Trust & Security

Where Your Data Lives, and Who Can Touch It

Every claim on this page is checked directly against the running infrastructure and the product's own privacy documentation, not aspirational copy -- each one links (in a hidden citation) to its source in the codebase. If something isn't listed here, treat it as not yet verified, not as "probably fine."

Data Residency

Production infrastructure -- the database, uploaded documents, and application traffic -- runs in AWS's ca-central-1 (Canada Central) region. The prior US region's database and document bucket have both been fully decommissioned; no data remains outside Canada in either.

Encryption

At rest: the production database (RDS) has storage encryption enabled. Uploaded documents in S3 are encrypted by default at the bucket level, and the application also sets server-side encryption explicitly on every upload.
In transit: the application load balancer only accepts TLS 1.2 and 1.3 (AWS's `ELBSecurityPolicy-TLS13-1-2-2021-06` policy) -- no plaintext HTTP to the app.

Access Controls

Optional two-factor authentication (TOTP authenticator apps) is available on every account, in addition to a bcrypt-hashed password or Google sign-in.
The application is fronted by AWS WAF, running AWS's managed core rule set, a known-bad-inputs rule set, and a per-IP rate limit, in front of the app's own login/2FA rate limiting.
AWS GuardDuty (threat detection) and CloudTrail (account-level audit logging) are enabled on the AWS account running production infrastructure.

Subprocessors

The current list of subprocessors, what each one receives and where it processes data is section 5 of our Privacy Policy ("Who we share information with"). It is kept in one place so this page can never disagree with it. None of them receive raw payment card data, and none may use your data to train their own general-purpose models without permission.

Data Isolation Between Customers

Every project, document and requirement belongs to one account, and the database itself enforces it: row-level security is forced on every table holding customer data, so a query that isn't scoped to the signed in account returns nothing. Each API route also checks ownership in application code. Automated tests run on every change and try to reach one customer's data as another, both through every route and directly against the database.

Vulnerability Reporting

If you believe you've found a security issue, email privacy@fjordiq.ai with details. Please don't test against other customers' data. Our contact details are also published in security.txt.

There is no bug bounty today.

Policies and Agreements

Privacy Policy, including the subprocessor list, retention and your rights.
Terms of Service.
Data Processing Agreement: available on request from support@fjordiq.ai.

Questions

For anything not covered here, email support@fjordiq.ai.