Security Overview
Finger is the leading All-in-One BusiFness Software platform specializing in collaborative work management and business process automation. Our Mission is to help business owners around the world achieve #SuiteFreedom by leveraging the power of systems, processes & automations!

We are dedicated to making Finger the most secure and reliable collaborative work management and business process automation platform on the market. We are committed to protecting your personal and company data and ensuring secure collaboration within our platform, which is why we have always, and continue to invest in the security of our services not only to meet but exceed industry standards.

Uptime Over 99.9%
Over years of continuous service, Finger has consistently met or exceeded a 99.9% uptime, ensuring you, your Staff and your Clients can access your Organization’s Portal when needed, without interruption. Current uptime status and a history for the last 90 days can always be accessed at https://www.fingertrading.com/

Physical Security
Data Center Details
Finger is powered by the industry standard Amazon AWS technology stack. This means your data is safely stored in ‘best in class’ data centers around the globe every day. Data center locations are carefully selected to mitigate environmental risks, such as flooding, extreme weather, and seismic activity. Data centers are designed to anticipate and tolerate failure while maintaining service levels. In case of failure, automated processes move traffic away from the affected area. Core applications are deployed to an N+1 standard, so that in the event of a data center failure, there is sufficient capacity to enable traffic to be load-balanced to the remaining sites.

Keycard protocols, biometric scanning protocols, and round-the-clock interior and exterior surveillance monitor access to every one of our data centers.
Every data center employee undergoes multiple and thorough background security checks before they’re hired.
Only authorized data center personnel are granted access credentials to our data centers. Any employee or contractor who needs data center access must first apply for access and provide a valid business justification. These requests are granted based on the principle of least privilege, where requests must specify to which layer of the data center the individual needs access and are time-bound. Requests are reviewed and approved by authorized personnel, and access is revoked after the requested time expires. Once granted admittance, individuals are restricted to areas specified in their permissions. Any contractors approved for access are granted visitor badge access, must present identification when arriving on site, and are signed in and escorted by authorized staff.
Physical access points to server rooms are recorded by Closed Circuit Television Camera (CCTV). Images are retained according to legal and compliance requirements. Physical access is controlled at building ingress points by professional security staff utilizing surveillance, detection systems, and other electronic means. Authorized staff utilizes multi-factor authentication mechanisms to access data centers. Entrances to server rooms are secured with devices that sound alarms to initiate an incident response if the door is forced or held open.
Electronic intrusion detection systems are installed within the data layer to monitor, detect, and automatically alert appropriate personnel of security incidents. Ingress and egress points to server rooms are secured with devices that require each individual to provide multi-factor authentication before granting entry or exit. These devices will sound alarms if the door is forced open without authentication or held open. Door alarming devices are also configured to detect instances where an individual exits or enters a data layer without providing multi-factor authentication.
Data center electrical power systems are designed to be fully redundant and maintainable without impact on operations, 24 hours a day. Data centers are equipped with back-up power supplies to ensure power is available to maintain operations in the event of an electrical failure for critical and essential loads in the facility.
Data centers use mechanisms to control climate and maintain an appropriate operating temperature for servers and other hardware to prevent overheating and reduce the possibility of service outages. Personnel and systems monitor and control temperature and humidity at appropriate levels.
Data centers are equipped with automatic fire detection and suppression equipment. Fire detection systems utilize smoke detection sensors within networking, mechanical, and infrastructure spaces. These areas are also protected by suppression systems.
Third-party testing ensures appropriately implemented security measures are aligned to established rules needed to obtain security and privacy certifications. Depending on the compliance program and its requirements, external auditors may perform testing of media disposal, review security camera footage, observe entrances and hallways throughout a data center, test electronic access control devices, and examine data center equipment.
Continuous Data Backup
Finger’s data backup model provides near real-time database replication to ensure customer data is both backed up and available on redundant and geographically dispersed servers. Full backups are performed many times daily and are stored encrypted in an environment physically separated from the primary servers to ensure fault tolerance.

