Least privilege by construction

Each connected account grants a read-only role scoped to the resource types you want watched. We assume it with short-lived STS credentials per scan; no long-lived cloud keys are stored in our systems. GitHub access is granted through an app installation limited to repository code read and pull request write, revocable by you at any time from GitHub.

Self-healing, when enabled, executes through your own pipeline against classes of drift you nominate — Fortify Core still never applies directly to your cloud.

Plan output is streamed through a redaction pass that strips provider-marked sensitive values and anything matching known credential patterns before a record is written. Records are encrypted with AES-256-GCM using keys held in a managed KMS with per-tenant data keys and automatic rotation. Backups are encrypted with the same scheme and tested quarterly.

Every record carries a tenant identifier enforced at the database policy layer, not only in application code. Scanning workers are single-tenant for the duration of a job and are destroyed afterwards, so no plan output survives between customers.

Multi-availability-zone deployment with automated failover, point-in-time database recovery to any second in the last 7 days, a documented recovery objective of 1 hour RTO and 5 minutes RPO, and restore drills performed each quarter.

Background checks and security training for every employee, mandatory MFA and managed devices with disk encryption, quarterly access reviews, and an incident response plan exercised twice a year with defined severity levels and customer notification timelines.

SOC 2 Type II audited annually; the report, the penetration test summary and completed security questionnaires are available under NDA. Audit log export, SAML SSO, SCIM and granular RBAC ship on the Enterprise plan. See the data processing addendum and sub-processor list.

Report suspected vulnerabilities to security@fortifycore.io. We acknowledge within one business day, provide a remediation timeline within five, and credit researchers who ask to be named. We do not pursue legal action against good-faith research that respects customer data and avoids service degradation.