Security

Security is not an afterthought at Consumer Fusion, it is embedded in how we build, deploy, and operate our platform. We handle sensitive business data for multi-location brands and enterprise clients, and we take that responsibility seriously.

Our security program is aligned with industry best practices and independently verified through third-party audits.

Consumer Fusion is SOC 2 Type II certified, audited and verified by an independent third-party auditor. This certification covers the Trust Services Criteria for Security, Availability, and Confidentiality, and requires us to demonstrate that our controls have been operating effectively over a period of time, not just at a point in time.

Our certification is maintained through Thoropass and is renewed on an annual basis. Customers under a signed NDA may request a copy of our SOC 2 report by contacting security@consumerfusion.com.

All data transmitted between your browser or application and our servers is encrypted in transit using TLS 1.2 or higher. Sensitive data stored in our systems is encrypted at rest using AES-256.

Database backups are encrypted, and encryption keys are managed using industry-standard key management practices with regular rotation policies.

Access to customer data is limited to Consumer Fusion personnel who need it to provide the Services. We enforce the principle of least privilege across all internal systems.

• Multi-factor authentication (MFA) is required for all internal systems and cloud infrastructure
• Role-based access control (RBAC) governs what each team member can access
• Access to production environments is logged and reviewed
• Employee access is provisioned on hire and de-provisioned promptly on departure
• Annual access reviews ensure permissions remain appropriate over time

Consumer Fusion's platform is hosted on enterprise-grade cloud infrastructure with the following protections in place:

• Infrastructure hosted on SOC 2 compliant cloud providers
• Network segmentation and private subnets for sensitive workloads
• Web application firewall (WAF) to filter malicious traffic
• DDoS protection and rate limiting on all public endpoints
• Continuous monitoring and alerting for anomalous activity
• Regular infrastructure vulnerability scans

Our software development lifecycle includes security at every stage:

• Security requirements are incorporated into product design
• Code is reviewed by peers before merging to production
• Automated static analysis (SAST) and dependency scanning run on every build
• Penetration testing is conducted at least annually by an independent third party
• Critical vulnerabilities are patched on an expedited timeline

Every Consumer Fusion employee undergoes background screening before joining. Security awareness training is required at onboarding and refreshed annually.

Employees with access to customer data are subject to confidentiality obligations. Our acceptable use policies govern how company devices and systems may be used.

Consumer Fusion maintains a documented incident response plan that is tested regularly. In the event of a confirmed security incident involving customer data, we will:

• Contain and investigate the incident promptly
• Notify affected customers within 72 hours of confirmed breach, consistent with applicable law
• Provide clear information about the nature of the incident and steps being taken
• Conduct a post-incident review to prevent recurrence

We maintain an ongoing vulnerability management program that includes continuous monitoring of our dependencies and infrastructure for known vulnerabilities, regular internal and external scanning, and an expedited patching process for critical and high-severity findings.

If you discover a potential security vulnerability in our platform, please report it responsibly to security@consumerfusion.com. We ask that you allow us reasonable time to investigate and address the issue before any public disclosure.

Consumer Fusion's security and privacy practices are designed to support compliance with:

• SOC 2 Type II (Security, Availability, Confidentiality)
• California Consumer Privacy Act (CCPA)
• General Data Protection Regulation (GDPR) where applicable
• CAN-SPAM and TCPA for communications

Clients requiring a Data Processing Agreement (DPA) for GDPR compliance may request one by contacting legal@consumerfusion.com.

For security questions, responsible disclosure, or to request our SOC 2 report:

• Email: security@consumerfusion.com