Security Compliance Overview

Security at a Glance

🔐

Encryption

Data in transit is encrypted with TLS 1.2+. Data at rest is encrypted (AES-256) by the storage in your environment, under keys you control.

🏢

Deployment model

Fragiliti runs entirely within your own infrastructure. Your data stays in your environment - we don't host, store or back it up.

🔑

Access control

We have no standing access to your data. You control authentication, RBAC and SSO inside your deployment; MFA and least privilege govern our own systems.

🛡️

Vulnerability management

Dependency scanning, peer code review, OWASP-aligned development and annual third-party penetration testing of the product.

🚨

Advisories & patches

A documented process for issuing security advisories and patches to on-premises customers.

📋

Compliance

Working towards SOC 2 Type II. Aligned to the DPDP Act 2023, GDPR and CCPA.

Deployment & Shared Responsibility

Fragiliti is delivered as software that you deploy and operate inside your own environment (on-premises or your private cloud). The data you load and everything the platform computes stays within your infrastructure at all times. Much of the computation runs in the browser and on servers you control - Fragiliti operates no hosted, multi-tenant service that holds your data.

Security is therefore shared: you secure the environment Fragiliti runs in, and we secure the software we ship and the systems we run.

You are responsible for	Fragiliti is responsible for
Hosting, servers, network and firewall configuration	Secure software development lifecycle (SDLC)
Encryption at rest, key management and storage	Vulnerability scanning and patching of the product
Backups, retention and disaster recovery	Security advisories and hardening guidance
Identity, SSO, RBAC and user provisioning	Security of our own corporate systems and website
Physical security and data residency	Support under your enterprise agreement

Data Security

Your data never leaves your environment. Fragiliti does not receive, host or store the data you work with. We have no access to it unless you explicitly grant time-limited access for a specific support engagement.

Layer	Method
Data in transit	TLS 1.2 or higher for connections within your deployment. TLS 1.0 and 1.1 are disabled.
Data at rest	AES-256 supported; performed by the storage in your environment, under keys you manage.
Backups	Configured and controlled by you; we provide guidance and tooling.
Data residency	Determined entirely by your environment - your data stays wherever you host it.

Access Control

Your data

No standing access: your data resides in your environment, and Fragiliti staff cannot access it.
Support access is yours to grant: any access for a support engagement is explicit, time-limited, and revoked on completion.
You control access within your deployment: authentication, SSO, role-based access control (RBAC) and least privilege are configured by you.

Fragiliti's own systems

Principle of least privilege: staff are granted only the access their role requires.
Multi-factor authentication (MFA): required for all staff accessing our corporate and build systems.
Access reviews: quarterly reviews of who has access to what.
Off-boarding: access is revoked within 24 hours of an employee leaving.
Audit logs: access to our systems is logged and monitored.

Vulnerability Management

Dependency scanning: automated scanning of all third-party libraries for known vulnerabilities (CVEs). Critical vulnerabilities are patched promptly.
Penetration testing: annual third-party penetration tests of the product. Results are reviewed and remediated.
Code review: all code changes are peer-reviewed before release.
Secure development: development follows OWASP Top 10 guidelines.
Security advisories: we issue advisories and patches to on-premises customers, and recommend keeping deployments current.
Responsible disclosure: we accept and respond to security reports via our Vulnerability Disclosure Policy.

Organisational Security

Security training: all staff complete security awareness training at onboarding and annually.
Background checks: conducted for all employees prior to joining.
Confidentiality agreements: all employees and contractors sign NDAs.
Security policies: documented information security policies, reviewed annually.
Vendor assessment: our own vendors and tools are assessed for security posture before adoption.

Compliance Status

Framework / Regulation	Status	Notes
SOC 2 Type II	⏳ In Progress	Controls aligned to the SOC 2 Trust Service Criteria; audit in preparation.
ISO 27001	⏳ Aligned	Controls aligned; formal certification planned.
India DPDP Act 2023	✓ Aligned	Applies to the limited personal data we process (enquiries, sales and support). Your platform data stays in your environment.
EU GDPR	✓ Aligned	Data-subject rights honoured for the personal data we hold.
CCPA (California)	✓ Aligned	We do not sell or share personal data; rights honoured.
India IT Act 2000	✓ Aligned	Reasonable security practices per Section 43A and the SPDI Rules 2011.
CERT-In Directions 2022	✓ Aligned	Incident-reporting procedures in place for our own systems.

Incident Response

Because your platform data resides in your environment, you own incident response for your own infrastructure. Fragiliti's incident response covers vulnerabilities in the product and incidents affecting our own systems or website:

Security issues are triaged within 1 hour of detection.
For product vulnerabilities, we issue security advisories and patches to affected on-premises customers, with remediation guidance.
Post-incident reviews are conducted and findings are actioned.

Full details of our incident response process are available to enterprise customers on request.

Reporting a Security Issue

If you discover a security vulnerability in Fragiliti, please disclose it responsibly via our Vulnerability Disclosure Policy.

Email: contact@fragiliti.com with subject line "Security Disclosure".

We do not pursue legal action against researchers who follow responsible disclosure guidelines and act in good faith.