Security

FDI Connect handles confidential economic-development data — pre-announcement project enquiries, deal metadata, and organisational contacts. This page describes the controls that protect it, written for the IT and procurement teams who need to evaluate us. If you need this in questionnaire form, email us and we will complete your assessment documentation.

Last updated: 5 October 2026

1. Overview

Security on FDI Connect is enforced at the database layer, not just in application code. Every table carries row-level security policies, privileged fields are protected by database triggers, and the platform is built exclusively on infrastructure providers that hold current SOC 2 Type II attestations. FDI Connect itself is an early-stage platform and does not yet hold its own SOC 2 attestation; the controls below describe our actual posture today, and we are happy to walk your IT team through any of them.

2. Infrastructure & hosting

The platform runs entirely on audited, enterprise-grade providers:

  • Application hosting: Vercel (SOC 2 Type II, ISO 27001) — serverless Next.js with automatic TLS.
  • Database & authentication: Supabase (SOC 2 Type II, HIPAA-capable) running managed Postgres on AWS, Europe (Ireland) region.
  • Payments: Stripe (PCI DSS Level 1 — the highest certification level).
  • Bot protection & edge security: Cloudflare (SOC 2 Type II, ISO 27001).
  • Mapping: Mapbox (SOC 2 Type II).

No production servers are self-managed; patching of operating systems and database engines is handled by these providers under their audited programmes.

3. Access control

  • Row-level security on every table. Access rules are enforced inside Postgres itself, so they apply to every query path — there is no route to data that bypasses them.
  • Role-based access. Each account holds a verified role (EDA, government department, investor, site selector, developer, broker, infrastructure) and sees only the workflows and data appropriate to it.
  • Organisation-level permissions. Organisation admins control what their staff can publish, see, and respond to.
  • Trigger-protected privileged fields. Subscription tier and verification status cannot be modified by any user session — they are changed only by server-side processes with service credentials (for example, the Stripe billing webhook).
  • Least-privilege API keys. Public clients use anonymous keys constrained by row-level security; service credentials never leave server environments.

4. Authentication

  • Managed authentication via Supabase Auth with mandatory email confirmation.
  • Cloudflare Turnstile bot protection on registration, login, and password-reset forms, enforced server-side at the authentication endpoint.
  • Passwords are hashed and managed by the authentication provider; FDI Connect never stores or sees them.
  • Identity verification badges are backed by government-ID checks through Stripe Identity — not self-claimed.

5. Data protection

  • Encryption in transit: TLS on every connection — browser to platform, platform to database, and all third-party calls.
  • Encryption at rest: database storage and file storage are encrypted at rest by the hosting providers (AES-256).
  • Confidential enquiries: investor-to-EDA enquiries and direct messages are scoped by row-level security to their participants. Pre-announcement project details are visible only to the parties involved.
  • Data rights: retention, deletion, and subject-access handling are described in our Privacy Policy, which covers UK/EU GDPR and US/California rights.

6. Payments

Card data never touches FDI Connect servers. Checkout and subscription management happen on Stripe-hosted pages, and the platform receives only signed webhook confirmations. Invoice and purchase-order billing is available on Enterprise/State agreements.

7. Backups & reliability

  • Automated daily database backups with managed retention, operated by Supabase.
  • Write-ahead-log archiving is enabled on the production database.
  • Static assets and application code are versioned and instantly re-deployable via Vercel.

8. Reporting & contact

If you believe you have found a security vulnerability, email support@fdi-connect.com with the details and we will respond promptly. Please do not test against production data belonging to other users.

Government IT or procurement team? We will complete your security questionnaire and provide supporting documentation — contact sales@fdi-connect.com.