TLS in transit, AES-256 at rest, and tokenized payments via Stripe — we never store raw card numbers.
SecuritySecurity Center
Security that keeps with your business. pace
Every layer of FCE One is designed for trust — from how we store your data to how we respond when something goes wrong. Here's exactly how we do it.
TLS in transitNetwork E2EE (scoped)Passkeys & recoveryResponsible disclosure
Deep dives grounded in how FC1 actually works
Encrypted messaging
What Network E2EE covers — and what it deliberately does not.
Passkeys & recovery
Account login vs unlocking encrypted message history.
Devices
Linking, revocation, and lost-device handling.
Threat model
Design goals and explicit non-goals — no hype claims.
Encrypted messaging · Passkeys & recovery · Devices · Privacy architecture · Threat model
Core controls in five pillars.
Encryption
TLS 1.2+ in transit, AES-256 at rest, envelope-encrypted per-tenant keys.
Access
Least-privilege IAM, hardware MFA, just-in-time production access.
Detection
24/7 monitoring, anomaly detection, tamper-evident audit trail.
Response
< 15 min pager response, 72-hour breach notification commitment.
Resilience
Multi-AZ, encrypted backups, 5-min RPO, quarterly DR drills.
Compliance
Security practices + provider PCI (Stripe). Formal FC1 SOC 2 / ISO reports only when attested under NDA.
FCE One uses role-scoped services, RS256 JWT auth, encrypted traffic, and isolated databases per portal — so a compromise in one area can’t freely reach the rest of the platform. Certification badges below describe controls and provider status; they are not a substitute for an attested FC1 SOC 2 / ISO report.
Portal-scoped JWTs, MFA options, and just-in-time employee access to production.
24/7 monitoring with a <15 minute pager response and 72-hour breach notification commitment.
1. Compliance & certifications
We separate FC1 practices from provider certifications. Ask sales for any formal report under NDA — do not assume a public badge means a completed FC1 audit:
- SOC 2 — when an FC1 Type II report exists, it is shared under NDA via security@fceone.com.
- ISO/IEC 27001 — we align controls to common ISMS practices; treat a public “certified” claim as valid only with current certificate evidence.
- PCI DSS Level 1 — handled by our payment processor (Stripe); we never store raw card data.
- GDPR & CCPA — data-protection addendums available for customers and enterprise partners.
2. Platform architecture
FCE One is built as a set of role-scoped microservices (identity, customer, seller, hub, business, driver, admin) behind a single API edge. Each service owns its own Postgres database, communicates through an event bus, and verifies RS256 JWTs via JWKS — so portal tokens can’t be reused across roles. Production runs on AWS across multiple availability zones, with automated failover and point-in-time database recovery.
- All traffic terminates at Cloudflare + AWS WAF before reaching application layers.
- No service is exposed to the public internet except through the gateway.
- All internal traffic is mutually authenticated; cross-service data moves via typed domain events, not shared SQL.
3. Encryption
In transit
- TLS 1.2+ everywhere. HSTS preload on all public domains.
- Modern cipher suites; SSL Labs A+ rating.
At rest
- AES-256 for databases, object storage, and backups.
- Customer secrets are envelope-encrypted with a per-tenant data key, rotated regularly.
- Disk-level encryption on every EC2 volume.
4. Authentication & access control
- Passwords are hashed with Argon2id; we never store or log raw credentials.
- Optional two-factor authentication (TOTP, WebAuthn/passkeys, SMS).
- SSO via SAML/OIDC for business tier (SCIM provisioning on request).
- All session tokens are HttpOnly + Secure + SameSite=Lax with rotating refresh.
- Employee access requires hardware keys and is reviewed monthly.
- Production access is just-in-time and logged.
5. Data handling
Customer data belongs to the customer. We process it only as described in our Privacy Policy and under a Data Processing Addendum where one exists. Highlights:
- Tenant data is logically isolated per account, with row-level authorization enforced at the API gateway.
- Exports are available on request and self-serve in most cases.
- We do not sell personal data and we do not use customer data to train third-party AI models.
6. Resilience & backups
- Production has a 99.95% uptime target (SLA available for enterprise).
- RPO: 5 minutes. RTO: 1 hour. Exercised quarterly.
- Encrypted backups are retained for 30 days across two regions.
- DR runbooks are reviewed twice a year.
7. Subprocessors
A current list of subprocessors is available at any time. Highlights:
- Amazon Web Services — hosting (US East, US West).
- Cloudflare — edge, WAF, DDoS protection.
- Stripe — payment processing (PCI DSS Level 1).
- Twilio / Postmark — SMS and transactional email.
- Sentry — error monitoring (no PII).
- Datadog — observability (structured logs + metrics).
Customers on enterprise plans are notified in advance of any subprocessor change.
8. Monitoring & incident response
- 24/7 paging on-call rotation, primary response SLA < 15 minutes.
- All security-relevant events are streamed to a write-once audit log.
- Anomaly detection on authentication, payouts, and data-export volumes.
- Formal post-incident reviews for every Sev 1 / Sev 2 — root cause, corrective actions, and follow-up tickets are shared internally within 72 hours.
- Material security incidents affecting customer data are notified without undue delay (and always within 72 hours).
9. Responsible disclosure
We welcome reports from the security community. Please email security@fceone.com with a clear description, steps to reproduce, and any supporting artifacts. PGP key available on request.
If you act in good faith and within the scope below, we will not take legal action:
- In scope: *.fceone.com web apps, public APIs, mobile apps.
- Out of scope: physical tests, social engineering, DoS/volumetric testing, third-party services.
- Please don't access data that isn't yours. Create a test account if you need one.
We respond within 2 business days, keep you updated, and recognize researchers on our Hall of Fame with permission.
10. Contact
Security questions, vendor questionnaires, or DPA requests: security@fceone.com.
For incident notifications under contract, use the emergency channel provided in your order form.
Need something we didn't cover?
Our security team responds to vendor questionnaires and custom reviews.