DEPLOYED ON AWS
The Fulcrum infrastructure is deployed on Amazon Web Services (AWS), and benefits from the security practices of AWS. Please refer to the AWS Cloud Security documentation for additional information.
ENCRYPTION
All information transmitted to and from Fulcrum is encrypted using 256-bit SSL (TLS). Data stored in Fulcrum is encrypted at rest using AES-256 including data records, media, signatures, and other attachments. Certain customer account information is additionally encrypted.
SECURE DEVELOPMENT
Our application development process is designed to allow us to address security vulnerabilities, based on severity, as part of our standard release cycle.
NETWORK SECURITY
Within AWS, Fulcrum’s instances are segmented into separate networks to provide additional controls over data flows within the system. All instances, including those not accessible to the public, are hardened and managed with automated configuration management.
ENDPOINT SECURITY
All company-owned machines are managed via mobile device management (MDM), which updates malware signatures daily.
ACCESS CONTROL
We implement a least privilege approach to ensure that only administrative staff have access to Fulcrum database in accordance with the Fulcrum Terms of Service. Access to the Fulcrum AWS infrastructure is managed by our corporate single-sign-on (SSO) solution, which requires multiple factors to grant access.
AUTHENTICATION
All user accounts in Fulcrum require strong passwords for authentication to the system. In addition to the built-in Fulcrum authentication system, enterprise users may link to their own identity providers using SAML 2.0.
PERSONNEL
All Spatial Networks, Inc. staff undergo a background check and sign a non-disclosure agreement. Aside from our use of AWS, we do not outsource any aspect of Fulcrum development, operation, or administration.
MONITORING AND LOGGING
We use modern tools to monitor the Fulcrum infrastructure for suspicious activity. Alerts are automatically routed in our corporate communications for review and remediation. Fulcrum provides several layers of logging, which can be analyzed via automated or manual means.
REDUNDANCY AND BACKUP
For disaster recovery, a warm standby is maintained in a separate availability zone and kept in sync via constant streaming replication. We run nightly full backups of the Fulcrum database, which are retained for 90 days. Within user accounts, Fulcrum retains a complete history of edits for each data record.
VALIDATION
We perform quarterly penetration tests, using industry-standard practices. Findings are reviewed with Fulcrum technical staff and added to the Fulcrum roadmap for adjudication, based on severity. Customers are also welcome to perform their own tests against the public-facing components of Fulcrum.
SOC 2 Type 2 Compliance
For SaaS companies in the United States, SOC 2 is considered the “gold standard” for security compliance. In order to achieve SOC 2 certification, companies must submit to an independent audit that assesses one or more of five crucial factors relating to security, availability, processing integrity, confidentiality, and privacy.
