Skip to main content
This page states what FTS actually does, including the things it does not do. Data in transit is encrypted with TLS; data at rest sits on the encrypted storage of our providers. FTS holds no encryption key of its own, offers no SAML single sign-on, and holds no security certification of its own; each of those is spelled out in its own section below, together with what our providers do hold.

​
Authentication

​
Two-factor authentication (2FA)

All plans support 2FA for added account security. To enable 2FA:
  1. Click your avatar (top right) → Manage account
  2. Open Security
  3. Scan the QR code with an authenticator app (Google Authenticator, Authy, etc.)
  4. Enter the 6-digit code to confirm
This account window is drawn by our identity provider, Clerk, not by FTS — so it looks slightly different from the rest of the product. Whether two-factor authentication is offered there at all depends on how our Clerk instance is configured; if you do not see the option, write to us. (Open item #93.)
Save your backup codes in a secure location (password manager, vault). They’ll restore access if you lose your authenticator.

​
Enterprise: Single Sign-On (SSO)

Enterprise customers can enforce SAML 2.0 SSO via their identity provider (Okta, Azure AD, Google Workspace, etc.).
Not available today. No customer has SAML single sign-on configured, and there is nothing in the product to switch it on. Enterprise is a contract we agree individually — if SSO is a requirement for you, say so before you sign, and we will tell you honestly what it would take. (Open item #102.)

​
Session management

Sign-in and session lifetime are handled by our identity provider. We do not state a fixed window here, because the value is configured in that provider’s console and not in the product, and two earlier versions of this documentation gave two different numbers. If you are signed out sooner than you expect, sign in again — no data is affected. To manually log out:
  1. Click your avatar → Sign Out
  2. All active sessions are terminated
To view active sessions:
  1. Click your avatar → Manage account, then Security
  2. Under Active devices you see device, browser and last activity
  3. Sign a device out from there to terminate it remotely
You can be signed in on several devices at once (e.g. desktop, a second browser, mobile). How many sessions are allowed is set in our identity provider, not in the product.

​
Data encryption

In transit (HTTPS TLS 1.3):
  • All data between your browser/client and FTS servers is encrypted
  • Certificates are automatically renewed via Let’s Encrypt
At rest:
  • Case data, attachments and metadata sit on the encrypted storage of our providers — Neon for the database, Cloudflare R2 for uploaded files
Three claims are withdrawn here. Earlier versions of this page said encryption keys were managed by AWS KMS with customer-managed keys on Enterprise, that passwords and API keys were hashed with bcrypt by FTS, and that session tokens used HMAC-SHA256. Measured against the code: FTS holds no encryption key, stores no password (sign-in is Clerk’s) and issues no API key, so there is nothing here for us to manage or to hash. Whether the providers rotate keys in a KMS is a statement about them, not about us. The German version of this page carried the same idea in a different costume — an encryption key per workspace, kept in a hardware security module — and that is gone for the same reason: there is no such key. (Open items #257, #253.)

​
Workspace isolation

A workspace is a level of structure inside your organisation. It is not a security boundary.
  • Anyone who is a member of your organisation can see the cases in every workspace of that organisation
  • Data belonging to a different organisation is not reachable — that is the boundary that holds
  • Roles (Operator, Reviewer, Admin) are granted per organisation, so an Admin is an Admin everywhere in it
This section used to promise the opposite — “members of workspace A cannot access data from workspace B” — and it is wrong. Measured: the query that decides what a signed-in person may read (getUserWorkspaceIds) returns every workspace of every organisation the person belongs to. The same wrong promise was corrected in the in-product documentation in an earlier round and survived here. It also listed workspace-scoped API tokens, which contradicts the API security section of this very page: there are no API tokens at all. (Open items #256, #255.)
If you need two groups of people who must not see each other’s cases, give them separate organisations, not separate workspaces.

