Security Controls

Databases are continuously backed up with point-in-time restore (7-day window) and encrypted at rest. Recovery procedures are tested to support restoration after a disruption.

Access to data is governed by role-based permissions scoped to a user's role, team, and agency, with least-privilege defaults. Customer administrators control who can see and do what within their workspace.

Multi-factor authentication (TOTP) is available to all users and required for Fluent's internal staff. Once enrolled, a time-based one-time code is required at sign-in in addition to the password.

All traffic between your browser or device and Fluent is encrypted using TLS 1.2 or higher; modern clients negotiate TLS 1.3 automatically. We do not serve application traffic over unencrypted connections.

Application secrets and credentials are stored in a managed secret store and injected at runtime — never committed to source code or configuration files.

All customer data — database records, file storage, and backups — is encrypted at rest using AES-256. Encryption keys are managed through our cloud provider's managed key service.

PHI is excluded from application logs, error monitoring, and performance analytics through automated scrubbing before any data leaves our systems. Third-party monitoring providers do not receive PHI.

Customers can request scoped exports of their data, protected by step-up verification and recorded in an audit log. On termination, data is deleted in accordance with our retention and deletion policies and applicable law.

Fluent maintains a documented incident response plan with defined severity levels, escalation paths, and post-incident review. If a confirmed incident affects your data, we notify you within the timelines defined in your agreement and BAA.

Fluent continuously monitors infrastructure and access patterns for anomalies using cloud-native threat detection, with automated alerts routed to our team for investigation.

PHI is only processed once a Business Associate Agreement (BAA) is executed and PHI mode is enabled for your workspace. PHI mode activates additional safeguards and gates PHI-designated features.

Access to protected health information is recorded in an append-only audit log capturing who accessed what and when. Logs are written to tamper-resistant storage and retained for at least 12 months.

Subprocessors that may handle PHI are contractually bound by BAAs or equivalent obligations. We publish our subprocessor list and provide at least 30 days’ notice before adding a new subprocessor.

Customer data, including PHI, is used only to provide the Service. We never use it for advertising, resale, benchmarking, or to train AI/ML models.