Start free trial
Legal

Security & Trust Center

Last updated 29 October 2026 · 3 minute read

In short

  • All traffic is encrypted, and connection secrets are encrypted at rest.
  • The database itself keeps each client’s data apart.
  • What your team does in Formentic is logged and visible to your admins.
  • No SOC 2 or ISO 27001 certificate yet. Ask us where things stand.

Our approach

Security is core to how Formentic is built, not an afterthought layered on top. This page summarises the practices behind the Service in plain language. For the full technical detail, see the Enterprise Security Whitepaper. For our contractual security commitments, see the Terms and the Data Processing Agreement (DPA).

Data encryption

  • All traffic between you, the Service, and our infrastructure is encrypted in transit using TLS 1.2 or higher.
  • SFMC Installed Package credentials and other secrets are encrypted at rest.
  • User passwords are never stored in readable form — only as salted cryptographic hashes. Formentic staff cannot see your password.

Tenant isolation

Formentic is a multi-tenant platform: every client's data is logically separated using row-level security enforced by the database itself, not just by application code, so one client's session cannot reach another client's records.

Scoped SFMC access

We only ever request Data Extension, Documents and Images, Saved Content and Email read/write permissions on your SFMC Installed Package (and Journeys read, if you choose to grant it). Our systems only read, write to, and manage the folders, Data Extensions, content blocks, emails and images provisioned for you (the Provisioned Assets) and, for the emails you build with Formentic, the content blocks you include in them (read only) and the triggered sends that use them (on your instruction) — never any other asset in your SFMC account. See the Terms, Section 4, and the Customer Responsibility Matrix.

Access control and accountability

  • Access to production systems and customer credentials is limited to the personnel who need it to operate the Service.
  • Actions taken by your Users inside the Service are logged and visible to your account admins.
  • You control session duration and IP allowlisting for your own Users, and we recommend enabling both.

Availability and continuity

We aim for the uptime targets described in the Service Level Agreement, back up the systems we operate, and maintain a plan for restoring service after an incident. Data in your own SFMC account is never solely dependent on Formentic's availability — it remains in Salesforce's infrastructure, under your control.

Incident response

If we become aware of a security incident affecting your data, we investigate, contain it, and notify affected clients without undue delay — within 48 hours for a personal data breach — as described in the DPA.

Reporting a vulnerability

If you believe you've found a security issue in the Service, please tell us before disclosing it publicly. Email support@formentic.com with details; we will acknowledge your report and keep you updated as we investigate.

Certifications

Formentic is an early-stage platform. We do not yet hold formal third-party security certifications such as SOC 2 or ISO 27001. We are building our practices with those frameworks in mind and will update this page as our compliance program matures. If a specific certification or audit report is important to your organisation's approval process, contact support@formentic.com and we will let you know where things stand.

  • Data Processing Agreement (DPA)
  • Subprocessor List
  • Acceptable Use Policy
  • Service Level Agreement
  • Customer Responsibility Matrix
  • Enterprise Security Whitepaper
  • Security summary: one page for IT and security teams