Security

Encryption

• TLS 1.3 for all data in transit
• AES-256 for data at rest
• Field-level encryption for Social Security numbers, employer identification numbers, and bank account and routing numbers, using keys held in a separate key-management service

Tenant isolation

Every financial record carries the identity of the customer it belongs to, and isolation is enforced in the database itself rather than only in application code. One customer's records cannot be read through another customer's session.

Payment card data

Our point-of-sale integration reads sales totals and transaction metadata only. Card numbers, security codes, and magnetic-stripe data never enter Faspro — they remain within your payment processor's environment. This keeps cardholder data structurally out of our systems rather than merely protected inside them.

Financial record integrity

Financial records are append-only. Corrections are recorded as new entries that supersede earlier ones rather than by overwriting history, and every change is logged with who made it, what changed, and when. Records are retained for at least seven years.

Access control

Access is role-based and limited to what a person's role requires. Administrative access to customer data is logged.

Independent assurance

SOC 2 Type II is targeted within 18 months of platform launch. We do not yet hold a SOC 2 report, and we will say so plainly until we do.

Reporting a vulnerability

If you believe you have found a security issue, email [email protected]. We will acknowledge your report and keep you informed as we investigate. Please give us a reasonable opportunity to address an issue before disclosing it publicly.