Built for regulated environments and security-conscious organisations

Yes. The EU's NIS2 Directive requires organisations in critical sectors to implement appropriate technical and organisational measures to manage cybersecurity risk, including controlling access to sensitive systems and demonstrating that identity is verified before privileged operations are performed.

FastPass IVM directly supports NIS2 compliance by enforcing a structured, auditable identity verification workflow at the help desk. Every verification attempt is logged with a full audit trail, verification policies are configurable and consistently enforced, and the system removes human discretion from sensitive access decisions. Contact us for a compliance mapping document.

Yes. FastPass IVM produces automatic and detailed audit logs for every verification attempt, including the method used, the outcome, and the timestamp — written directly into the ITSM ticket. This supports the access control and monitoring requirements that appear in SOC 2 Type II audits. FastPassCorp's cloud infrastructure is operated in alignment with SOC 2 principles.

FastPassCorp aligns its security practices, processes, and technology controls with the ISO/IEC 27001:2013 framework, as well as SOC 2, HIPAA, and the NIST Cybersecurity Framework. The FastPassCloud environment carries ISO 27001, 27017, and 27018 certification for the hosting infrastructure. Formal product-level third-party ISO certification is not currently in place, but SOC 2 certification is in progress. Customers requiring evidence of specific controls are encouraged to contact us — detailed documentation of security measures across applications, infrastructure, and operations is available.

Yes. FastPass IVM and SSPR has been penetration tested by Backbone Security Inc. The cloud operations hold Cyber Essentials Plus certification. FastPass also conducts weekly vulnerability scans across all production systems, applications, and servers, with additional scans following any significant changes to the environment. New vulnerabilities are classified by severity and likelihood of exploitation, and remediation is prioritised accordingly.

Yes. From version 4.0 onwards, FastPass is fully compliant with FIPS 140-2. Encryption uses a 256-bit AES algorithm and hashing uses PBKDF. Compliance covers all components including the Windows Client, the Password Interceptor and Filter, the server, and the domain controller components.

FastPass IVM is designed to operate in compliance with GDPR and CCPA requirements. All personnel supporting FastPass Cloud hold at minimum BPSS clearance and receive annual training on data protection and personal data best practices. Staff are required to sign NDAs and adhere to the Information Security Policy and Data Protection Policy, both of which are aligned with ISO 27001 and EU GDPR. FastPass also provides functionality to automatically delete user data when accounts are removed, disabled, or removed from authorised groups, ensuring data hygiene aligns with HR off-boarding processes.

In transit, all communications are encrypted using SSL and TLS, with TLS 1.2 required as a minimum for both cloud and on-prem operations. At rest, all sensitive data stored in the FastPass database is encrypted. FastPass supports multiple encryption models including Bring Your Own Key and Bring Your Own Encryption, and encryption keys can be assigned at the data-set level for granular control.