Effective date: March, 2020
ISO 27001 is the globally accepted standard for assessing the life cycle of an organization’s security practices. It is a rigorous assessment of both risk, compliance, and governance that verifies that an organization has a mature, well-managed approach to information security. Framer has achieved ISO 27001 compliance. You can download our ISO 27001 certificate here. A copy of the Statement of Applicability is available to Enterprise customers upon request.
SOC 2 is a globally recognized auditing standard for service organizations that demonstrates adequate controls and processes. Forethought has successfully completed the SOC 2 Type 1 audit in the end of 2019, with the SOC 2 Type 2 audit to be completed at the end of 2020. Forethought’s SOC 2 report covers the trust services principles and criteria security and availability. A copy of the most recent audit report is available to Enterprise customers upon request.
Forethought is committed to ensuring that all our customer and employee personal data are treated in a way that complies with the EU’s General Data Protection Regulation (GDPR). Forethought applies these rights globally to all our customers, not just to the EU customers.
The California Consumer Privacy Act (“CCPA”) regulates how organizations handle the personal information of Californian residents and gives them certain rights with respect to their personal information. Forethought is committed to be compliant with the CCPA. As a provider of enterprise design tools, Framer is primarily a service provider under the CCPA.
Forethought is certified under the EU-U.S. and Swiss-U.S. Privacy Shield as administered by the U.S. Department of Commerce. This certifications confirms that we comply with the Privacy Shield principles for the transfer of EU and Swiss personal data to the United States. Our Privacy Shield certification is available here.
All of FOrethought’s services are hosted in Amazon Web Services (AWS) facilities in the United States. Services are distributed across multiple AWS availability zones. These zones are hosted in physically separate data centers, protecting services against single data center failures.
You can find more information about AWS security practices on their cloud security page.
Forethought classifies the data they own, use, create, and maintain into the following categories:
Confidential - Customer and personal data
Internal - Framer-internal operational data that should not be disclosed
Public - For example, the marketing material and content on this website
Encryption at rest
Framer uses the AWS-managed data stores Aurora, DynamoDB, ElastiCache, and S3 to store customer data, including backups. All these AWS services have been configured to use encryption at rest using AES with 256-bit keys.
Forethought uses AWS Parameter Store for securely storing and managing secrets that are used by services. Forethought uses AWS Key Management Service (KMS) to encrypt and decrypt these secrets as well as manage all encryption keys in use by Framer services. Access to secrets and encryption keys are restricted to the services on a need-to-know basis and are managed by the Forethought infrastructure team.
Forethought fully separates and isolates their production, staging, and development networks and environments.
Forethought practices continuous delivery. We have processes and automation in place that allow us to safely and reliably roll out changes to our cloud infrastructure and web-based applications in a rapid fashion. We deploy new changes to production dozens of times a day.
All code changes are requested through pull requests and are subjected to code reviews and approval prior to being merged to the master and production branches.
Framer uses Snyk to automatically scan each code change set (pull requests) for security vulnerabilities and automatically opens new pull requests to upgrade or patch vulnerable dependencies.
Framer uses WhiteSource Renovate to automatically create pull requests to update outdated dependencies.
Framer uses static source code analysis tools like Code Climate to analyze any source code changes in order to identify any potential code quality issues or security weaknesses.
Framer uses Sentry to track errors in the web and desktop applications.
Framer’s security team works closely with the engineering teams to resolve any potential security concerns that may arise during design or development.
In addition to our internal security scanning and testing program, Forethought employs third-party firms to conduct extensive penetration tests on a regular basis. Findings from these penetration tests are prioritized, triaged, and remediated by the Forethought security team.
Forethought operates a private security bug bounty program with Bugcrowd that allows security researchers around the world to continuously test the security of Framer’s applications and services. Security engineers who identify valid issues are paid via the program. If you would like to be invited into our bug bounty program, please report a security vulnerability by following our vulnerability disclosure guidelines as outlined below. Based on that we will consider inviting you into our program, which will be determined at our discretion.
Forethought requires the use of TLS to secure the transport of data, both on the internal network between services as well as the public network between the Forethought applications and the Forethought cloud infrastructure. Forethought’s TLS configuration requires at least TLS version 1.2 and the use of strong cipher suites, which supports important security features such as Forward Secrecy. To defend against downgrade attacks Forethought has implemented HTTP Strict Transport Security, and has all their production domain names included on the HSTS Preload List.