Network and System Security
Tenable Network Security Infrastructure
Finger uses industry-standard network protection procedures, including network segregation using VLAN’s, firewall and router technologies, intrusion detection and prevention systems, centralized log aggregation, and alert mechanisms. These procedures are used in conjunction with secure connectivity, including secure channels and multi-factors for authorized systems operations group personnel. This allows us to prevent, detect, and promptly remediate the impact of malicious traffic and network attacks.

Regular Updates and Patch Management
Ongoing internal network security audits and scanning gives us an overview for quick identification of impacted systems and services. According to our in-house patch management policy, operating systems, software, frameworks, and libraries used in Finger infrastructure are updated to the latest versions on a regular basis. Whenever a vulnerability in a product used by Finger or a high or critical vulnerability is publicly reported, prompt actions are taken to mitigate any potential risks for our customers — we apply hotfixes and patches promptly when available and/or implement pro-active mechanisms like configuration of firewalls or IDS/IPS.

System Integrity Protection
Finger uses operating system-based and automated integrity check services to ensure the integrity of all critical files and system objects. A quick response to any potential unauthorized changes to the system helps ensure our customers are exposed only to Finger.

Application Security
Your Data & Files are Encrypted
Finger uses Transport Layer Security (TLS) 1.2 with a preferred AES 256 bit algorithm in CBC mode and 2048-bit server key length with industry-leading modern browsers. When you access Finger via web browser or via the PWA mobile application, TLS technology protects your information using both server authentication and data encryption. This is equivalent to network security methods used in banking and leading e-commerce sites.

All data is encrypted while in transit and at rest. A variety of security layers are in place to prevent unauthorized access to the underlying data, including IP-restricted access and intrusion-resistant firewall prevented access. All databases are required to accept only encrypted connections from pre-defined data sources.

User files uploaded to Finger’s servers via both web application and API are automatically encrypted with AES 256 using per-file keys. If someone were to gain physical access to the file storage, this data would be encrypted and impossible to read directly. These encryption keys are stored in a secure key vault, which is a separate database decoupled from the file storage layer.

All user passwords are validated against password policies and stored securely using a strong hashing algorithm with a unique salt for every password. All users’ passwords, cookies, and sensitive information are reliably protected from eavesdropping.

Application Security Protocols
An in-depth Application Security Lifecycle process is fully integrated into Finger’s Software Development Lifecycle (SDLC), including:

Defined in-house security requirements, policies, and industry security best practices applied in every stage of the lifecycle.
Ongoing security review of architectures, design features, and solutions.
Iterative manual and automated (using static code analyzers) source code review for security weaknesses, vulnerabilities, and code quality, plus development team advisory and guidance.
Regular manual assessment and dynamic scanning of pre-production environment.
Security trainings conducted for IT teams according to their respective job roles.
User Authentication
Each user in Finger has a unique, password-protected account with a verified email address. The password is validated against password policies and stored securely using a strong hashing algorithm with a unique salt for every password. In addition, 2-Factor Authentication is available as an added security measure to protect Finger accounts. Finger also offers advanced security settings that allow customers to manage Password Security Policy. More details can be found in our Help Section.

The Finger Help Team is always happy to assist you with any Finger-related issues. If troubleshooting or diagnosing an issue requires the Help Team to access your account, that permission can be granted only by you. Detailed logs are recorded each time the Help Team accesses your account in this way – these logs are routinely reviewed. This systemic approach lets us provide world-class support and ensures additional confidentiality for your data stored in Finger.

If you or one of your users loses access to the Finger platform due to failure to pass 2-Factor Authentication, we are able to help restore access, but there will be a specific set of security procedures that must be completed. We enforce these policies to protect against social engineering and malicious actors.

Data Sharing and Role-Based Access Control
In each individual Finger account, an appropriate administrator/staff member manages and controls individual user rights by granting specific Roles, Circles and/or Custom Menu visibility.

