Security
What protects your documents and records, stated plainly.
Tender documents and quality records are commercially sensitive. This page lists the controls that are in place today, and our compliance status as it actually is.
- Sign-up
- None public; invitation only
- Sign-in
- Single sign-on through WorkOS
- Certifications held
- None today (no SOC 2, no ISO 27001)
- Reports
- hrishikeshkakkad@fluidzero.ai
Who can get in, and to what.
- 01Invitation-only accounts
- There is no public sign-up. Organizations and their members are provisioned by us, and an identity that has not been provisioned is refused.
- 02Single sign-on
- Sign-in runs through WorkOS AuthKit, with email and password, one-time email codes, or Google accounts.
- 03Roles
- Fennec separates owners, admins, members and viewers. Chainage separates engineers, approvers, quantity surveyors and administrators, and checks roles on the server.
- 04Organization scoping
- Documents, extractions, inspections and results belong to an organization, and requests are authorized against the organization in the signed-in session.
Where your data lives, and how it moves.
- Encryption in transit
- All traffic is served over HTTPS, with HTTP Strict Transport Security on our web domains.
- Encryption at rest
- Documents are stored in Amazon S3 and records in managed PostgreSQL, both encrypted at rest by the provider.
- Hosting
- Fennec and Chainage run on Amazon Web Services, with their databases on Neon’s managed PostgreSQL and their web applications served through Vercel. Fennec’s documents are stored in Oregon, United States; Chainage’s files in Mumbai, India.
- Model training
- Neither product trains models on your documents. Both send documents to a third-party document-reading service, and Fennec also to a language-model service, for processing. We list them for your review on request.
Records you can rely on later.
- 01Append-only logs
- Chainage records who changed each record, who opened each inspection, and what its document reader was asked and answered. The database refuses a rewrite of any of them.
- 02Rules frozen at the time of work
- A Chainage inspection keeps the acceptance limits it was raised under, so later catalogue changes never re-judge past work.
- 03Raw exchanges kept
- Fennec keeps the raw output of every document it reads and every exchange with the services that read it, so a result can be explained and audited later.
- 04Read-only integration keys
- Chainage API keys can read inspections and their results, nothing else. They are stored only as hashes and can be revoked.
The reasoning behind these is on our approach page.
No certification today, and no badge pretending otherwise.
fluidzero does not currently hold SOC 2 or ISO 27001 certification. We would rather tell you that than show a badge we have not earned.
We complete security questionnaires, walk your team through our architecture and data flows, list the third-party services that process your data, and discuss contractual data-protection terms. Email hrishikeshkakkad@fluidzero.ai to start a review.
Found a problem? Tell us first.
If you believe you have found a security issue in any fluidzero product or website, email hrishikeshkakkad@fluidzero.ai with the details. Please give us reasonable time to fix it before disclosing it. See also our privacy policy.