# Governance and Security

> SOC 2 Type 2, site access approved at the enterprise, one-step user offboarding, OIDC identity, field- and IP-level security and audit trails.

Source: https://www.fuuz.com/platform/governance

Governance and security


IT sets the guardrails. OT builds inside them. Fuuz gives enterprise IT one place to secure, monitor and govern every application, connection, user and agent.

[Visit the trust center](https://www.fuuz.com/trust/) [Talk to us](https://www.fuuz.com/contact)

Controls

## Security Built Into The Platform

### SOC 2 Type 2

Fuuz is SOC 2 Type 2 audited. Reports are available under NDA.

[Trust center →](https://www.fuuz.com/trust/)

### Identity your way

Identity through OpenID Connect (OIDC), with as many identity providers as your use cases need, a password policy for each, and multi-factor authentication you can enforce for everyone or for selected users.

### Every authentication logged

Every authentication event is logged with the user, each attempt and the location, so you always know who signed in, who tried and from where.

### Access at every level

Tenant-level, field-level and IP-level security, including IP allowlists, plus security rules by user, applied to every app and every API call.

### Audit trail

Changes are logged with the user, the time, and the before and after values.

### Encrypted, outbound-only

Data is encrypted in transit and at rest, and the Fuuz Gateway opens no inbound ports on your network.

Encryption standards, key management, provisioning, retention and testing details are in the [trust center](https://www.fuuz.com/trust/).

Multi-site access

## Site-Level Access, Governed At The Enterprise

Every plant gets its own access controls, built into the platform. Sites run their day-to-day, and the enterprise keeps the final say on who gets in.

When a site needs a new user, it requests access. An authorized enterprise administrator reviews and approves the request before the account is active, so access grows the way your organization intends.

- Access controls built in at the site level
- New users requested by the site, approved by an authorized enterprise admin
- Disable a user once, in one place, and their access is removed everywhere
How access flows

**1. Site requests** A plant asks for access for a new user.

**2. Enterprise approves** An authorized enterprise admin approves or declines.

**3. Site-level access** The user gets only what that site and role allow.

**4. One-place offboarding** Disable the user once, and their access ends everywhere.

Self-administered

## Governance That Works The Way You Do

### API keys

Create, scope and revoke your own API keys, without waiting on a vendor.

### Platform tenants

Administer your own tenants, including build, QA and production environments.

### Roles, policy groups and policies

Define the roles, policy groups and policies that match how your organization actually works.

Change governance

## One Governed Path To Production

Build

### Version

Every change is versioned, in your Git or in Fuuz's built-in version control.

Test

### Approve

Changes are tested and signed off before they move forward.

Release

### Package

A versioned package is installed, with a full audit trail.

Recover

### Roll back

If something is wrong, roll back to the previous release.

Compliance programs

## Shared Responsibility For Regulated Work

### ITAR and CMMC

Fuuz supports a shared responsibility model for customers working under ITAR and CMMC requirements. We define which controls the platform provides and which you operate.

### 21 CFR Part 11 Roadmap

Fuuz is working toward 21 CFR Part 11 compliance, targeted for 2027.

### Your standards

Customers configure the platform to support their own quality and industry programs, with audit trails and electronic records.

Compliance

## Compliance Built Into How You Operate

Fuuz helps manufacturers meet customer and industry requirements with traceability, audit trails and enforced process, captured as the work happens.

### Traceability

Forward and backward genealogy across production and quality.

### Audit trails

Changes logged with who, when, and before and after values.

### Enforced process

Checks, sign-offs and holds built into the workflow.

### Shared responsibility

A shared responsibility model for ITAR and CMMC work.

[Learn more →](https://www.fuuz.com/platform/governance)

### Part 11 roadmap Roadmap

Working toward 21 CFR Part 11 compliance, targeted for 2027.

Modernize on your terms. Every system you retire is one less integration to maintain.

Get started

## Give IT The Guardrails. Give OT The Speed.

Tell us what you run today and what you need next. We will map how Fuuz fits, without ripping anything out.

[Start the conversation](https://www.fuuz.com/contact)

Prefer to talk? Call [1-877-801-FUUZ (3889)](tel:18778013889)