Security
How we keep the platform safe.
This page describes how fruityworx Platforms Inc. secures the fruityworx platform and the data inside it. Customers who need a deeper review can request our SOC 2 Type II report and our latest penetration test summary under NDA.
Tier-1 uptime. Hardened surface.
The platform targets tier-1 uptime and runs on hardened infrastructure with automatic failover. The marketing site (this page) and the platform (app.fruityworx.io and every white-label deployment) run on separate infrastructure with separate credentials and separate blast radius.
Encryption.
All data is encrypted in transit using TLS 1.3, with modern cipher suites only (no RC4, no 3DES, no CBC-mode ciphers). All data is encrypted at rest using AES-256, with keys managed by the cloud provider's KMS and rotated annually. Backups are encrypted with a separate key ring.
Workspace isolation.
Every workspace on the platform lives in a dedicated environment: its own data partition, its own user directory, its own API keys, and its own audit log. A workspace cannot read or write to another workspace's data. The platform enforces isolation at the application layer (every query is scoped to a workspace) and at the data layer (row-level access control). A bug in one workspace cannot leak data from another.
Authentication.
The platform supports single-factor (email + password), two-factor (TOTP and WebAuthn), and single sign-on (SAML 2.0 and OIDC). SSO is included on the Scale plan and available as an add-on on the Growth plan. Password hashing uses Argon2id with parameters that meet current OWASP guidance.
Authorization.
The platform uses a role-based access control model with predefined roles (Owner, Admin, Operator, Read-only) and the ability to create custom roles with fine-grained permissions. API access uses scoped tokens that expire automatically.
Audit logging.
Every authentication attempt, every administrative change, and every access to sensitive data is logged with a tamper-evident chain. Operators can stream audit logs to their own SIEM via webhook. Audit retention is 12 months by default, longer for regulated industries.
Network and infrastructure.
The platform runs on hardened cloud infrastructure with WAF, DDoS protection, and rate limiting at the edge. Administrative access to production requires hardware-backed MFA and comes from a separate, audited network. Infrastructure configuration is managed as code and reviewed by a second engineer.
Application security.
We run a continuous application security program: dependency scanning on every build, SAST on every pull request, DAST in a staging environment, and an annual third-party penetration test by a CREST-accredited firm. The platform's bug bounty program is described below.
AI and data.
AI apps on the platform do not train on customer data. Each AI app is configured to use a specific model and a specific data scope, and the model provider receives only the data needed to produce the configured output. AI providers are listed in the sub-processor list and can be replaced or removed by the operator at any time.
Region pinning.
Operators on the Scale plan can pin their platform and specific workspaces to specific geographic regions. Data at rest and in transit stays inside the chosen region. Region-pinned workspaces are isolated from regions outside the pin, even at the network layer.
Compliance.
fruityworx is SOC 2 Type II audited annually. The audit covers security, availability, and confidentiality trust service criteria. The full report is available under NDA to operators on the Growth and Scale plans. We comply with GDPR and CCPA, and we sign DPAs with operators who need them.
Sub-processors.
We use a small set of sub-processors to operate the platform: cloud infrastructure, payment processing, transactional email, monitoring, and AI model providers (only when the operator enables an AI app). A current list of sub-processors, with the data each one receives, is available at security@fruityworx.io.
Responsible disclosure.
We welcome reports from security researchers. Send findings to security@fruityworx.io with enough detail to reproduce. We acknowledge within 24 hours, triage within 72 hours, and credit researchers (by their preferred handle) in our hall of fame for valid reports. Please don't test against a workspace you don't own; we'll happily set up a sandbox for you.
Contact.
Security questions, SOC 2 requests, and DPAs go to security@fruityworx.io. Fruityworx Platforms Inc., 59 Atis St., Aurora Subd., Angono, Rizal 1930, Philippines.