Security controls built into your cloud
Control who can sign in, which services can connect and what your API tokens may change. Here are the protections and access settings available in Faastic.
- 01
Closed until you open it
Managed databases and storage don't listen on the internet until you open them, and then only to the addresses you list.
- 02
Encrypted connections
Databases and storage accept encrypted (TLS) connections, with a CA bundle you can verify against.
- 03
Two-factor is mandatory
Every account signs in with a second factor, an authenticator app or a passkey. With a passkey, you can even drop the password.
- 04
Scoped API tokens
Read or read & write, limited to areas, projects or single services, with an expiry date. Creating one asks for your password or authenticator code, and no token can manage members or other tokens.
- 05
A log of every change
The activity log shows each change, who made it and, for scripts, the token that made it.
We don't publish certifications or audit results until we hold the reports.
Frequently asked questions
Is two-factor authentication required?
Yes, for every account. Sign in with an authenticator app or a passkey, and with a passkey you can drop the password altogether.
Are managed databases reachable from the internet?
Not by default. Databases and object storage stay closed until you open them, and then only to the addresses you list. You can also keep them on a private network.
Do you offer a data processing agreement (DPA) for the GDPR?
Yes. Our data processing agreement is published with our legal documents and covers your GDPR paperwork.
Are you ISO 27001 certified?
We don't publish certifications or audit results until we hold the reports. This page describes how the platform actually behaves instead.
Where is my data stored?
In our datacenter in Ghent, Belgium, on hardware we own.
Let's talk about security
Ask us anything. And if you've found a problem, tell us: we'll work through it with you.