> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ferrufino-tech-solutions.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Security
> Two-factor sign-in, session management, GDPR — and what FTS does not have: no SAML SSO, no encryption key of our own, no security certification of our own.
This page states what FTS actually does, including the things it does not do. Data in transit is encrypted with TLS; data at rest sits on the encrypted storage of our providers. FTS holds no encryption key of its own, offers no SAML single sign-on, and holds no security certification of its own; each of those is spelled out in its own section below, together with what our providers do hold.
## Authentication
### Two-factor authentication (2FA)
All plans support 2FA for added account security.
**To enable 2FA:**
1. Click your **avatar** (top right) → **Manage account**
2. Open **Security**
3. Scan the QR code with an authenticator app (Google Authenticator, Authy, etc.)
4. Enter the 6-digit code to confirm
This account window is drawn by our identity provider, Clerk, not by FTS — so it looks slightly different from the rest of the product. Whether two-factor authentication is offered there at all depends on how our Clerk instance is configured; if you do not see the option, write to us. (Open item #93.)
Save your backup codes in a secure location (password manager, vault). They'll restore access if you lose your authenticator.
### Enterprise: Single Sign-On (SSO)
Enterprise customers can enforce SAML 2.0 SSO via their identity provider (Okta, Azure AD, Google Workspace, etc.).
**Not available today.** No customer has SAML single sign-on configured, and there is nothing in the product to switch it on. Enterprise is a contract we agree individually — if SSO is a requirement for you, say so before you sign, and we will tell you honestly what it would take. (Open item #102.)
## Session management
Sign-in and session lifetime are handled by our identity provider. We do not
state a fixed window here, because the value is configured in that provider's
console and not in the product, and two earlier versions of this documentation
gave two different numbers. If you are signed out sooner than you expect,
sign in again — no data is affected.
To manually log out:
1. Click your **avatar** → **Sign Out**
2. All active sessions are terminated
To view active sessions:
1. Click your **avatar** → **Manage account**, then **Security**
2. Under *Active devices* you see device, browser and last activity
3. Sign a device out from there to terminate it remotely
You can be signed in on several devices at once (e.g. desktop, a second browser, mobile). How many sessions are allowed is set in our identity provider, not in the product.
## Data encryption
**In transit (HTTPS TLS 1.3):**
* All data between your browser/client and FTS servers is encrypted
* Certificates are automatically renewed via Let's Encrypt
**At rest:**
* Case data, attachments and metadata sit on the encrypted storage of our
providers — Neon for the database, Cloudflare R2 for uploaded files
**Three claims are withdrawn here.** Earlier versions of this page said
encryption keys were managed by **AWS KMS** with **customer-managed keys on
Enterprise**, that passwords and API keys were **hashed with bcrypt by FTS**, and
that session tokens used **HMAC-SHA256**. Measured against the code: FTS holds no
encryption key, stores no password (sign-in is Clerk's) and issues no API key, so
there is nothing here for us to manage or to hash. Whether the providers rotate
keys in a KMS is a statement about them, not about us. The German version of
this page carried the same idea in a different costume — an encryption key **per
workspace**, kept in a hardware security module — and that is gone for the same
reason: there is no such key. (Open items #257, #253.)
## Workspace isolation
A workspace is a level of structure inside your organisation. **It is not a
security boundary.**
* Anyone who is a member of your organisation can see the cases in **every**
workspace of that organisation
* Data belonging to a different organisation is not reachable — that is the
boundary that holds
* Roles (Operator, Reviewer, Admin) are granted per **organisation**, so an
Admin is an Admin everywhere in it
**This section used to promise the opposite** — "members of workspace A cannot
access data from workspace B" — and it is wrong. Measured: the query that decides
what a signed-in person may read (`getUserWorkspaceIds`) returns every workspace
of every organisation the person belongs to. The same wrong promise was corrected
in the in-product documentation in an earlier round and survived here. It also
listed workspace-scoped **API tokens**, which contradicts the *API security*
section of this very page: there are no API tokens at all. (Open items #256,
\#255.)
If you need two groups of people who must not see each other's cases, give them
**separate organisations**, not separate workspaces.
## Data compliance
**GDPR (EU)**
* FTS is GDPR-compliant. We process personal data only as needed for service delivery.
