Security at firmfact
Built for finance, procurement and market data teams at regulated firms.
The summary below is what buyers usually need during vendor review. For the underlying documents, ask us and we will share them directly.
Hosting and data residency
Where your data lives, and who can touch it.
- EU-primary infrastructure: your data is hosted in the European Union
- EU-first sub-processors, named in our Data Processing Agreement
- Operated under Dutch law
Authentication and access control
How people sign in, and what happens the day they leave.
- Enterprise SSO over SAML 2.0 or OpenID Connect, on Enterprise and Enterprise Plus
- SCIM 2.0 automated user provisioning and deprovisioning from your identity provider, on Enterprise and Enterprise Plus
- Two-factor authentication, least-privilege roles, and session inactivity timeouts
- Removing or deactivating a leaver takes effect immediately (live sessions are signed out and workspace API tokens revoked) and is written to the audit trail
Encryption
How data is protected in transit, at rest, and between customers.
- Every layer that stores your data is encrypted at rest: database, uploaded documents, credentials, and backups
- Traffic to the application and API is encrypted with TLS 1.3; older TLS versions are refused, and HTTPS is enforced with HSTS
- Documents are encrypted with AES-256 under a key unique to each workspace; the storage provider never holds the key
- Deleting a workspace destroys its encryption key, so its stored files become permanently unreadable once our encrypted backups have rotated out
- Backups are encrypted before they leave our infrastructure, verified every day, and restore-verified
- Passwords stored with bcrypt; API tokens held only as hashes
Keeping customers separate
Isolation is enforced twice, independently, so a mistake in one layer is caught by the other.
- Every database query is automatically scoped to the workspace you are signed into
- Row-level security in the database re-checks that boundary independently across tenant-scoped tables, through a role that cannot bypass it
- Files are served only through the application, after you sign in, never by a link that points at storage
Document intake and email
You can forward invoices and contracts straight to your workspace.
- Each workspace has its own private intake address; mail to it can only ever be filed into that workspace
- Only senders you have explicitly approved are processed automatically; anything else is held for review
- Sender authenticity is checked with SPF, DKIM, and DMARC: a message that fails is never processed automatically, even from an approved sender
- Attachments and uploads are scanned for malware before they are stored, on our own infrastructure; an infected file is refused, not quarantined for someone to open later
- Every intake decision is recorded in the audit trail
AI processing
What the AI sees, where it runs, and what it is not allowed to do.
- AI inference runs against an EU regional endpoint (Mistral AI SAS, Paris), served from EU and EFTA data centres
- Zero data retention is enabled on our account: the provider does not keep your documents or questions once they are processed
- The provider-side training setting is disabled: your documents and questions are not used to train models
- Document content is passed per request; storage locations and credentials are never shared with the provider
- Your own AI client connects over MCP as a person, by signing in (Claude, Claude Code and the CLI) or with that person's API token, so it only sees what they may see
- The AI provider is named in the Data Processing Agreement and the sub-processor register
Application security
How we keep the code and the running service safe.
- Peer code review and a secure development process
- Every change scanned for known-vulnerable dependencies and run through static analysis
- The production application is also tested by an independent third-party security platform (automated testing, not a manual penetration test)
- Sign-in, password-reset, and API endpoints rate-limited against brute-force attempts
- Automated monitoring alerts us to errors and security-relevant events, including attempts to cross a workspace boundary
Privacy and GDPR
How we handle personal data and support your compliance obligations.
- Built to align with the GDPR
- Data Processing Agreement available to download right now, no account or sales call needed
- Sub-processor register in your account after onboarding, or on request during diligence
- Account admins can export your data from the app at any time, on every plan; deletion on request
Availability and disclosure
Uptime, and how to reach us about a security issue.
- 99.9% monthly uptime target, with an SLA on Professional and above
- Live service status at status.firmfact.com (opens in a new tab); subscribe for incident notices
- Report a suspected security issue to security@firmfact.com
- Security contact also published at /.well-known/security.txt
Vulnerability disclosure
We welcome good-faith reports from researchers, customers, and the community.
- Email findings to security@firmfact.com. Include steps to reproduce, impact, and a proof of concept where practical.
- We aim to acknowledge reports within two business days and provide weekly status updates until remediation.
- Agree the scope with us at security@firmfact.com before any active testing, and never access or change another customer's data. Avoid privacy violations, data destruction and service disruption.
- Researchers who comply with this policy are treated as authorised testers acting in good faith. We will not pursue legal action against good-faith, scoped research, and we credit reporters with permission.
Request our security documentation
Our Data Processing Agreement is published: download it now, no account or sales call needed. Customers and prospects under evaluation can also request our sub-processor register and our authentication and SSO security review. Send your security questionnaire and we will work through it with you.