Your data, protected by design.

FDE Force is built for enterprise environments where client confidentiality, data isolation, and regulatory compliance are non-negotiable.

Encryption & access control

Every layer of the platform is designed to protect sensitive interview data from collection through storage and delivery.

Encryption

All data is encrypted in transit (TLS 1.2+) and at rest, by our hosting provider. Stakeholder responses, workspaces, and deployment maps are encrypted throughout their lifecycle.

Access controls

Each vendor's login sees only its own workspace. The platform login can list vendors and issue their logins, but cannot see inside any workspace.

Sign-in

Agents connect over OAuth 2 with PKCE. Access tokens last an hour, refresh tokens 30 days and are rotated on use, and only hashes of tokens are stored. Single sign-on is not yet supported.

Strict boundaries between organizations

Client data never crosses organizational boundaries. Every vendor's data lives in its own isolated database schema.

IP isolation

Your workspace, its product description, features, roles and their questions, remains fully yours. The platform applies your approach consistently across your customers without exposing or reusing intellectual property.

Client data isolation

Each vendor's data lives in its own database schema. Stakeholder responses, findings, and deployment maps are partitioned at the database level - never shared or aggregated across vendors.

Change history

Every change to a deployment map is kept as a version, with the interview or reason behind it.

Regulatory compliance

General Data Protection Regulation

Full compliance with European data protection regulations. Data subject rights are supported, data processing is documented, and appropriate technical and organizational measures are in place. Data processing agreements are available on request.

EU AI Act

The platform is designed to be transparent and ethically aligned with EU AI Act requirements. The interviewer introduces itself as an AI agent, and the system operates as an augmentation tool - keeping humans in control of analysis, judgment, and recommendations.

SOC 2 Type II

FDE Force is hosted on Railway, which holds a SOC 2 Type 2 report.

Platform security measures

Cloud infrastructure

Hosted on enterprise-grade cloud infrastructure in the EU (Railway, Amsterdam).

Data residency

Data processing and storage locations are documented and available on request to support data residency requirements. The platform and its database are hosted in the EU.

Testing

Automated tests check, on every change, that no vendor can reach another vendor's data.

Secure development

Security is embedded in the development lifecycle with automated testing.

Incident response

Customers are notified without undue delay of any personal data breach related to their data.

Subprocessor transparency

Full list of subprocessors published and maintained. Clients are notified of any changes to the subprocessor list.