FORECAST-GRADE COMPUTER VISION · COMPLIANCE DOSSIER
The rest of this page is a procurement-grade dossier. It is written for the security reviewer in your loop, not the marketing reader. Subprocessor list, encryption architecture, pen-test cadence, audit report access, and a direct line to our security team are below.
Each certification is renewed annually with continuous monitoring. Reports, bridge letters, and scope statements are available under NDA through the request form at the bottom of this page.
Trust Services Criteria: Security, Availability, Confidentiality, Processing Integrity. Scope: FGCV Platform, FGCV-X1 edge runtime, FGCV Eval Suite, supporting infrastructure.
Request the report →Information Security Management System covering product engineering, customer data handling, incident response, supplier risk, and physical security at SF / Berlin / Tokyo offices.
Request the SoA →FGCV operates as a Business Associate for customers processing PHI in medical imaging workflows. BAA available for both managed-cloud and on-prem deployments.
Request the BAA →The same platform ships as a sealed appliance or tarball — no feature fork against managed cloud. Documented deployments at three Fortune 100 manufacturers, including one fully air-gapped site.
Architecture review →The managed cloud, on-prem, and fully air-gapped runtimes share the same SDK, the same SOC 2 Type II controls, the same signed inference runtime, and the same incident response playbook. There is no feature fork and no “secure lite” tier — the binary that ships to an air-gapped Siemens plant in Erlangen is the same one that powers a managed workload for a Series B startup in San Francisco.
Copy-pasteable into your vendor risk questionnaire. We notify customers 30 days before any subprocessor change affecting their data.
FGCV engages the following subprocessors to deliver the platform. Customer data is only routed to a subprocessor when the corresponding feature is enabled in the customer's tenant.
| Subprocessor | Purpose | Region | Certs |
|---|---|---|---|
| Amazon Web Services | Managed cloud compute & storage | US, EU, APAC | SOC 2 · ISO 27001 · HIPAA |
| Snowflake | Feature store & analytics warehouse | US, EU | SOC 2 · ISO 27001 · HIPAA |
| Datadog | Infrastructure & APM telemetry | US, EU | SOC 2 · ISO 27001 |
| Auth0 (Okta) | SSO & workforce identity | US, EU | SOC 2 · ISO 27001 · HIPAA |
| Cloudflare | Edge WAF & DDoS | Global anycast | SOC 2 · ISO 27001 |
| Stripe | Billing (no model/pixel data) | US, EU | SOC 2 · ISO 27001 · PCI-DSS L1 |
| Zendesk | Customer support ticketing | US, EU | SOC 2 · ISO 27001 |
| NCC Group | Annual third-party penetration test | UK, US | CREST · CHECK |
Data is encrypted at rest with AES-256-GCM and in transit with TLS 1.3 (minimum TLS 1.2 for legacy clients). Key management defaults to AWS KMS in the customer's region; customer-managed keys (BYOK) via KMS, HSM, or HashiCorp Vault are available on all plans.
Customer data access by FGCV personnel requires a documented support ticket, manager approval, time-bound JIT elevation, and produces a tamper-evident audit log entry visible to the customer in real time.
If your question is not answered here, email [email protected] — a security engineer (not a salesperson) will respond within one business day.
US (us-west-2, us-east-1), EU (eu-central-1, eu-west-1), and APAC (ap-northeast-1) are all available. The region is selected at tenant creation and pinned for the lifetime of the account — cross-region replication is disabled by default and never enabled without a written change request. Air-gapped deployments keep all data on customer infrastructure with zero egress.
Yes. Our standard BAA covers managed-cloud and on-prem HIPAA workloads and is counter-signed within five business days. It includes the 24-hour breach notification window, the right to audit, and downstream subprocessor flow-down. A redlined copy is available on request from [email protected].
Both are supported. BYOK integrates with AWS KMS, Google Cloud KMS, Azure Key Vault, or HashiCorp Vault in the customer's environment. HYOK is available on the Enterprise tier — FGCV never sees plaintext keys, and key revocation causes immediate cryptographic erasure of all tenant data without a code deploy.
NCC Group conducts an annual black-box web/API/network test and a semi-annual internal-network test against the managed cloud. Most recent cycle: 2024-Q4 (no Critical or High findings open). Executive summary is shared under NDA within two business days of a signed request.
Confirmed security incidents affecting customer data trigger notification to the customer's designated security contact within 24 hours, with a written incident report within 72 hours. Regulators and affected data subjects are notified per the customer's instruction and the applicable law (GDPR, HIPAA, state breach laws).
Email [email protected] from a corporate domain with your company name and reviewer name. We counter-sign a mutual NDA and deliver the documents via a secure portal within two business days. Reports are refreshed annually and bridge letters are issued for the gap between report cycles.
Our security team responds within one business day. No sales routing, no qualification form.
