Data Security Statement

Last updated 11 November 2025

1. Purpose

This statement outlines the policies, controls, and safeguards implemented by Fortx to protect customer and system data stored, processed, or transmitted through our platform.

Our goal is to ensure that all information managed on our platform remains confidential, integral, and available, with robust security measures in place at every layer of our infrastructure.

2. Data Protection Overview

Fortx takes a comprehensive approach to data security.

All data within our platform is protected using industry-standard encryption and security frameworks, ensuring that information is secure both in transit and at rest.

Our infrastructure is hosted on Amazon Web Services (AWS) - a leading cloud service provider recognised for its ISO 27001, SOC 1/2/3, and PCI DSS compliance certifications.

3. Data Encryption

a. Data in Transit

  • All data transmitted between our customers, APIs, and platform services is encrypted using Transport Layer Security (TLS) 1.2 or higher.
  • We enforce HTTPS across all web interfaces and secure all API endpoints.
  • TLS certificates are managed and renewed automatically to ensure continuity of encryption.
  • Mutual TLS and secure token-based authentication are supported for API integrations.

b. Data at Rest

  • All customer and system data stored within our AWS environment is encrypted at rest with AES-256 encryption.
  • Encryption is applied across all AWS services.
  • Backup and snapshot data are encrypted with the same standards and stored within the same AWS region as the primary data.

4. Access Control and Authentication

  • Access to production systems is strictly limited to authorised personnel under the principle of least privilege.
  • Administrative and developer access requires Multi-Factor Authentication (MFA) and is granted only via secure VPN or federated SSO.
  • Role-based access controls (RBAC) are enforced across all application and infrastructure components.
  • All access attempts and administrative actions are logged, monitored, and reviewed regularly.

5. Infrastructure and Network Security

  • Our platform is hosted on AWS, leveraging its physically secure, geographically redundant data centres.
  • Network security is maintained through:
    • VPC segmentation to isolate environments (production, staging, and development)
    • Network ACLs to enforce least-privilege network rules
    • Continuous vulnerability management using AWS-native and third-party tools
  • Regular penetration testing and security audits are conducted to validate system resilience.

6. Compliance and Best Practices

Our platform and security operations align with globally recognised frameworks and standards, including:

  • SOC 2 Type II (Security, Availability, and Confidentiality Principles)
  • ISO 27001 Information Security Management
  • GDPR (General Data Protection Regulation) for data privacy
  • AWS Shared Responsibility Model, under which AWS manages the security of the cloud, and we manage the security in the cloud

7. Incident Response and Monitoring

Fortx maintains a formal Incident Response Plan (IRP) to ensure prompt detection, response, and remediation of potential security events.

  • Security monitoring is continuous.
  • In the event of an incident, affected systems are immediately isolated, the root cause is analysed, and impacted customers are notified according to applicable regulations and contractual obligations.
  • Post-incident reviews are conducted to improve future prevention and detection measures.

8. Business Continuity and Disaster Recovery

  • We maintain automated, encrypted backups with defined retention policies to enable full data recovery in the event of disruption.
  • Our disaster recovery strategy leverages AWS multi-Availability Zone (AZ) and cross-region redundancy.
  • Periodic recovery drills are performed to validate business continuity readiness.

9. Continuous Improvement

Security is an ongoing commitment. We continually review, test, and enhance our policies, configurations, and operational practices to stay ahead of emerging threats.

Regular employee security training, independent audits, and vulnerability assessments are integral to our proactive security culture.

10. Contact

For security-related enquiries, vulnerability reporting, or data protection concerns, please contact security@fortx.com.