Customer data, including Messages, Dashboards, Pages, Projects/Tasks and Files/Folders, can only be accessed by other users within your Finger account if those items were specifically shared with them, or if the items were placed in Shared Folders.

Incident management and disaster recovery
We practice regular recovery drills where we test diverse disaster and failure scenarios. We perform hourly backups of all databases, and files are backed up automatically after they are uploaded to Finger. Our backups are tested on a regular basis and are stored off-site for a maximum of 30 days. We have procedures for responding to incidents managed by our dedicated Operations and Security, Infrastructure and DevOps teams. In the event of an incident, we will contact you within 24 hours and offer the best possible options for moving forward.

Data Deletion
All your content will be inaccessible immediately upon cancellation. If 180 days have passed after your cancellation date, all your content will be permanently deleted from all servers and logs. This information can not be recovered once it has been permanently deleted. Additionally, all data will be permanently deleted from backups if 180 days have passed after your cancellation date.

Privacy and Compliance
GDPR Compliance
We are an Active Participant in the Data Privacy Framework Program managed by the International Trade Administration and the US Department of Commerce. For customers who request it, we have a Data Processing Addendum that outlines the obligations Finger has in its role as a provider of the Finger Service to our customers. This may include obligations related to the General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR). More information can be found on the GDPR Commitment page.

HIPAA Compliance
The Health Insurance Portability and Accountability Act provides security provisions and data protection for safeguarding medical information. If Finger processes Protected Health Information (PHI) on behalf of either a Covered Entity or a Business Associate (both known as “roles” under HIPAA), then Finger has a Business Associate Agreement that meets industry standards and requirements as well as the HIPAA Security Rule. More information can be found on our Finger and HIPAA page.

PCI/DDS Compliance
PCI stands for the Payment Card Industry. The major payment card brands Visa, MasterCard, American Express, Discover Financial Services, and JCB International established the Payment Card Industry Data Security Standard (PCI DSS) to help merchants prevent payment card data theft.

The Finger platform undergoes continual assessment and scanning by Finger, a world-class data & privacy security firm. The current certification status can be found HERE

Privacy Policy
The Finger Privacy Policy has been carefully cultivated to address your privacy concerns and your rights with regard to your personal data.

Constant Monitoring
Internal Systems & Processes
We have an internally built system that monitors and automatically blocks suspicious activity (including vulnerability scanning, failed logins, and a host of other suspicious activity). We also have alerts in place for excessive resource use that escalates to our DevOps team for manual investigation.

We have a team dedicated to maintaining your account’s security on our platform and monitoring tools we’ve set up to alert us to any nefarious activity against our domains. To date, we’ve never had a data breach.

We also log and audit internal data access. If a Finger employee wrongly accesses customer data, they will face penalties ranging from termination to prosecution. Again, to our knowledge, this hasn’t happened.

We have processes and defenses in place to keep our streak of 0 data breaches going. But in the unfortunate circumstances someone malicious does successfully mount an attack, we will immediately notify all affected customers.

Law Enforcement
Our Commitment to Due Process
Finger won’t hand your data over to law enforcement unless a court order says we have to. We flat-out reject requests from local and federal law enforcement when they seek data without a court order. And unless we’re legally prevented from it, we’ll always inform you when we receive such requests.

Your transactions with Finger
All credit card transactions are processed using secure encryption—the same level of encryption used by leading banks. Card information is securely transmitted one time to a 3rd party payment gateway, which then stores the card information & returns to us only an identifying hash (ID number) that we store. No payment information or credit card numbers are ever stored on Finger’s servers. The Finger platform is fully PCI/DDS Compliant, as audited and confirmed by SecurityMetrics, a world leader in data security and compliance.

Want to know more?
Contact Us with additional questions or if you need more details.

Have a concern? Need to report an incident?
Have you noticed abuse, misuse, an exploit, or experienced an incident with your account? Please Contact Us for details on how to securely submit a report.