* The database runs on Neon in Frankfurt, Germany, and the application executes in Frankfurt. Uploaded files are held in Cloudflare R2 in the EU region. This page no longer names a **city** for R2: "Paris" stood here and nothing supports it — a bucket's location is a setting in Cloudflare's console, and the console is the only place that can answer it. (Open item #258.)
* You can request data export or deletion anytime (see [Data export](/en/account/data-export)).
**SOC 2**
FTS itself holds **no SOC 2 certification today, and there is no audit report to
send you.** Earlier versions of this page said a Type II certification was under
way and expected in Q3 2026 and that an audit report was available on request,
while our own FAQ said Type I was targeted for Q4 2026 and Type II for Q2 2027 —
Type II cannot precede Type I, and both dates cannot be right. Neither statement
is one we can stand behind, so both are withdrawn until there is a signed
engagement to point at. Our infrastructure providers (Vercel, Clerk, Stripe,
Neon, Cloudflare) hold SOC 2 Type II certifications of their own; that is a
statement about them, not about us. We will answer a security questionnaire in
writing. (Open item #104.)
**Data Processing Agreement (DPA)**
* There is no *Legal* area in the product. Request a DPA by e-mail at [hello@ferrufino-tech-solutions.com](mailto:hello@ferrufino-tech-solutions.com) and we will send you one to sign.
## Workspace access controls
**Admin capabilities:**
* Invite and remove members, and change member roles
* Manage the taxonomy, case templates and the four-eyes setting
* Export all organisation data as JSON, including the audit log — it records
role changes, organisation-settings changes, the whole case lifecycle,
evidence uploads, submitted reviews and the billing events. It does **not**
record sign-ins or sign-outs, and removing evidence from a case that is still
a draft leaves no entry at all. (Open item #254.)
* Manage the subscription
Three things this list used to claim and the product does not have: a screen for viewing audit logs (the log exists, but only inside the JSON export — open item #92), configurable data-retention policies, and SSO or IP allowlists. Sign-in is handled by Clerk with e-mail and password.
Regularly review members and roles under **Settings** → **Members**. Remove inactive users to reduce risk — and to free the seat you are paying for.
**Member roles (see [Invite your team](/en/guides/invite-team)):**
* **Operator**: Create and edit own cases — the role every new member starts with
* **Reviewer**: Everything an Operator can do, plus verify cases in review and publish them
* **Admin**: Everything a Reviewer can do, plus members, roles, taxonomy, templates, billing
There is no Viewer role, no Member role and no Owner role, and no read-only role at
all: whoever can sign in to a workspace can also create cases in it.
## Incident response
If you discover a security issue:
1. **Email** [security@ferrufino-tech-solutions.com](mailto:security@ferrufino-tech-solutions.com) with details
2. We'll acknowledge within **1 business day**
3. We investigate and come back to you with what we found
4. For a critical issue we follow the internal runbooks in this repository
Two words are deliberately gone from this list. FTS has **no separate security
team** — the same people who build the product answer these mails — and there is
**no Enterprise SLA document** to point at; an earlier version of this page
referred to one. If you need a contractual response time, ask for it before you
sign and we will put it in writing. (Open item #257.)
We ask that you do not publicly disclose vulnerabilities until we've had time to patch. We follow responsible disclosure practices and will credit reporters.
## API security
**There is no public FTS API and there are no API tokens.** There is no token
screen, no token lifetime and nothing to revoke. Everything you do in FTS goes
through the signed-in web application. If you need programmatic access, write to
[support@ferrufino-tech-solutions.com](/en/contact) — it is on the roadmap, not
in the product.
**This box used to read "Never commit API tokens to version control", directly
beneath the paragraph that says FTS issues no API tokens at all.** A rule about
handling something is a statement that the something exists, so the two boxes
contradicted each other across a single blank line. The advice itself is sound
for any credential you hold — it simply has no FTS token to apply to
(corrected on 06.08.2026, open item #255). The German version of this page never
carried the box; the same residue was removed from
`de/guides/integrations.mdx` in the previous round.
## Password policy
Passwords are set and checked by Clerk, our identity provider, not by FTS.
This page used to state a policy — twelve characters, mixed case, a digit, a
special character, and a check against known-breach databases. **Those are
settings in Clerk's console, and none of them can be read from this product's
source code**, so we cannot stand behind the exact list here. What you actually
see when you choose a password is what Clerk enforces for our instance. Same
situation as two-factor sign-in above. (Open items #257, #93.)
Use a password manager (1Password, Bitwarden, LastPass) to generate and store strong passwords.
## Related pages