How Fortoxa secures your data, and what it has not proved yet.
Fortoxa sells the argument that a security claim without evidence behind it is worth nothing. That argument has to survive being pointed at Fortoxa. Below is the posture, what each item rests on, and — in the second half — the gaps, because a vendor page with no gaps is a vendor page nobody checked.
What is implemented.
Each item names what it rests on. Nothing here has been checked by an outside party.
Encryption in transit
All traffic is served over TLS. The application sends HSTS with a one-year max-age and includeSubDomains, and its Content-Security-Policy sets upgrade-insecure-requests, so a plaintext request is upgraded rather than served.
Encryption at rest
Customer data is held in managed Postgres and object storage with provider-managed encryption at rest. Fortoxa does not operate its own key-management service, and does not offer customer-managed keys.
Credential handling
Passwords and API keys are stored as bcrypt hashes, never in plaintext. Session tokens are RS256 JWTs. Secrets are supplied as environment variables and are not committed to source control.
Browser-side hardening
The site sets a restrictive Content-Security-Policy with no wildcard script source, X-Frame-Options DENY, X-Content-Type-Options nosniff, a strict Referrer-Policy, and a Permissions-Policy disabling camera, microphone and geolocation.
Where data is processed
Customer data is processed in UK and EU regions. Every third party that touches customer data is named on the subprocessors page, with its role and location.
Tenant separation
Data is scoped to workspaces, and every customer-facing query is filtered by the workspace on the authenticated session. Roles are admin, analyst and viewer.
What Fortoxa cannot currently show you.
If one of these is a blocker for your procurement process, it is better that you find out on this page than three weeks into a review.
No third-party audit or certification
Fortoxa holds no SOC 2 report, no ISO 27001 certificate, and no Cyber Essentials certification of its own. Nothing on this page has been verified by an external assessor. If your procurement process requires an audit report, Fortoxa cannot satisfy it today.
No independent penetration test
Fortoxa has not commissioned an external penetration test, and there is no report to share. The responsible-disclosure policy is the route by which external findings currently reach us.
No automated release gate
There is no continuous-integration pipeline enforcing review, dependency scanning, or static analysis on every change. Adding one is on the roadmap; describing it as though it already ran would be the kind of unverifiable security claim this product exists to expose.
No published availability commitment
No plan carries an uptime SLA, and Fortoxa does not measure or publish uptime. The status page says the same thing.
Where to send a security issue.
You found a vulnerability
Read the disclosure policy first — it sets out what testing is in scope and what is not, and the safe-harbour position.
You are a customer with a concern
Write to the security mailbox. It is the same address the platform's own automated alerts are delivered to, so it is a monitored inbox rather than a forwarding alias.