Everything before the first call.

• Who is Fortoxa for?

  UK and EU small businesses that run their own servers and are being asked for security evidence by a customer, an insurer or an assessor. If you have no servers to install an agent on, Fortoxa has very little to collect and is probably not the right tool.
• What does Fortoxa actually collect?

  An agent you install on a server reads system and authentication logs and ships events to your workspace. From those it builds blocked-connection records, account and role history, and host configuration and patch state. It does not read laptops, phones, SaaS accounts, or any host without the agent. See data sources.
• How long does setup take?

  Installing the agent is a single command on one server. How quickly the register becomes useful depends on how much your hosts log and how many you cover — Fortoxa does not publish a time-to-value figure because it does not measure one.
• How is pricing structured?

  Four plans: Micro £29/month (1 seat), Starter £99/month (5 seats), Business £349/month (20 seats, and the first plan that produces the control register and evidence export), and Pro £899/month (higher ingest, SOC 2 alongside the other frameworks). Those seat numbers are the caps the software enforces, not guidance. Starter and Business include a 14-day trial on a new subscription. Full limits on pricing.
• Which plan gives me the compliance register?

  Business and above. Micro and Starter cover monitoring, alerts and the live activity feed; neither includes the control register or the evidence export. This is enforced server-side, not a soft limit.
• Which frameworks does Fortoxa map to?

  Cyber Essentials, NCSC CAF, GDPR Article 32 and NIS2, with SOC 2 on Pro. Each framework page sets out what the framework requires, what Fortoxa produces toward it, and what stays your job. Fortoxa produces evidence; it does not certify you and no output from it is a certificate.
• How are alerts delivered?

  By email. There is no chat-tool delivery and no SMS alerting on any plan today — an earlier version of this page said otherwise. Chat delivery is on the roadmap, with no date.
• Is my data UK/EU resident?

  Customer data is processed in UK and EU regions. Every third party that touches it is named on the subprocessors page with its role and location.
• Can you send me your SOC 2 report or ISO certificate?

  No. Fortoxa holds no third-party audit report, no ISO 27001 certificate, and no Cyber Essentials certification of its own, and has not commissioned an external penetration test. If your procurement process requires one, that is a blocker today. The full position is on the security page.
• What is your uptime commitment?

  There is not one. No plan carries an availability SLA, and Fortoxa does not measure or publish uptime. The status page says the same and explains why it shows no green ticks.
• What happens to my data if I cancel?

  You can export your evidence and reports at any time while the subscription is active. Fortoxa does not currently operate an automated retention or deletion schedule, so deletion after cancellation is handled on request — write in and it will be actioned. An earlier version of this page quoted a 30-day automatic window that no code implements.
• Do you offer MSP or reseller pricing?

  Pro includes multi-workspace and a named account manager. There is no published partner programme or reseller rate card — ask and you will get a direct answer rather than a brochure.

Each question has its own anchor — link to one directly if you need to cite it. Not answered here? Send the question and it will be answered and added.