Skip to main content
Trust Center

What is public, what is project-specific and what needs independent validation.

The Trust Center gives buyers clear verification boundaries. It does not replace a contract, DPA, security assessment, regulatory decision or current certification document.

Ask a trust or security question Read the Privacy Notice
Transparency

Claim status

This website does not claim PCI DSS certification, cloud or payment-network partnership, authority to issue insurance, a universal SLA or identical infrastructure controls across every project. Any such scope needs a current document that matches the entity, service, environment and date.

Public information

What can be checked now

These links and explanations apply to the public website and published service boundaries.

Privacy and public forms

Forms warn against sending IDs, passports, passwords, OTPs, payment data or private customer information. Sensitive material uses a separate verified handoff.

Read the Privacy Notice

Consent-aware analytics

Analytics storage remains off until an explicit choice. Advertising storage, advertising user data and ad personalization remain denied.

Service boundaries

Licensing, worker and allocation pages state who decides, what Fixosoft provides and what remains with the client or authority.

Project-specific

Controls that belong in the contract and architecture

Do not assume the same hosting, retention or service level applies to every system.

Access, encryption and auditability

Authentication, authorization, encryption, secrets, logging and review controls are defined for the system’s data, providers and risk.

Hosting and subprocessors

Infrastructure providers, processing regions, responsibility boundaries and subprocessors belong in the relevant project documents.

Backup, monitoring and recovery

Frequency, retention, restore tests, alerts, support hours and recovery objectives are agreed for the scope.

Incident handling

Escalation routes, owners, records, notices and recovery actions belong in the operating plan for the system.

Regulated claims

PCI DSS and insurance—precise wording only

Engineering support is not certification, and preparing information for an insurer is not issuing a policy.

PCI DSS

Fixosoft can support architecture, readiness, hardening and control implementation. Only a valid, properly scoped AOC can support a certification claim for the entity, service and environment it names.

Tech E&O / Cyber Liability

Fixosoft does not claim authority on this website to issue insurance. Where relevant, it may help compile technical information for a customer’s discussion with an appropriately licensed professional. The authorized provider decides availability, terms and issuance.

Financial licensing

Fixosoft may support license-fit research and application-material preparation. Client-appointed qualified legal and compliance professionals lead advice, submission, representation and regulator engagement; the regulator decides.

Responsible reporting

Report a security concern

Send a high-level description, affected page, reproduction steps and likely impact to webmaster@fixosoft.com. Do not send credentials, keys, production data, personal data or customer documents, and do not test exploitation against a live system without explicit authorization.

What to include

Affected URL, short description, reproduction steps, test date and time, and potential impact.

What not to include

Passwords, OTPs, keys, payment details, personal information, customer files or data obtained through unauthorized access.

Vendor due diligence

Checklist for a private due-diligence pack

Sensitive evidence is not published on this website. During procurement, every item should be marked available, not applicable or pending, with an owner and current review date.

  • Full legal entity and company or business number; current registration certificate.
  • Current tax-withholding and bookkeeping certificates; bank-account ownership certificate.
  • Verified ownership, directors and signing authority.
  • Professional indemnity and Cyber Liability evidence when applicable, including insured party, dates and scope.
  • PCI DSS AOC only when applicable, with entity, service, environment, dates and assessor.
  • Security architecture summary; business-continuity and disaster-recovery plan.
  • DPA, subprocessors, and hosting or processing regions.
  • Three current references and two comparable projects, with consent.
  • Proposed team and CVs, SLA and response times.
  • Source-code ownership, licensing, third-party dependencies and handover terms.
  • Redacted penetration-test or security-review summary.
  • Exit, transition, data-export and knowledge-handover procedure.

A missing document is not replaced with marketing copy. It is marked not applicable or pending, with an explanation and owner.

The Trust Center received a substantive review on 19 August 2026.

Next step

Need an answer for vendor review?

Send the checklist without confidential material. Fixosoft can map what is public, what requires an NDA and what depends on project scope.

Contact about trust