one surface for employees and end-users alike.
Multi-tenant by construction
Postgres row-level security and a scoped repository layer make the tenant boundary a database property, not a hand-scoped query you have to trust.
AI-agent-native
Identity that governs autonomous agents
Agents are first-class principals — issued identities, delegated authority, and enforced at the moment they act, not just when they're configured.
Agent identities & delegation
Every agent gets a cryptographic identity and tighten-never-weaken delegation from the human it acts for — with a separately-permissioned kill switch.
MCP per-call authorization
A fail-closed gateway sits in front of an agent's MCP tool calls: allowlist, delegation scope, rate/budget caps, and a human-in-the-loop approval path.
Standards-aligned
OAuth 2.1, token exchange (RFC 8693), and DPoP-bound tokens — the ecosystem's language, wired to real enforcement instead of a proprietary interface.
Security embedded
Hardened by default, evidenced for buyers
The controls regulated buyers ask about on first contact are built in — and the supply chain that produces the platform is signed end to end.
Fail-closed everywhere
Missing key, unreachable dependency, ambiguous auth — the platform denies rather than degrading. Argon2id hashing, RS256 + JWKS, strict CORS.
Continuous compliance
Every action emits telemetry, carries a detection decision, an audit decision, and maps to a compliance control — so evidence is produced by construction.
Signed, digest-pinned supply chain
Cosign-signed images, egress network control, database least-privilege, and defense-in-depth against malicious code (ADR-0002/0019/0020/0021).
Two ways to run it
One codebase. Managed or self-hosted.
The same platform and the same standards surface, delivered the way your organization needs. Move between them without re-integrating.
FAQ
Frequently asked questions
- Is Zynth Auth an OpenID Provider?
- Yes. Zynth Auth is an OpenID Provider (OIDC): it exposes discovery, authorization, token, and JWKS endpoints, so you point your existing OIDC library at the issuer instead of writing custom verification code.
- Can I self-host Zynth Auth?
- Yes. The same codebase runs as a managed cloud service or self-hosted on your own infrastructure via Docker Compose, with cosign-verified, digest-pinned images. Your tier is a configuration and entitlement, not a different product.
- How does Zynth Auth handle AI agents?
- Agents are first-class identities with tighten-never-weaken delegation from the human they act for, a fail-closed MCP per-call authorization gateway, human-in-the-loop approvals for sensitive actions, and a separately-permissioned kill switch.
- How are tenants isolated?
- Multi-tenancy is enforced at the database with Postgres row-level security and a scoped repository layer, so the tenant boundary is a database property rather than a query you have to trust.
- Which compliance frameworks does it support?
- Controls are mapped to SOC 2, ISO 27001, GDPR, Singapore PDPA, Philippines DPA, and HIPAA, with audit evidence produced by construction. AI-governance frameworks (EU AI Act, ISO 42001, OWASP Agentic Top 10) are registered. See the Trust Centre for details.
- Where is data hosted?
- The managed offering is hosted in Singapore (APAC region) for data residency and sovereignty. Self-hosted deployments keep all data within your own infrastructure.