Faros' commitment to data privacy and security is embedded in every part of our business. This page outlines the high-level details for several of the frameworks, regulations, and certifications that apply to our company and its products.
Please contact email@example.com with specific questions or requests.
Trust Center Updates
The Faros Infosec team implemented a WAF solution for Faros API. WAF provides an extra level of security which can help mitigate many common attacks.
Faros AI management is pleased to announce that Faros has successfully completed our SOC2 Type II audit for the one year period ending in July 2022. The auditors at Sensiba San Filippo, LLP (SSF) performed the audit and found no exceptions during their review of our controls. A copy of this report is available via our security portal.
The Faros Infosec team added static IPv4 addresses for Faros API (prod.api.faros.ai) - 126.96.36.199, 188.8.131.52. This allows restricting outgoing traffic by whitelisting these IP addresses in customer network. The whitelisting is an important part of networking security since it can significantly reduce the attack surface and risk associated with unauthorized access.
The Faros Infosec team implemented a WAF solution for Faros Application. WAF provides an extra level of security which can help mitigate many common attacks.
The Faros Infosec team has performed our periodic update of all system level packages. All Faros services are running with latest security patches.
The Faros Infosec team has evaluated our exposure to the Spring Framework Java framework remote code execution (RCE) vulnerability (CVE-2022-22965), also known as Spring4Shell. The vulnerability was disclosed on Tuesday, March 29, 2022.
We determined that none of our services were affected by the vulnerability.
The Faros Infosec team has evaluated our exposure to the Log4j Java library remote code execution (RCE) vulnerability (CVE-2021-44228), also known as Log4Shell. Log4j is a Java-based logging utility found in a wide number of software products. The vulnerability was disclosed by the Apache Log4j project on Thursday, December 9, 2021.
We immediately deployed recommended mitigations and began to roll out permanent remediation. As of December 10, 2021, remediation in our production environments was complete. There has been no member or customer impact.