Fornax OpSuites Security Statement

Summary

Fornax hosts customer websites on established infrastructure providers, keeps each customer’s data separate, and locks stored CRM connection tokens. This page separates what is in place today from what we are working toward, and it does not claim certifications we do not hold.

1. Infrastructure

• Demo sites, DNS, CDN, storage: Cloudflare. Live customer sites: Cloudflare Pages today, moving to Amazon Web Services (AWS). Database and authentication: Supabase (PostgreSQL). Backend services and dashboard: Railway (containerized). Payments: Stripe (we never see card numbers). Phone and texting (Fornax Phone): Telnyx. Email: Amazon SES (Amazon Web Services).
• Our providers publish their own certifications (for example SOC 2). These are the providers’ certifications, not Fornax’s. Fornax has not completed its own SOC 2 audit.
• We do not promise a specific uptime percentage or a backup schedule.

2. In place today

• Encrypted connections: our web services send an HSTS header so browsers keep using HTTPS.
• Separate customer data: the database uses row-level security tied to the customer, so one customer’s rows cannot be read as another’s. The database has automated isolation tests.
• Locked CRM token: the HubSpot token you connect is encrypted with AES-256-GCM before it is stored. The key lives only in the backend’s secret store, and nothing in the dashboard ever receives the plain token.
• Safer connect flow: connecting a CRM uses a one-time random value, so an attacker cannot link their account to your business.
• Administrator sign-in: the admin tools require an authenticator-app code (two-factor) on top of the password.
• Card data: Stripe handles all card data; Fornax stores no card numbers.
• Accessibility checks: every generated site goes through automated accessibility checks before it is published. These checks cover what static HTML can show; they are not a full accessibility audit or a compliance claim.

3. What we are working toward

These are targets, not statements of fact, and we will move them up to “in place” only once they are built and tested.

• Further hardening of sign-in and sessions, including optional two-factor for customer accounts.
• Regular, documented tests of data isolation.
• Logging of administrator access.
• Rotation of encryption keys on a schedule.
• A written incident-response process: we aim to contact affected customers promptly and without undue delay, and to follow applicable notification laws.

4. Vendor review

We review each critical vendor (Stripe, Cloudflare, AWS, Supabase, Railway, Telnyx, Amazon SES) for security posture before relying on it, and sign data processing terms where personal data is involved.

5. Privacy and compliance

• CCPA: we act as a service provider for your customers’ data under data-processing terms in our customer agreement, honor deletion requests, and never sell data. Retention and deletion periods are in the Privacy Policy.
• GDPR: we do not target EU customers at launch.
• HIPAA: not applicable; we do not handle protected health information.

6. Reporting a vulnerability

Email support@fornaxopsuites.com. We aim to acknowledge within 24 hours.

7. Changes

We will update this statement as our practices change.