Trust and security
Security assurance and compliance documentation are available through our Trust Center and customer security-review process.
SOC 2 Type I & II
We have completed SOC 2 Type I and Type II examinations. Reports for completed periods and their scope are available through our security-review process.
Regional storage options
Customer storage deployments include Australia, the United States and Singapore. The applicable agreement and deployment configuration determine the available arrangements.
Monitored by Vanta
Security and compliance control monitoring and evidence management through Vanta.
Available reports and control documentation can be requested through the Fluency Trust Center.
The controls enterprise teams expect
Fluency observes how work actually runs, which makes the handling of that data the first question every security review asks. These are the answers.
SOC 2 Type I & II
Our completed Type II report covers the security, availability and confidentiality trust services criteria. Reports and their scope are available through our security-review process, subject to access requirements.
Encryption in transit and at rest
We use encryption for supported transfers and stored information, with identity and access controls appropriate to the system.
Capture exclusions and redaction
Captured content can contain personal information before and after processing. Configurable capture exclusions and redaction reduce exposure, but do not guarantee removal of every identifier or sensitive item.
Role-based access controls
Access is restricted by user role to enforce least-privilege principles across your organisation.
Regional data residency
Storage-region selection does not itself restrict every processing service to that country. Model, gateway, support and diagnostic services may process information in other countries, as described in our Privacy Policy.
Third-party penetration testing
Independent penetration testing forms part of our security programme. Available reports and their scope can be requested through our security-review process.
Where your data lives
Customer platform storage deployments include Australia, the United States and Singapore. Some model, gateway, support and diagnostic services process information in other countries. The customer agreement and authorised configuration determine which routes may be used.
Australia
Storage region.
United States
Storage region.
Custom MSAs
Available on the Enterprise tier for organisations with specific security and compliance requirements.
The team is based in San Francisco, USA and Melbourne, Australia. Our privacy policy sets out how we collect, use and protect personal information.
How Fluency deploys into your estate
The second half of a security review is rarely about certificates. It is about whether the thing fits the way you already run identity, logging and recovery.
Single sign-on
SAML 2.0 and OIDC federation, so people sign in with your existing identity provider — Okta, Microsoft Entra ID, ADFS, Google, OneLogin, JumpCloud or Ping. Fluency never handles their password.
Directory sync
SCIM provisioning keeps accounts in step with your directory, so joiners, movers and leavers are handled where you already handle them.
Multi-factor authentication
Required for all privileged access to production. Where single sign-on is enabled, enforcement is delegated to your identity provider.
Private cloud deployment
Private cloud options and their scope are agreed for the deployment. The agreed architecture and service terms identify data locations, support access, telemetry and any external processing services.
Audit log export
Sign-ins, record changes, configuration changes and administrator access to customer data, each with the user, IP address, timestamp and object. Retained for at least 30 days and exportable on request.
Backups and deletion
Backups follow class-specific retention and recovery arrangements. Deletion and return follow the applicable customer agreement and instructions, including backup-expiry cycles and handling of restored records described in our Privacy Policy.
Frequently asked questions
Our safeguards include encryption for supported transfers and stored information, access restrictions based on role and need, security monitoring and incident-response procedures. The measures appropriate to a record depend on the system and risks involved. You can request our SOC 2 report and the scope relevant to your deployment through our security-review process.
We have completed SOC 2 Type I and Type II examinations. Our completed Type II report covers the Security, Availability and Confidentiality trust services criteria. Reports for completed periods and their scope are available through our Trust Center, subject to access requirements.
Visit our Trust Center for available reports and control documentation. Contact our team for the scope relevant to your deployment, and read our Privacy Policy for information about personal information, providers and processing locations.
We use Vanta to monitor security and compliance controls and manage supporting evidence. Independent SOC 2 reports are available through our security-review process.
Yes, custom MSAs are available on our Enterprise Tier to meet specific organizational security and compliance requirements.
You can review our privacy policy at usefluency.com/privacy-policy for detailed information about how we collect, use, and protect your personal information.
The team is based in San Francisco, USA and Melbourne, Australia. Customer platform storage deployments include Australia, the United States and Singapore. Some model, gateway, support and diagnostic services process information in other countries. The customer agreement and authorised configuration determine which routes may be used; our Privacy Policy identifies the relevant providers, locations and transfer safeguards.
