Security / trust page — found from the homepage — Firefish

Cited by

Facts read from this source

• Cyber essentials Report an error

  “Firefish Software Ltd is compliant with the requirements of the Cyber Essentials Scheme and has been accredited with their certificate of assurance in relation to Data Security.”

• Cyber essentials certificate number Report an error

  “Our certificate number for the Cyber Essentials Scheme is e1d8895-568d-4d7a-9117-86294b777808.”

• Azure Report an error

  “At this time, all of our customer data is stored within the Microsoft Azure Platform.”

• Regions Report an error

  “All Firefish physical hardware will be located within secure Microsoft data centres at two locations within Europe. Our primary data centre is located in Microsoft’s West European centre (Netherlands) with a secondary centre in Microsoft’s North Europe region (Ireland).”

• Data processing third parties Report an error

  “Firefish does not pass data to any other third party for processing except when explicitly requested by the client, for example through a 3rd party integration with time sheeting software or for the migration of data from one system to another.”

• Azure standards Report an error

  “Azure also meets a broad set of international and industry-specific compliance standards such as ISO 27001, HIPAA, FedRAMP, SOC 1 and SOC 2 as well as country-specific standards such as Australia IRAP, UK G-Cloud and Singapore MTCS.”

• EU AI act Report an error

  “All AI features within Firefish are built by design to adhere to the requirements of the EU AI Act, ensuring transparency, user awareness, and human oversight are embedded from the outset.”

• Encryption in transit Report an error

  “All traffic is encrypted using HTTPS certificates: sha256RSA algorithm and 2048 Bit key over TLS 1.3 (with TLS 1.2 available as a fallback when 1.3 is not supported by the client).”

• Encryption at rest Report an error

  “Azure encrypts all data at rest using 256 bit AES-GCM encryption.”

• Penetration testing Report an error

  “Annually, we perform industry-leading third party security scanning and penetration audits on our external-facing infrastructure to determine any possible security threats.”

• MFA Report an error

  “Users log in to Firefish using a username and password and the application also has Multi Factor Authentication (MFA) as an enhanced security measure.”

• Password policy Report an error

  “Basic password security requires a minimum of 8 characters and can include symbols.”

• Enhanced password policy Report an error

  “Superusers can elect to enable enhanced password security. This provides optimal password security by stipulating that passwords must, in addition to the basic rules of 8 characters minimum, include 3 of the 4 following characters: uppercase, lowercase, number, symbol.”

• Remote access MFA Report an error

  “Remote desktop access to all of our servers is restricted to authorised individuals only and uses multi-factor authentication to ensure the highest level of security is maintained.”

• Status page Report an error

  “We provide a public operational service status page which documents our historical uptimes and provides information in the event of a service disruption.”

• Uptime monitoring Report an error

  “Uptime monitoring by a third party (Uptime robot) which notifies us when external services slow down or fail.”

• Background checks Report an error

  “All employees are also subject to a Disclosure Scotland criminal record check prior to employment commencing, with this being renewed every 4 years for those with access to sensitive data.”

• Backup frequency Report an error

  “A full database backup is performed once a week and before any system update”

• Incremental backup Report an error

  “We then perform an incremental backup three times weekly”

• Transaction backup Report an error

  “Finally, we perform transaction backups every 30 minutes throughout each day.”

• Backup retention Report an error

  “These backups are stored in such a way that they can provide a full backup for the previous 28 to 35 days dependant on the date the original data was backed up.”

• Replication Report an error

  “Three copies of the data are stored at each of the data centres at all times, meaning a minimum of six copies of all data will exist for the full 28-day period.”

• Import retention Report an error

  “we will retain the data after the import has been completed for 5 working days in the case of a standard bulk upload and 60 working days for data migrations.”

• Export retention Report an error

  “For exports from Firefish, the data is removed 5 working days from the date of export.”

• Transfer method Report an error

  “we provide a secure location for you to upload/download the data via a secure HTTPS/ SMB 3.0 Connection.”

• Data restore rto Report an error

  “we can restore a backup of the database and files directly from our internal backups and aim to do so within two-hours of receiving notification that the event has occurred.”

• Azure uptime SLA Report an error

  “the core Microsoft Azure Services are backed by a 99.9% uptime SLA.”

• Datacentre recovery time Report an error

  “In the highly unlikely event of the data centre not being recoverable, Firefish will recreate the servers in the secondary data centre, allowing normal service to be resumed. This process may take up to 48 hours.”

• VAT number Report an error

  “VAT Number: 984027013”

• Data transfer safeguards Report an error

  “appropriate safeguards in terms of Article 46 GDPR or UK GDPR (as appropriate) are in place, for example using appropriate Standard Contractual Clauses, or such other appropriate legal method of transfer.”

• Modules core Report an error

  “Core modules AI & Automation Business Development Analytics Search & Match Conversations Job Workflows”

• Modules addon Report an error

  “Add-on modules Websites Hiring Manager Portal Candidate Portal Marketplace”

• Documents available Report an error

  “Legal Trust & Data Security Terms of Service Privacy & Cookie Policy Data Processing Agreement Compliance Hub AI Policy”

• Specialties Report an error

  “Permanent Recruitment Contract Recruitment Temporary Recruitment Logistics Recruitment Tech Recruitment Construction Recruitment”

• API docs Report an error

  “API Documentation”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Data Protection Officer Retention, deletion & talent-pool consent
• The Data Protection Officer European sovereignty
• The Employer Branding Manager AI screening transparency & control
• The Employer Branding Manager European sovereignty
• The HR IT Integrator Retention, deletion & talent-pool consent
• The HR IT Integrator European sovereignty
• The Skeptic Retention, deletion & talent-pool consent
• The Skeptic European sovereignty
• The Talent Acquisition Lead Retention, deletion & talent-pool consent
• The Talent Acquisition Lead European sovereignty
• The Works Council Advocate European sovereignty