SOC certified and data privacy forward

Built for privacy and security

We focus on helping clients manage sensitive data and documents out of legacy systems, and we take trust seriously by providing features and functions that help clients be proactive about constantly shifting global privacy compliance laws. Those features, from PII identification to retention tagging and purging, are described on the compliance page. This page covers how the platform itself is protected.

Ongoing third-party SOC monitoring

Fuse partners with Thoropass, an external platform and auditor, to implement and monitor ongoing changes to maintain SOC compliance as the business and our clients evolve. Thoropass maintains active monitoring of cloud resources in real time.

Third-party security scans and monitoring

Fuse partners with Gartner-recognized industry leader Veracode to build and enforce continuous secure-coding practices, scans and penetration-testing standards for products and services. Fuse Analytics is listed in the Veracode Verified directory at the Verified Standard tier.

Powered by AWS

The Fuse platform is cloud-hosted on AWS, which gives it:

• Global reach
• High scalability
• Cross-region redundancy
• Enterprise security

Multi-factor authentication

Every Fuse Analytics user can require a second factor at sign-in from their own profile, using an authenticator app on their phone. The same multi-factor authentication protects the self-service portal that former employees use to exercise their data subject rights. See how to enable multi-factor authentication for the steps.

Why the archive matters for security

Legacy HR systems and outdated employee portals are often the weak points an attacker looks for, and personal data, unlike a card number, cannot be changed after a breach. Moving that history out of a system kept alive only for its records, or out of an improvised database, and into one platform with SOC monitoring, secure-coding scans and multi-factor authentication shrinks the exposure. That is the security case for archiving a retired UKG, ADP, Workday, SAP or Dayforce system rather than leaving it running for the records it holds.