Security You Can Trust (and Audit).
Fullcast is architected for high availability, with infrastructure hosted across multiple cloud providers and designed for multi-availability zone resilience. Our infrastructure, application layer, and operational practices are designed to protect your revenue data at every level.
How Fullcast Protects Your Data
Fullcast’s security posture spans infrastructure, application, identity, and incident response. Every layer is designed to protect the operational data that drives your go-to-market execution.
Cloud Infrastructure
Fullcast’s infrastructure is primarily cloud-hosted and has been architected for high availability. Our systems operate across multiple availability zones for redundancy and are designed to support continuous uptime for your revenue-critical workflows. Additional details are available in our Trust Center.
3rd-Party Penetration Testing
We conduct annual third-party penetration tests covering both our application and cloud infrastructure. Executive summaries and detailed findings are available to prospects and customers under mutual NDA. Full documentation is available on our trust center.
Identity & Access Management
Fullcast supports Single Sign-On (SSO) via SAML 2.0 with identity providers including Okta. Google Workspace SSO is available for Fullcast Performance (formerly Atrium). SSO is SP-initiated where supported.
Incident Response
Fullcast maintains a documented incident response plan covering preparation, detection, analysis, containment, eradication, recovery, and post-incident review. In the event of a security incident, affected companies are notified in a timely manner consistent with contractual service levels. Where GDPR applies, the ICO is notified within 72 hours. All notifications include breach details and remediation actions taken. For additional detail, please refer to our Privacy Policy.
Read More About Our Privacy Policies
Compliancy at Fullcast
Fullcast maintains current SOC 2 Type II compliance through annual independent audits, with GDPR and CPRA compliance across the platform. Our trust portal at trust.fullcast.com gives prospects and customers on-demand access to audit reports and our published subprocessor list, with disaster recovery targets of a 4-hour RTO and 24-hour RPO.
Learn More
Governance at Fullcast
Fullcast provides granular role-based access controls, approval workflows, and comprehensive audit trails so your team stays in control of every change to your revenue operations. Audit logs capture configuration updates, employee data access, failed logins, and AI agent invocations, retained for up to 30 days with backups purged within 35 days.
Learn More
Privacy at Fullcast
Fullcast does not sell or disclose customer data beyond what is described in our Privacy Policy. Upon contract termination, data is processed for up to 35 days before purge. For non-U.S. customers, cross-border data transfers are governed by Standard Contractual Clauses included in our Data Protection Agreement, available on request, with privacy oversight from our CTO.
Learn MoreFrequently Asked Questions
What cloud provider hosts Fullcast?
Fullcast’s infrastructure is primarily cloud-hosted across leading providers, architected for high availability and multi-availability zone resilience. Specific infrastructure details are available in our Trust Center.
How often does Fullcast conduct penetration testing?
We conduct third-party penetration tests annually, covering both application and cloud infrastructure. Results can be shared with prospects under mutual NDA.
What SSO protocols does Fullcast support?
We support SAML 2.0 SSO via identity providers such as Okta. Google Workspace SSO is available for Atrium. All supported SSO configurations are SP-initiated.
Does Fullcast support SCIM for automated provisioning?
SCIM-based automated provisioning is not currently supported.
Does Fullcast have a documented incident response plan?
Yes. Our plan covers the full incident lifecycle from preparation through post-incident review. In the event of a security incident, affected companies are notified in a timely manner consistent with our contractual commitments. Where required by GDPR, the ICO is notified within 72 hours.
What security monitoring tools does Fullcast use?
Fullcast uses AWS GuardDuty, VPC security groups, intrusion detection systems, and centralized logging through Loggly, Vanta, and PagerDuty with SIEM capabilities for event management and auditing.
