Trust claims are limited to controls the product actually implements.
FPD does not claim SOC 2, FedRAMP, ISO 27001 or another certification it has not obtained. This page describes the current code and operational boundary so buyers can evaluate the beta on facts.
IMPLEMENTED CONTROLS
ACCOUNT CREDENTIALS
Passwords use scrypt with per-password random salts. Password changes and successful recovery revoke existing sessions.
TERMINAL LICENSING
Activation keys and terminal bearer tokens are hashed server-side. Windows credentials use Electron safeStorage and can be revoked per terminal.
SESSIONS
HttpOnly, SameSite=Lax cookies; Secure is required behind production HTTPS.
HTTP BOUNDARY
CSP, frame denial, content-type protection, referrer/permissions policy, HSTS and bounded rate limits.
BILLING
Stripe-hosted checkout/portal. Entitlements update from signed, idempotently processed webhooks when the live backend is deployed.
RELEASE INTEGRITY
Public version + SHA-256 metadata. Release readiness refuses to pass without a real x64 artifact URL/hash.