Security
Enterprise security. No enterprise price tag.
Your proposals contain sensitive pricing and client data. We treat that seriously. Here is how we protect it.
TLS encryption in transit
All data encrypted with TLS 1.3 between your browser and our servers. No exceptions.
Encryption at rest
Customer data is encrypted at rest by our infrastructure providers, with daily automated backups stored separately from the live database.
SSO (SAML and OIDC)
Enterprise single sign-on via SAML 2.0 or OpenID Connect. Enforce your identity provider across every seat.
MFA / 2FA
TOTP-based two-factor authentication with recovery codes. Available on all paid plans.
Audit log
Chain-hashed, tamper-evident audit trail. CSV export. Enterprise plans get full retention.
IP allowlisting
Restrict access to your Frameboard account from approved IP ranges only. Enterprise plan.
SCIM provisioning
Automated user provisioning and deprovisioning from your identity provider. Enterprise plan.
GDPR-ready
Signable Data Processing Agreement and subprocessor list available. Right to erasure with step-up verification. Full data export in machine-readable format. Cookieless analytics - the only cookies we set are strictly necessary for sign-in.
Content Security Policy
Strict CSP headers with nonce-based script execution. No inline event handlers. XSS protection at the edge.
Rate limiting
Adaptive rate limiting on all API endpoints. Brute-force protection on authentication.
Questions about security?
We are happy to discuss our security posture, provide our DPA, or answer questions from your InfoSec team.