Compliance and Certifications

Compliance & Certifications

Article Type: Reference Audience: All Users, IT/Security Teams, Auditors Module: Platform / Security & Compliance

MFGx maintains a formal security and compliance program for the Fuuz Industrial Operations Platform, covering SOC 2, FDA 21 CFR Part 11, FedRAMP, and the major privacy regulations. This page summarizes the platform's compliance posture and how to request audit documentation.

SOC 2

MFGx holds a SOC 2 Type 2 certification (Security and Availability trust services criteria) with an unqualified opinion, renewed annually by an independent third-party auditor. SOC 2 Type 1 and Type 2 reports are available under NDA — submit a support ticket or contact your account representative to arrange access.

The Fuuz platform runs on the AWS Cloud — AWS data centers hold and process all Fuuz platform data under a shared security responsibility model. AWS maintains its own SOC 2, ISO 27001, and FedRAMP certifications; for details on AWS's posture, see the AWS SOC FAQs.

FDA 21 CFR Part 11 (Electronic Records & Electronic Signatures)

The Fuuz platform is compliant with 21 CFR Part 11 when configured for FDA-regulated environments. This includes:

• Electronic signatures with identity verification
• Comprehensive audit trails on records and changes (see Data-Change-History)
• Validation documentation to support customer validation activities
• Electronic Batch Records (EBR) and Device History Records (DHR) capabilities for life sciences and medical device manufacturing

As of June 2026, MFGx is actively working toward full certification of the platform.

FedRAMP

FedRAMP authorization is a mutual compliance process rather than a unilateral vendor certification. For customers with federal requirements, MFGx uses the Fuuz In-House Edition and works directly with the client to build FedRAMP compliance around their deployment — pairing the client's authorization boundary and agency requirements with the platform's controls. The underlying AWS infrastructure is FedRAMP certified.

If you have FedRAMP requirements, contact your account representative to scope an In-House Edition engagement.

Additional Standards & Regulations

Standard	Status	Notes
ISO 27001	Aligned	Information security management practices
TISAX	Aligned	Automotive industry security requirements
NIST CSF	Aligned	Identify, Protect, Detect, Respond, Recover
GDPR	Compliant	EU; DPAs available, EU data residency supported, 72-hour breach notification
CCPA / CPRA	Compliant	California; Fuuz does not sell customer data
PIPL	Compliant	China Personal Information Protection Law
HIPAA	Available	Requires a Business Associate Agreement (BAA)
PCI DSS	Compliant	Via payment processor integration; Fuuz does not store cardholder data

Data is encrypted with AES-256 at rest and TLS 1.2+ in transit.

Requesting Compliance Documentation

Submit a support ticket to request SOC 2 reports, DPAs, BAAs, or validation documentation; NDA paperwork will be provided where required.

Note: The original KB article includes two downloadable attachments (AWS SOC 2 Report and SOC 2 Privacy Report). Download these files from the original article.

See Also

• Service-Level-Agreement-SLA
• Backup-Policy-and-Service
• Authentication-Events
• Data-Change-History
• Enterprise-Admin-Overview

---

Source: support.fuuz.com