Security Overview

Security responsibilities are owned at the leadership level, controls are documented, and data is classified so that stricter rules apply to more sensitive information.

Data is encrypted in transit using TLS and at rest using industry-standard encryption. Especially sensitive fields receive additional protection.

Access follows least privilege, enforced through role-based access control. Multi-factor authentication is required for administrative access. Customer data is isolated per tenant, enforced at the database layer with row-level security.

Input validation, security headers, CSRF protection, and dependency scanning are part of the development pipeline. The platform sits behind DDoS protection and a web application firewall.

Errors and security-relevant events are logged and monitored, with audit trails for sensitive actions so activity can be reconstructed when needed.

Payments are fully outsourced to our payment processor. Card data does not touch Fulcrum infrastructure, and payment webhooks are signature-verified.

We maintain an incident response process with severity levels, defined responsibilities, and customer notification timelines. Personal data breaches are handled as described in the DPA Summary.

We test our own defenses, including penetration testing against recognized methodologies, and fix findings on severity-based timelines.

Data is backed up regularly and recovery procedures are tested, with defined recovery time and recovery point objectives.

Found something? We want to know. See the Vulnerability Disclosure Policy, or email [email protected].