Skip to main content
FTS is built with security and privacy at its core. We protect your operational knowledge with industry-leading encryption, access controls, and compliance standards.

​
Authentication

​
Two-factor authentication (2FA)

All plans support 2FA for added account security. To enable 2FA:
  1. Click your avatar → Security Settings
  2. Select Two-Factor Authentication
  3. Scan the QR code with an authenticator app (Google Authenticator, Authy, etc.)
  4. Enter the 6-digit code to confirm
Save your backup codes in a secure location (password manager, vault). They’ll restore access if you lose your authenticator.

​
Enterprise: Single Sign-On (SSO)

Enterprise customers can enforce SAML 2.0 SSO via their identity provider (Okta, Azure AD, Google Workspace, etc.). To configure SSO:
  1. Contact your FTS account manager
  2. Provide your identity provider’s metadata URL
  3. We’ll validate the setup in a test environment
  4. Once live, all workspace members must authenticate via your corporate SSO
Once SSO is enabled, password-based login is disabled for your workspace. Ensure your IT team has provisioned all users before activation.

​
Session management

FTS sessions expire after 30 days of inactivity. You’ll be notified 3 days before expiry with an in-app banner. To manually log out:
  1. Click your avatar → Sign Out
  2. All active sessions are terminated
To view active sessions:
  1. Security Settings → Active Sessions
  2. See device, browser, and last activity
  3. Click Sign Out on any session to terminate it remotely
You can have up to 5 simultaneous sessions (e.g., desktop + 2 browsers + mobile + API token).

​
Data encryption

In transit (HTTPS TLS 1.3):
  • All data between your browser/client and FTS servers is encrypted
  • Certificates are automatically renewed via Let’s Encrypt
At rest (AES-256):
  • Case data, attachments, and metadata are encrypted in our Neon PostgreSQL database
  • Encryption keys are managed by AWS KMS (Enterprise plan uses customer-managed keys)
Sensitive fields (Field-level encryption):
  • User passwords and API keys are hashed (bcrypt) and salted
  • Session tokens use HMAC-SHA256

​
Workspace isolation

Each workspace is logically isolated:
  • Members of workspace A cannot access data from workspace B
  • Workspace admins cannot escalate privileges beyond their workspace
  • API tokens are workspace-scoped
Use separate workspaces for different departments or customers to enforce data isolation.

​
Data compliance

GDPR (EU)
  • FTS is GDPR-compliant. We process personal data only as needed for service delivery.
  • Data is stored in EU data centers (Neon PostgreSQL in Frankfurt, Germany; Cloudflare R2 in Paris).
  • You can request data export or deletion anytime (see Data export).
SOC 2 Type II (in progress)
  • We’re undergoing SOC 2 Type II certification, expected Q3 2026.
  • Current security controls meet SOC 2 standards; audit report available upon request.
Data Processor Agreement (DPA)
  • Available in your Workspace Settings → Legal for EU customers and those requiring contractual assurances.

​
Workspace access controls

Admin capabilities:
  • Invite, remove, and reassign member roles
  • View audit logs (who accessed what, when)
  • Set data retention policies
  • Configure SSO and IP allowlists (Enterprise)
Regularly audit workspace members and roles in Workspace Settings → Members. Remove inactive users to reduce risk.
Member roles (see Invite your team):
  • Viewer: Read-only access
  • Member: Create and edit own cases
  • Reviewer: Approve/reject cases in review workflows
  • Admin: Full workspace control

​
Incident response

If you discover a security issue:
  1. Email security@ferrufino-tech-solutions.com with details
  2. We’ll acknowledge within 1 business day
  3. Our security team investigates and contacts you with updates
  4. Critical issues trigger an incident response plan (see Enterprise SLA)
We ask that you do not publicly disclose vulnerabilities until we’ve had time to patch. We follow responsible disclosure practices and will credit reporters.

​
API security

If you use the FTS API:
  • Generate tokens in Workspace Settings → API Tokens
  • Each token is workspace-scoped and cannot access other workspaces
  • Tokens expire after 1 year; you’ll be reminded to rotate
  • Revoke any token immediately if compromised
Never commit API tokens to version control. Use environment variables or secret management tools (1Password, HashiCorp Vault, etc.).

​
Password policy

FTS enforces strong passwords:
  • Minimum 12 characters
  • At least one uppercase letter, one lowercase, one number, one special character
  • Checked against common breach databases (HIBP)
Use a password manager (1Password, Bitwarden, LastPass) to generate and store strong passwords.

Invite your team

Data export

Contact support