​
Data compliance

GDPR (EU)
  • FTS is GDPR-compliant. We process personal data only as needed for service delivery.
  • The database runs on Neon in Frankfurt, Germany, and the application executes in Frankfurt. Uploaded files are held in Cloudflare R2 in the EU region. This page no longer names a city for R2: “Paris” stood here and nothing supports it — a bucket’s location is a setting in Cloudflare’s console, and the console is the only place that can answer it. (Open item #258.)
  • You can request data export or deletion anytime (see Data export).
SOC 2
FTS itself holds no SOC 2 certification today, and there is no audit report to send you. Earlier versions of this page said a Type II certification was under way and expected in Q3 2026 and that an audit report was available on request, while our own FAQ said Type I was targeted for Q4 2026 and Type II for Q2 2027 — Type II cannot precede Type I, and both dates cannot be right. Neither statement is one we can stand behind, so both are withdrawn until there is a signed engagement to point at. Our infrastructure providers (Vercel, Clerk, Stripe, Neon, Cloudflare) hold SOC 2 Type II certifications of their own; that is a statement about them, not about us. We will answer a security questionnaire in writing. (Open item #104.)
Data Processing Agreement (DPA)

​
Workspace access controls

Admin capabilities:
  • Invite and remove members, and change member roles
  • Manage the taxonomy, case templates and the four-eyes setting
  • Export all organisation data as JSON, including the audit log — it records role changes, organisation-settings changes, the whole case lifecycle, evidence uploads, submitted reviews and the billing events. It does not record sign-ins or sign-outs, and removing evidence from a case that is still a draft leaves no entry at all. (Open item #254.)
  • Manage the subscription
Three things this list used to claim and the product does not have: a screen for viewing audit logs (the log exists, but only inside the JSON export — open item #92), configurable data-retention policies, and SSO or IP allowlists. Sign-in is handled by Clerk with e-mail and password.
Regularly review members and roles under Settings → Members. Remove inactive users to reduce risk — and to free the seat you are paying for.
Member roles (see Invite your team):
  • Operator: Create and edit own cases — the role every new member starts with
  • Reviewer: Everything an Operator can do, plus verify cases in review and publish them
  • Admin: Everything a Reviewer can do, plus members, roles, taxonomy, templates, billing
There is no Viewer role, no Member role and no Owner role, and no read-only role at all: whoever can sign in to a workspace can also create cases in it.

​
Incident response

If you discover a security issue:
  1. Email security@ferrufino-tech-solutions.com with details
  2. We’ll acknowledge within 1 business day
  3. We investigate and come back to you with what we found
  4. For a critical issue we follow the internal runbooks in this repository
Two words are deliberately gone from this list. FTS has no separate security team — the same people who build the product answer these mails — and there is no Enterprise SLA document to point at; an earlier version of this page referred to one. If you need a contractual response time, ask for it before you sign and we will put it in writing. (Open item #257.)
We ask that you do not publicly disclose vulnerabilities until we’ve had time to patch. We follow responsible disclosure practices and will credit reporters.

​
API security

There is no public FTS API and there are no API tokens. There is no token screen, no token lifetime and nothing to revoke. Everything you do in FTS goes through the signed-in web application. If you need programmatic access, write to support@ferrufino-tech-solutions.com — it is on the roadmap, not in the product.
This box used to read “Never commit API tokens to version control”, directly beneath the paragraph that says FTS issues no API tokens at all. A rule about handling something is a statement that the something exists, so the two boxes contradicted each other across a single blank line. The advice itself is sound for any credential you hold — it simply has no FTS token to apply to (corrected on 06.08.2026, open item #255). The German version of this page never carried the box; the same residue was removed from de/guides/integrations.mdx in the previous round.

​
Password policy

Passwords are set and checked by Clerk, our identity provider, not by FTS.
This page used to state a policy — twelve characters, mixed case, a digit, a special character, and a check against known-breach databases. Those are settings in Clerk’s console, and none of them can be read from this product’s source code, so we cannot stand behind the exact list here. What you actually see when you choose a password is what Clerk enforces for our instance. Same situation as two-factor sign-in above. (Open items #257, #93.)
Use a password manager (1Password, Bitwarden, LastPass) to generate and store strong passwords.

Invite your team

Data export

Contact support