Trust Center

MFA on every workforce account

SSO with phishing-resistant or TOTP MFA. Shared passwords for production systems are prohibited.

MFA and SSO for cloud consoles

AWS and other admin consoles require SSO plus MFA. Root credentials are vaulted and used only for break-glass.

Role-based access, least privilege

Production roles are scoped by job function. Standing admin access is not granted by default.

Quarterly access reviews

Owners attest that each production and SaaS role is still required. Orphaned accounts are revoked.

Joiner–mover–leaver within 24 hours

New hires get the minimum role. Movers are recertified. Leavers lose production and email access the same business day.

Privileged activity is logged

Assume-role events, production deploys, and datastore access are written to the audit trail.

Admin session timeouts

Idle and absolute timeouts on administrative surfaces. Re-authentication required for sensitive actions.

Unique IDs — no shared prod logins

Every human and service account is uniquely attributable. Generic admin users are not used in production.

TLS 1.2+ in transit

Public and private service traffic uses modern TLS. Weak ciphers and plain HTTP on product surfaces are disabled.

Encryption at rest (AES-256)

Datastores and object storage use provider-managed AES-256. Snapshots inherit encryption.

Secrets never live in git

API keys, tokens, and certificates are stored in a managed vault. Secret scanning runs on every push.

Keys in cloud KMS

Application encryption keys are generated and stored in AWS KMS. Rotation follows the key policy.

Full-disk encryption on endpoints

Company laptops require FileVault/BitLocker (or equivalent) before they can reach corporate systems.

Centralized audit logging

Authentication, authorization, and data-access events from the product and cloud accounts land in a central store.

Log retention of at least 12 months

Security-relevant logs are retained for a minimum of twelve months to support investigations and Type II evidence windows.

Alerts on anomalous authentication

Impossible travel, repeated failures, and privilege escalation generate paging alerts for on-call.

Trusted time on systems

Production systems synchronize clocks so audit events can be correlated across services.

Log integrity protections

Log destinations restrict delete/modify to a break-glass role. Application roles are write-only.

Dependency scanning on every build

CI fails closed on known-critical issues in application dependencies, with a documented exception path.

Image and infrastructure scanning

Container images and infrastructure definitions are scanned before they are promoted to production.

Independent pentest at least annually

An external firm tests the product and selected infrastructure. Findings are tracked to closure. Summary under NDA.

Patch SLAs for critical issues

Critical remotely exploitable issues are targeted for mitigation within 72 hours of a stable fix, sooner when feasible.

Change management for production

Production changes go through reviewed pull requests and CI. Emergency changes are retrospectively documented.

Separated production and staging

Non-production environments do not share credentials or customer data with production.

Background verification where lawful

Roles with production access are screened in line with Dutch and EU employment law.

Security awareness on hire and annually

Training covers phishing, data handling, and incident reporting. Completion is tracked.

Confidentiality and acceptable use

Workforce agreements cover confidentiality, acceptable use, and return of assets at offboarding.

MDM on company devices

Company laptops are enrolled, patchable, and remotely wipeable. Unmanaged devices cannot reach production.

Screen lock and clean desk

Automatic lock on idle. Sensitive paper and displays are handled as confidential in offices and coworking spaces.

Same-day offboarding

Identity, email, vault, and cloud access are revoked as part of a single offboarding checklist.

Living subprocessor inventory

Processors that may see personal data are listed on this Trust Center and in customer DPAs.

DPA with each processor

No personal data is sent to a processor without a data processing agreement and an assessed transfer mechanism.

Security review before onboard

Critical vendors are reviewed for encryption, access control, incident process, and subprocessors of their own.

Annual re-assessment of critical vendors

High-risk processors are recertified at least annually or when their scope materially changes.

30-day notice for material subprocessor changes

Customers are notified of material additions as required by the DPA, with an objection window where contracted.

Records of processing

We maintain Article 30 records for controller activities and processor activities on behalf of customers.

Customer DPA available

A GDPR data processing addendum is part of the customer contract pack and can be requested from this Trust Center.

DSAR handling procedure

Privacy requests are logged, verified, and completed within statutory timelines. Tenant DSARs are routed to the customer when we are processor.

Retention and deletion schedule

Each personal-data category has a retention rule. Tenant deletion follows the contract and backup TTL.

EU residency for tenant data

Primary customer tenant data is stored in AWS eu-central-1. Exceptions are only listed subprocessors with a transfer tool.

Privacy by design in the SDLC

Features that collect or expose personal data get a lightweight DPIA-style review before launch.

Mandatory peer review

Production code cannot merge without at least one review from someone other than the author.

CI security gates

Tests, lint, and security scans must pass before deploy. Protected branches block force-push.

SAST and secret scanning

Static analysis and secret detection run in CI. High findings are tracked like any other defect.

Logical tenant isolation

Authorization checks are tenant-scoped. Automated tests cover cross-tenant access attempts.

Responsible disclosure inbox

security@remotefort.com accepts vulnerability reports. We ask researchers not to access customer data or disrupt service.

Production access only via SSO

Engineers do not SSH with standing keys. Access is identity-aware, MFA-gated, and time-bound.

Automated encrypted backups

Datastores are backed up on a defined schedule, encrypted, and stored in-region.

Restore tests

Restore procedures are exercised on a defined cadence so backups are known to be usable.

Status and customer incident comms

Severity definitions include when and how customers are notified of availability or security incidents.

Capacity and health monitoring

Error rates, latency, and saturation page on-call before customers feel a full outage.

Documented RTO / RPO

Recovery time and recovery point objectives for the production platform are written and reviewed with the ISMS.

Incident response plan

Roles, severity, evidence handling, and legal notification paths are documented and accessible to on-call.

24/7 severity matrix

P1 security and availability events page immediately. Lower severities follow business-hours SLAs.

Customer notification commitments

Personal-data breaches affecting a tenant are notified in line with GDPR and the DPA—without waiting for a marketing review.

Post-incident reviews

Blameless reviews capture timeline, impact, and corrective actions. Actions are tracked to done.

Annual tabletop exercise

At least once a year we rehearse a security incident with engineering, operations, and a privacy owner.