Everything procurement, security, and legal teams need to evaluate Fotowall in one place. Documents below are kept current; if you need something not listed, email trust@fotowall.io.
Defense-in-depth on a hardened Google Cloud foundation. TLS in transit, KMS-managed at rest, App Check on public writes, audit logging on admin actions.
GDPR, UK GDPR, and U.S. state privacy compliance built in. Consent Mode v2 analytics, default-denied; self-service DSAR; configurable retention.
Standard SaaS DPA available on request, signed for Enterprise. SCCs incorporated for EEA/UK transfers. SOC 2 Type II audit planned.
WCAG 2.1 AA target, externally audited annually. Public statement with known limitations and remediation timelines.
Uptime targets, on-call coverage during contracted event windows, post-incident transparency.
Every legal and compliance document linked from one place. All are versioned with a last-updated date.
For RFPs and vendor reviews we can supply the following under NDA, typically within 2 business days:
Request access: trust@fotowall.io
Security researchers — thank you. Report suspected vulnerabilities to security@fotowall.io. We commit to acknowledge within 2 business days, respond substantively within 10 business days, and not pursue legal action against good-faith research that respects user privacy, avoids service disruption, and gives us a reasonable window to remediate before disclosure.
For procurement, security review, or custom legal terms (MSAs, BAAs once HIPAA support lands), our team is one email away.