Forethought only exposes public (web) applications and APIs to the public internet. All other services are only available on the internal network, and accessible by employees using a VPN or single sign-on proxy. The external attack surface is monitored for changes by a third-party service.
Network segmentation is a foundational aspect of Framer’s cloud security strategy. Framer achieves segmentation boundaries at various layers of their cloud infrastructure. Framer uses a multi-account strategy within AWS to isolate production, development, and test environments, but also domains such as logging, security, and marketing. Within AWS, Framer uses VPCs, security groups, network access control lists, and subnets to further isolate services.
Framer maintains an extensive centralized logging environment in which network, host, and application logs are collected at a central location. Framer has also enabled detailed audit trails with critical service providers like Google G Suite, GitHub, and AWS (CloudTrail). These logs and audit trails are analyzed by automated systems for security events, anomalous activity, and undesired behavior. These systems will generate events which are monitored around the clock by a security operations center (SOC).
All new hires are required to attend the security awareness training as part of their on-boarding. And all employees are required to attend the annual security awareness training. Framer engineers are required to attend an annual security training designed specifically for engineers.
Framer maintains an accurate and up-to-date inventory of all its networks, services, servers, and employee devices.
Access to customer data Access to Framer customer data is provided on an explicit need-to-know basis and follows the principle of least privilege. Customer data is audited and monitored by the security team. Framer support and customer employees are only granted access after explicit approval of the respective customer. All Framer employees have signed a non-disclosure agreement.
The security team at Framer aggregates logs and audit trails from various sources at a central location and uses tools to analyze, monitor and flag anomalous or suspicious activity. Framer’s internal processes define how alerts are triaged, investigated, and, if needed, escalated. Both customers and non-customers are encouraged to disclose any potential security weaknesses or suspected incidents to Framer Security.
In case of a serious security incident, Framer the security expertise to investigate security incidents and resolving them to closure. If needed, Framer has also access to external subject matter experts.
Framer maintains a number of information security policies that form the basis of our information security program. All Framer employees are required to review these policies as part of their on-boarding. These security policies cover the following topics and are available to Enterprise customers upon request:
- Access control
- Change management
- Risk management
- Data classification and asset inventory management
- Incident response and management
- Network security
- Encryption and key management
- Human resources security
- Information transfer
- Secure development
- System monitoring and logging
- Vendor management
- Vulnerability management and malware protection
- Mobile device management and remote working
- Business continuity and disaster recovery
All Framer customer data is stored redundantly at multiple AWS data centers (availability zones) to ensure availability. Framer has well-tested backup and restoration procedures in place, which allow for quick recovery in the case of single data center failures and disasters. Customer data is continuously backed up and stored off-site. The restoration of backups are fully tested every 30 days to ensure that our processes and tools work as expected.
Framer exclusively uses Apple MacBook devices. These devices are all centrally managed through the Jamf Pro mobile device management solution, which allow us to enforce security settings such as full disk encryption, network and application firewall, automatic updates, screen time-outs, and anti-malware solutions. In case employee devices get stolen or lost, data on these devices can be remotely wiped.
Framer performs a periodic risk analysis and assessment to ensure that our information security policies and practices meet the requirements and applicable regulatory obligations.
Framer Enterprise includes all our general security measures, plus additional features and enhancements to provide even more customization and privacy.
Framer supports single sign-on (SSO) for Enterprise customers. By using the customer’s existing identity management solution, Framer provides an easy and secure way for companies to manage their team members’ access. Framer supports identity providers like Google G Suite, Azure Active Directory, OneLogin, and Okta. Framer also supports both SAML and OAuth-based OpenID Connect.
Framer supports role-based access control, which means the access of team members within an organization are dictated by their role (viewer, collaborator, editor, or administrator). Administrators can assign team members specific roles or revoke access using the Framer account dashboard.
If you would like to disclose a potential security vulnerability or have security concerns about a Framer product, please reach out to firstname.lastname@example.org. Please include a description of the security vulnerability, steps to reproduce, and the impact the vulnerability may have.
You may encrypt your messages using our PGP public key.