SOC 2 Type 2
Independent audit of our security and availability controls. Reports available under NDA.
Trust center
Security And Compliance You Can Verify
Fuuz is SOC 2 Type 2 audited. This page summarizes how we protect your data and how we share responsibility for regulated work.
Compliance
Programs And Attestations
ITAR and CMMC
A shared responsibility model that defines which controls the platform provides and which the customer operates.
21 CFR Part 11 Roadmap
Working toward compliance, targeted for 2027.
Practices
How We Protect Your Data
Access control
Identity through OpenID Connect (OIDC), with as many identity providers as you need, MFA you can enforce for everyone or selected users, IP allowlists, and tenant-, field- and IP-level security with rules by user. Every authentication event is logged.
Encryption
AES-256 at rest and TLS 1.2 or higher in transit.
Audit trails
Changes logged with user, time and before and after values.
Secure edge
The Fuuz Gateway uses outbound connections only.
Testing
Quarterly vulnerability assessments and annual independent penetration testing.
Information security program
A written information security program, reviewed at least annually.
Read the WISPBackups
Backed Up Every Day, Kept For Weeks
Fuuz backs up all customer data on the Fuuz-hosted platform using AWS Backup, with a defined backup plan, a dedicated backup vault and continuous monitoring.
Daily backups
Daily snapshots, kept on a rolling one-week basis.
Weekly backups
Weekly snapshots, kept on a rolling eight-week basis.
Encrypted
Backups are encrypted at rest and in transit, and access to backup data is restricted by role.
Platform configuration
Fuuz service configuration is version controlled in our source repository, separate from customer data backups.
On Fuuz-hosted infrastructure, disaster recovery restores never have to be requested: our team knows about an issue before you do. If you need data restored from a backup, open a support ticket with Fuuz or ask your partner. Customers who host Fuuz in their own data center manage backups of that infrastructure.
Service levels and support
Support That Fits How You Deploy
Service levels depend on your deployment architecture and the support plan you choose. Fuuz-hosted environments are covered by the service level agreement in your contract; infrastructure and networks you host are covered by your own team or your partner.
Support plans
Standard support is included through the Fuuz support portal during business hours, Monday to Friday, Eastern time. Extended support plans are available from Fuuz or from Fuuz partners.
Open support.fuuz.comStatus and maintenance
Follow incidents, planned maintenance and releases on the Fuuz status page, and subscribe for updates. Planned maintenance runs in a published monthly window.
Open status pageService level agreement
Availability commitments, priority response targets and service credits are defined in your agreement. Ask our sales team about the options for your deployment and support plan.
Ask about service levelsService levels
Ask About Service Levels And Support Plans
Service levels depend on how you deploy and the support plan you choose. Tell us about your environment and our sales team will walk you through the options and share the full SLA.
Technical details
The Specifics Your Security Team Will Ask For
Encryption
- TLS 1.2+ in transit, TLS 1.3 supported; HTTPS enforced
- AES-256 at rest for databases, object storage and backups
Key management
- AWS Key Management Service (KMS)
- Customer-managed keys available on the Enterprise tier
Identity and provisioning
- Identity and provisioning through OpenID Connect (OIDC) only
- Any number of identity providers, configured for different use cases
- Password policy configurable per identity provider
- MFA enforceable for all users or for selected users
- IP allowlists and IP-level restrictions
Data isolation and residency
- Separate databases per enterprise
- Data residency by region, including US, EU and APAC
Retention and backup
- Retention configurable to your requirements
- Encrypted daily backups kept for 1 week and weekly backups kept for 8 weeks
Vulnerability management
- Quarterly vulnerability assessments
- Annual third-party penetration testing
- Automated security testing in the build pipeline
- Critical vulnerabilities patched within 24 to 48 hours
Security review
Need Documents For Your Review?
Request our SOC 2 Type 2 report, security questionnaire responses or shared responsibility details.
Prefer to talk? Call 1-877-801-FUUZ (3889)