Security page — Framer

Cited by

Facts read from this source

• ISO 27001 Report an error

  “Framer has achieved ISO 27001 compliance. The ISO 27001 certificate and statement of applicability are available to Enterprise customers upon request in our Trust Center.”

• SOC 2 type2 Report an error

  “Framer has successfully completed the SOC 2 Type 2 audit. Framer’s SOC 2 report covers the Security and Availability Trust Services Principles and Criteria.”

• GDPR commitment Report an error

  “Framer is committed to ensuring that all our customer and employee personal data are treated in a way that complies with the EU’s General Data Protection Regulation (GDPR).”

• CCPA Report an error

  “Framer is committed to be compliant with the CCPA. As a provider of enterprise design tools, Framer is primarily a service provider under the CCPA.”

• Aws US primary Report an error

  “All of Framer’s services are hosted in Amazon Web Services (AWS) facilities in the United States, with additional hosting infrastructure across Europe and Asia-Pacific, and global acceleration across 200+ edge locations via AWSCloudFront.”

• Encryption at rest Report an error

  “All these AWS services have been configured to use encryption at rest using AES with 256-bit keys.”

• Secrets management Report an error

  “Framer uses AWS Parameter Store for securely storing and managing secrets that are used by services. Framer uses AWS Key Management Service (KMS) to encrypt and decrypt these secrets as well as manage all encryption keys in use by Framer services.”

• Environment separation Report an error

  “Framer fully separates and isolates their production, staging, and development networks and environments.”

• Deployment frequency Report an error

  “We deploy new changes to production dozens of times a day.”

• Code review Report an error

  “All code changes are requested through pull requests and are subjected to code reviews and approval prior to being merged to the master and production branches. Framer uses GitHub Enterprise and Dependabot to automatically create pull requests to update outdated dependencies.”

• Static analysis and monitoring Report an error

  “Framer uses static source code analysis tools like Github Advanced Security and Detectify to analyze source code changes in order to identify potential code quality issues or security weaknesses. Framer uses Sentry to track errors in the web and desktop applications, and Panther detection rules, AWS CloudTrail, and Amazon CloudWatch for continuous monitoring and overview to our network and applications.”

• Penetration testing Report an error

  “Framer employs third-party firms to conduct extensive penetration tests of all application and cloud infrastructure on a regular basis.”

• Tls requirement Report an error

  “Framer’s TLS configuration requires at least TLS version 1.2 and the use of strong cipher suites, which supports important security features such as Forward Secrecy.”

• Hsts Report an error

  “Framer has implemented HTTP Strict Transport Security, and has all their production domain names included on the HSTS Preload List.”

• External attack surface Report an error

  “Framer only exposes public web applications and APIs to the public internet. All other services are only available on the internal network, and accessible by employees using a VPN or single sign-on proxy. The external attack surface is monitored for changes by a third-party service.”

• Network segmentation Report an error

  “Framer uses a multi-account strategy within AWS to isolate production, development, and test environments, but also domains such as logging, security, and marketing. Within AWS, Framer uses VPCs, security groups, network access control lists, and subnets to further isolate services.”

• Intrusion detection Report an error

  “These systems generate real-time alerts dispatched via PagerDuty and Slack to designated on-call engineering and security personnel for immediate triage.”

• Audit trails Report an error

  “Framer has also enabled detailed audit trails with critical service providers like Google Workspace, GitHub, and AWS CloudTrail.”

• Security training Report an error

  “All new hires are required to attend security awareness training as part of their onboarding. All employees are required to attend annual security awareness training. Framer engineers are required to attend annual security training designed specifically for engineers.”

• Incident management Report an error

  “Framer’s internal processes define how alerts are triaged, investigated, and, if needed, escalated. Both customers and non-customers are encouraged to disclose any potential security weaknesses or suspected incidents to Framer Security.”

• Security policies Report an error

  “Framer maintains a number of information security policies that form the basis of our information security program. All Framer employees are required to review these policies as part of their onboarding. These security policies cover the following topics and are available to Enterprise customers upon request”

• Endpoint security Report an error

  “Framer exclusively uses Apple MacBook devices. These devices are all centrally managed through the internal mobile device management solution with fleet-wide security enforcement and threat detection powered by Jamf Protect and Kolide, which allows us to enforce security settings such as full disk encryption, network and application firewall, automatic updates, screen time-outs, and anti-malware solutions. In case employee devices get stolen or lost, data on these devices can be remotely wiped.”

• Risk assessment Report an error

  “Framer performs a periodic risk analysis and assessment to ensure that our information security policies and practices meet the requirements and applicable regulatory obligations.”

• Rbac Report an error

  “Framer supports role-based access control, which means the access of team members within an organization is dictated by their role: viewer, collaborator, editor, or administrator.”

6 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Data Protection Officer Editor, templates & design control
• The Data Protection Officer Hosting, domains & portability
• The Data Protection Officer European sovereignty
• The Freelance Web Designer Hosting, domains & portability
• The Freelance Web Designer European sovereignty
• The Marketing Lead Editor, templates & design control
• The Marketing Lead Hosting, domains & portability
• The Marketing Lead European sovereignty
• The Practice Owner Hosting, domains & portability
• The Practice Owner European sovereignty
• The Skeptic Hosting, domains & portability
• The Skeptic European sovereignty
• The Small-Business Owner Hosting, domains & portability
• The Small-Business Owner European sovereignty