--- title: "Data and security" description: "How a Pyn workspace and its data are protected: sign-in options and SSO, 24-hour sessions and cross-site request protection, roles, owner-only exports, audit log streaming, integration scopes, and what employees are shown." sidebar: order: 2 area: concepts feature: security lastVerified: 2026-10-22 version: "2026-10-16" audience: admin related: - integrations/sso - getting-started/roles-and-permissions - for-employees/privacy-and-your-data - integrations/slack intercom: - id: "16838066" title: Enabling Single Sign On (Pyn 2) url: https://intercom.help/pyn/en/articles/16838066-enabling-single-sign-on-pyn-2 note: draws on --- A workspace holds your employee records and the messages you send them. The controls below are what Pyn enforces today; each links to the page where you configure it or see it in action. ## Signing in A user signs in with Google, Microsoft, a magic link sent to their email, BambooHR, or single sign-on. Pyn never creates a user from a sign-in alone: the address must have been invited to the workspace, or SSO group mapping must cover it. Archiving a user ends their access at once, including any session they had open. See [Sign in](https://support.pynhq.com/account/sign-in/) and [Users](https://support.pynhq.com/settings/users/). **Single sign-on** connects Okta or any OpenID Connect provider. Provider groups map to Pyn roles, and on every sign-in the person receives the highest role of any group they are in, so leaving a group in the provider removes the role in Pyn. See [SSO](https://support.pynhq.com/integrations/sso/). ## Sessions and requests - A session lasts 24 hours from sign-in, whether or not the person keeps using Pyn or switches workspaces; then they sign in again. - Pyn refuses browser requests that try to change data when the request is identified as coming from another website, so a page elsewhere cannot act with your signed-in session. - Magic links, auth links, reader links and respond links are single-purpose tokens: an auth link lasts three days and is used once; a reader or respond link identifies one delivery and does nothing else. ## Roles Owner, Admin, Power User and User nest, and the server checks the role on every action, not only the navigation. Stopping an enrollment, changing settings, inviting users and reading the Directory need Admin; only an Owner can make or change an Owner. See [Roles and permissions](https://support.pynhq.com/getting-started/roles-and-permissions/). ## Exports and downloads A CSV export of enrollments, flows, actions or deliveries is generated for the person who asked for it, and only they can download it; older exports without a recorded owner have to be requested again. Downloads arrive as notices and expire. See [Download an export](https://support.pynhq.com/notices/download-an-export/). ## Integrations and scopes Each integration asks for the least it needs and says so on its page: the Slack bot can message people and post where it is invited but cannot read channels or join them; HRIS connections read employee fields with a service credential you control; email sends through your own Google Workspace or Microsoft 365 mailbox or a domain you authenticate with DNS. A credential that stops working moves the integration to **Needs Attention** and raises a notice rather than failing quietly. See [Integrations](https://support.pynhq.com/integrations/) and [Needs Attention](https://support.pynhq.com/integrations/needs-attention/). ## Audit streaming Workspaces that need an external audit trail can connect Splunk Cloud: an Admin provides an HTTP Event Collector endpoint, index, source and source type, and Pyn streams its audit log there. Ask Pyn support to enable the integration for your workspace. ## Pausing An Admin can pause the workspace, which stops every send, flow and refresh until it is resumed. Pyn can also pause a workspace. See [Pause your workspace](https://support.pynhq.com/settings/account/pause-your-workspace/). ## What employees see An employee needs no Pyn account. They receive messages in their inbox, Slack or Teams from the sender you chose, and the only pages they open are the reader and respond pages, which carry a code for one delivery and no sign-in. Pyn records that a message was delivered, that a link was opened and that a tracked button or form was used; it does not record email opens. Form answers are stored against the employee for your team to read. See [Privacy and your data](https://support.pynhq.com/for-employees/privacy-and-your-data/) for the version written for them. ## Pyn staff A user whose email ends in `@pynhq.com` or `@pyn.ai` appears in **Current Users** with a **Support** chip. Pyn staff can also view a workspace with an internal tool; while they do, the app shows a striped warning along the navigation. ## Related - [SSO](https://support.pynhq.com/integrations/sso/) for Okta and OpenID Connect set-up and group-to-role mapping. - [Roles and permissions](https://support.pynhq.com/getting-started/roles-and-permissions/) for every action and the role it needs. - [Privacy and your data](https://support.pynhq.com/for-employees/privacy-and-your-data/) for what employees are told. - [Slack](https://support.pynhq.com/integrations/slack/) for the exact bot scopes. ## Related Intercom articles - [Enabling Single Sign On (Pyn 2)](https://intercom.help/pyn/en/articles/16838066-enabling-single-sign-on-pyn-2) — draws on