Security and Data Protection
Our certifications, encryption practices, hosting infrastructure, and how we handle your data.
ForezynPlan is built with security as a foundational principle. The platform uses a dedicated Forezynplan.Crypto module for all encryption operations.
Encryption at rest
Financial model data is encrypted using symmetric AES encryption (Forezynplan.Crypto). Plan encryption keys are managed per-sharing context — when a plan is shared or ownership is transferred, encryption keys are re-issued. User key encryption protects individual account data. RSA crypto services handle asymmetric operations for key exchange.
Encryption in transit
All data transmitted between your browser and ForezynPlan servers is encrypted using TLS. HTTPS is enforced on all endpoints. SignalR WebSocket connections for real-time collaboration are also encrypted in transit.
Infrastructure
ForezynPlan runs on Microsoft Azure. Data is stored across Azure SQL Server databases (6 schemas: live, billing, balancer, auth, archive, tools), Azure Blob Storage (plan JSON backups, reports, integration sync state, company logos), and Azure Queue Storage (async processing). Redis Cache provides high-speed caching with TTL.
Authentication security
IdentityServer3 issues reference tokens (stateful, server-validated) rather than self-contained JWTs. Tokens are introspected on every API request. OAuth tokens for integrations (Xero, Crunch, QuickBooks) are stored securely and refreshed automatically.
Access controls
ForezynPlan enforces layered access: license-based feature gating, organisation-level roles, and plan-level permissions. All access changes are written to the audit log. Plan ownership transfers include automatic right reapplication and encryption key rotation.
Observability
Security monitoring includes Application Insights (Azure), NLog with Elasticsearch targets, Sentry for frontend error tracking, Elastic APM for performance monitoring, and conversation/activity ID tracing across all services. JSNLog captures client-side errors.
GDPR / CCPA
ForezynPlan is compliant with GDPR (EU) and CCPA (California). You can request a data export or account deletion at any time. See forezynplan.com/privacy for our full Privacy Policy.