Fastio's assessments and frameworks, and every security measure in place today, in one place. For how these controls work day to day, see Security. Questions for your review go to security@fast.io.
What independent parties have assessed and verified, and the laws and frameworks our security program follows.
Independently validated under Google's Cloud Application Security Assessment (CASA), at Assurance Level 1 (AL1).
CASA is the App Defense Alliance framework Google uses to vet apps that access sensitive user data. It is built on the OWASP Application Security Verification Standard (ASVS) and assesses the application itself.
Fastio's Microsoft 365 integration is published under a Microsoft verified publisher identity.
Publisher verification means Microsoft has confirmed the identity of the organization that publishes the app.
Application security validated against the OWASP Application Security Verification Standard through Google CASA.
Fastio is GDPR-aligned, with defined deletion windows, encryption, role-based access, legal holds, and self-service closure of accounts and organizations.
For customer data, Fastio acts as a service provider and does not sell or share personal information. Our marketing website uses advertising cookies, which visitors can opt out of. Personal information is deleted on verified request, subject to legal exceptions.
Payments are processed by Stripe, a PCI DSS Level 1 service provider, on a Stripe-hosted checkout. Fastio never stores, processes, or transmits card data.
Our security program is mapped to the NIST Cybersecurity Framework 2.0.
NIST AI RMF and EU AI Act transparency
AI governance aligned with the NIST AI Risk Management Framework. AI features are clearly disclosed.
ESIGN, UETA, and eIDAS
Fastio e-signatures are designed to meet ESIGN and UETA requirements, and are Simple Electronic Signatures under eIDAS. Each signing keeps an audit trail.
Security depends on the whole stack, not just our code. Here is where your data is stored, what stands in front of it, and where AI runs.
Fastio owns and operates its own servers and network, in long-term leased space at a data center provider that holds SOC 2 Type II, ISO/IEC 27001, and PCI DSS certifications.
A global edge network with a web application firewall and DDoS mitigation sits in front of every request.
AI processing and search embeddings run with the AI providers listed on the subprocessors page, and none of them trains on customer data.
These commitments are not settings you have to find and switch on. They are how Fastio works.
Your files, conversations, and metadata are never used to train AI models, ours or anyone else's. Our AI model providers don't train on customer data either.
Your files and account data are never sold to advertisers, data brokers, or anyone else. We protect them from those who would, and keep it simple for you to download and share your files.
Your content is never handed to third parties for their own use. The subprocessors on our published list process data only to operate Fastio for you.
Fastio's AI reaches only the files the person or agent using it can already open.
The controls in place today, by area. Those marked Enterprise come with the Enterprise plan; the rest are on every plan.
Grace period before deleted data is purged
The team behind Fastio has spent 20 years building, operating, and securing cloud storage, and Fastio's security model is built on that experience.
Founded 2006, The Woodlands, Texas 
Cloud storage and file sharing, since 2006 More than 100 million registered MediaFire users 
Fastio
AI project workspaces 2024 launched VividEngine products are used by teams at companies like these
No. Your files, conversations, and metadata are never used to train AI models, ours or anyone else's. Our AI model providers, listed on the subprocessors page, don't train on customer data either.
Yes. All customer data is encrypted at rest with AES-256, and all connections to Fastio are encrypted with TLS.
We are actively preparing for a SOC 2 Type II audit and are in the process of engaging an auditor. Fastio is validated under Google CASA at Assurance Level 1 today, and our data center provider holds SOC 2 Type II.
The Cloud Application Security Assessment is the App Defense Alliance framework Google uses to vet apps that access sensitive user data. Built on the OWASP Application Security Verification Standard (ASVS), it assesses the application itself. Fastio is validated at Assurance Level 1 (AL1).
Fastio is GDPR-aligned, with defined deletion windows, encryption, role-based access, legal holds, and self-service closure of accounts and organizations. Our standard Data Processing Agreement is published for review and is executed with Enterprise Plus customers and customers with a separately signed agreement on request, and our list of subprocessors is published on this site.
Deleted data is permanently purged after a grace period: 15 days for shares, 30 days for workspaces, 60 days for organizations, and 90 days for user accounts. An organization with a billing subscription history (including a trial) is kept for 180 days, and so are its shares and workspaces. An organization that Fast closes because a subscription was never started is purged after 7 days, along with its shares and workspaces. A user account that owns an organization still awaiting deletion is not purged until that organization is. That covers file storage, search indexes, AI indexes, and metadata. Some data is kept longer: data under a legal hold, until the hold is released; e-signature envelopes and their records, for up to seven years; billing and tax records, as the law requires; usage records, for up to 120 days; activity history and audit records, as needed for security, audit, and legal purposes; backups, which contain account and file metadata but not file contents, for no longer than one year and restored only for disaster recovery; and copies held by Sub-processors, which are deleted on their own schedules. Our Data Deletion Policy has the details.
Yes, on Enterprise plans: SAML 2.0 or OpenID Connect, with SCIM 2.0 provisioning, DNS-verified domains, and optional SSO enforcement. Two-factor authentication with an authenticator app is available on every plan.
On Enterprise plans, Fastio alerts you to sign-ins from new countries, unusual download or deletion activity, and newly created credentials. Each alert is emailed to your owner and admins, and by default to your compliance auditors, and is written to the audit log.
Email security@fast.io. For a walkthrough of workspaces, permissions, and the audit log, book a demo with our team.
Yes, further detail on our controls and architecture is available under NDA for your security review. Tell us what your review needs at fast.io/contact, or email security@fast.io.
Email security@fast.io with your questions, or book a demo to walk through workspaces, permissions, and the audit log with our team.
