# Trust Center

> Fuuz is SOC 2 Type 2 audited. See our security practices, shared responsibility model for ITAR and CMMC, and request security documents for your review.

Source: https://www.fuuz.com/trust/

Trust center


Fuuz is SOC 2 Type 2 audited. This page summarizes how we protect your data and how we share responsibility for regulated work.

[Request security documents](https://www.fuuz.com/contact) [Governance and security](https://www.fuuz.com/platform/governance)

Compliance

## Programs And Attestations

### SOC 2 Type 2

Independent audit of our security and availability controls. Reports available under NDA.

### ITAR and CMMC

A shared responsibility model that defines which controls the platform provides and which the customer operates.

### 21 CFR Part 11 Roadmap

Working toward compliance, targeted for 2027.

Practices

## How We Protect Your Data

### Access control

Identity through OpenID Connect (OIDC), with as many identity providers as you need, MFA you can enforce for everyone or selected users, IP allowlists, and tenant-, field- and IP-level security with rules by user. Every authentication event is logged.

### Encryption

AES-256 at rest and TLS 1.2 or higher in transit.

### Audit trails

Changes logged with user, time and before and after values.

### Secure edge

The Fuuz Gateway uses outbound connections only.

### Testing

Quarterly vulnerability assessments and annual independent penetration testing.

### Information security program

A written information security program, reviewed at least annually.

[Read the WISP →](https://www.fuuz.com/trust/wisp)

Backups

## Backed Up Every Day, Kept For Weeks

Fuuz backs up all customer data on the Fuuz-hosted platform using AWS Backup, with a defined backup plan, a dedicated backup vault and continuous monitoring.

### Daily backups

Daily snapshots, kept on a rolling one-week basis.

### Weekly backups

Weekly snapshots, kept on a rolling eight-week basis.

### Encrypted

Backups are encrypted at rest and in transit, and access to backup data is restricted by role.

### Platform configuration

Fuuz service configuration is version controlled in our source repository, separate from customer data backups.

On Fuuz-hosted infrastructure, disaster recovery restores never have to be requested: our team knows about an issue before you do. If you need data restored from a backup, open a support ticket with Fuuz or ask your partner. Customers who host Fuuz in their own data center manage backups of that infrastructure.

Service levels and support

## Support That Fits How You Deploy

Service levels depend on your deployment architecture and the support plan you choose. Fuuz-hosted environments are covered by the service level agreement in your contract; infrastructure and networks you host are covered by your own team or your partner.

### Support plans

Standard support is included through the Fuuz support portal during business hours, Monday to Friday, Eastern time. Extended support plans are available from Fuuz or from Fuuz partners.

[Open support.fuuz.com →](https://support.fuuz.com/)

### Status and maintenance

Follow incidents, planned maintenance and releases on the Fuuz status page, and subscribe for updates. Planned maintenance runs in a published monthly window.

[Open status page →](https://status.fuuz.app/)

### Service level agreement

Availability commitments, priority response targets and service credits are defined in your agreement. Ask our sales team about the options for your deployment and support plan.

[Ask about service levels →](#sla-inquiry)

Service levels

## Ask About Service Levels And Support Plans

Service levels depend on how you deploy and the support plan you choose. Tell us about your environment and our sales team will walk you through the options and share the full SLA.

Technical details

## The Specifics Your Security Team Will Ask For

### Encryption

- TLS 1.2+ in transit, TLS 1.3 supported; HTTPS enforced
- AES-256 at rest for databases, object storage and backups

### Key management

- AWS Key Management Service (KMS)
- Customer-managed keys available on the Enterprise tier

### Identity and provisioning

- Identity and provisioning through OpenID Connect (OIDC) only
- Any number of identity providers, configured for different use cases
- Password policy configurable per identity provider
- MFA enforceable for all users or for selected users
- IP allowlists and IP-level restrictions

### Data isolation and residency

- Separate databases per enterprise
- Data residency by region, including US, EU and APAC

### Retention and backup

- Retention configurable to your requirements
- Encrypted daily backups kept for 1 week and weekly backups kept for 8 weeks

### Vulnerability management

- Quarterly vulnerability assessments
- Annual third-party penetration testing
- Automated security testing in the build pipeline
- Critical vulnerabilities patched within 24 to 48 hours
Security review

## Need Documents For Your Review?

Request our SOC 2 Type 2 report, security questionnaire responses or shared responsibility details.

[Request documents](https://www.fuuz.com/contact)

Prefer to talk? Call [1-877-801-FUUZ (3889)](tel:18778013889)