How we secure Fynox.

Where your data lives

Fynox SaaS runs in the EU. Prefer your own environment? Fynox and Vigil can run inside your own infrastructure.

Your data and AI

Fynox Vigil is our own security AI, run by Fynox and not by a third-party AI provider. Your security data will never go to outside AI services or be used to train models.

Data protection

• TLS 1.2 or newer in transit, encryption at rest
• Integration credentials encrypted per tenant, secret fields encrypted one by one
• Strong tenant isolation enforced at the database layer

Access

• Sign-in with your identity provider (OIDC)
• TOTP MFA, which each tenant can require
• Roles from viewer to admin
• Audit log with actor, IP and time

Product and infrastructure security

• Protected main branch, every change goes through a pull request
• Admin access only through an authenticated tunnel, keys only, no public SSH
• Security headers: HSTS, CSP, X-Frame-Options
• Regular backups and continuous monitoring

Privacy

• GDPR and UK GDPR, with a Data Processing Addendum for business customers
• After a subscription ends, customer data is deleted or anonymized within 90 days unless the law requires otherwise
• AI security findings are deleted after 90 days

Sub-processors

We keep a current list of the providers that help us deliver the service, and share it with business customers under their DPA.

Report a vulnerability

Write to [email protected]. Tell us what you found and how to reproduce it, and we'll reply. The contact is also in /.well-known/security.txt.

Documents on request

Data Processing Addendum, sub-processor list, security overview.