Trust and security
We strive to meet the highest level of security certification across borders and industries. Our compliance and certification are managed by Vanta and our audit partners.
SOC 2 Type I & II
Audited by Sensiba and managed through Vanta, with an independent penetration test every year on top of it.
Two residency regions
Australian and US regions, chosen by you, under the privacy laws that apply there, with deployments into new regions based on service demand.
Monitored by Vanta
Continuous compliance monitoring against our controls, published in the Trust Center.
Every control below is evidenced in the Fluency Trust Center.
The controls enterprise teams expect
Fluency observes how work actually runs, which makes the handling of that data the first question every security review asks. These are the answers.
SOC 2 Type I & II
Audited by Sensiba and managed through Vanta. The Type II report covers the security, availability and confidentiality trust services criteria, and is available under NDA.
End-to-end encryption
All data is encrypted in transit and at rest using modern cryptographic protocols.
PII redaction
Microsoft Presidio redacts personal data, passwords and other sensitive fields before processing. Custom redaction fields can be added.
Role-based access controls
Access is restricted by user role to enforce least-privilege principles across your organisation.
Regional data residency
Data is stored and processed in the region you choose, with Australian and US regions available, under the privacy laws that apply there.
Third-party penetration testing
An independent firm penetration-tests the platform every year. Reports are published in the Trust Center.
Where your data lives
Customer data is stored and processed in the region you select, with Australian and US regions available, under the privacy and data protection laws that apply there.
Australia
Storage and processing region.
United States
Storage and processing region.
Custom MSAs
Available on the Enterprise tier for organisations with specific security and compliance requirements.
The team is based in San Francisco, USA and Melbourne, Australia. Our privacy policy sets out how we collect, use and protect personal information.
How Fluency deploys into your estate
The second half of a security review is rarely about certificates. It is about whether the thing fits the way you already run identity, logging and recovery.
Single sign-on
SAML 2.0 and OIDC federation, so people sign in with your existing identity provider — Okta, Microsoft Entra ID, ADFS, Google, OneLogin, JumpCloud or Ping. Fluency never handles their password.
Directory sync
SCIM provisioning keeps accounts in step with your directory, so joiners, movers and leavers are handled where you already handle them.
Multi-factor authentication
Required for all privileged access to production. Where single sign-on is enabled, enforcement is delegated to your identity provider.
Private cloud deployment
Fluency can run inside your own AWS or GCP account, which keeps every log and every byte of telemetry in your environment. Allow a further two to four weeks.
Audit log export
Sign-ins, record changes, configuration changes and administrator access to customer data, each with the user, IP address, timestamp and object. Retained for at least 30 days and exportable on request.
Backups and deletion
Automated daily backups with 30-day retention and point-in-time recovery. You can request deletion of your data at any point in the term.
Frequently asked questions
Yes, security is our top priority. Fluency is SOC2 Type I & II certified with enterprise-grade controls. All data is encrypted in transit and at rest, and we follow strict compliance standards for data handling and privacy.
Yes, your data is secure with Fluency. We maintain SOC 2 Type II compliance, which verifies our adherence to strict information security policies and procedures through independent auditing. For more detailed information about our security practices and compliance certifications, please visit our trust center at trust.usefluency.com.
Visit our trust center at trust.usefluency.com for detailed information about our security practices, compliance certifications, and data protection measures.
Fluency monitors compliance with Vanta to ensure we maintain the highest standards of security and regulatory compliance.
Yes, custom MSAs are available on our Enterprise Tier to meet specific organizational security and compliance requirements.
You can review our privacy policy at usefluency.com/privacy for detailed information about how we collect, use, and protect your personal information.
The team is based in San Francisco, USA and Melbourne, Australia. Customer data is stored and processed in the region you select, with Australian and US regions available, under the privacy and data protection laws that apply there.
