Security Overview

1. Our Security Commitment

At FurnViz, security is a foundational commitment. We understand that our customers entrust us with sensitive business assets — architectural floor plans, product catalogs, client project data — and we take that responsibility seriously. This Security Overview describes the controls, practices, and processes we maintain to protect the confidentiality, integrity, and availability of your data.

2. Infrastructure Security

FurnViz is hosted on enterprise-grade cloud infrastructure provided by leading cloud service providers operating physically secured, ISO 27001-certified data centers. Key infrastructure security controls include:

• Physical security: Data centers feature multi-layered physical access controls including biometric authentication, 24/7 on-site security personnel, CCTV surveillance, and man-trap entry systems.
• Geographic redundancy: Data is replicated across multiple geographic availability zones to ensure resilience against data center-level failures.
• Network segmentation: Production environments are logically isolated from development, staging, and corporate networks using separate VPCs and strict network access control lists (ACLs).

3. Data Encryption

• Encryption at rest: All customer data stored on FurnViz infrastructure is encrypted using AES-256. Database backups are also encrypted at rest.
• Encryption in transit: All data transmitted between your browser or API client and FurnViz servers is protected using TLS 1.3. Older, weaker protocols (TLS 1.0, TLS 1.1, SSL) are disabled at our load balancers.
• Key management: Encryption keys are managed using hardware security modules (HSMs) or equivalent managed key management services, with strict key rotation policies.

4. Access Control

• Role-based access control (RBAC): Access to the FurnViz platform is governed by RBAC. Each User is assigned a role (e.g., Admin, Designer, Viewer) with predefined permissions scoped to the minimum necessary for their function (principle of least privilege).
• Multi-factor authentication (MFA): MFA is available for all FurnViz customer accounts and is enforced for all FurnViz internal engineering and operations personnel.
• Single Sign-On (SSO): Network-tier customers can enable SSO integration using SAML 2.0 or OIDC-compatible identity providers (e.g., Azure AD, Okta, Google Workspace).
• Audit logging: All significant platform events — login attempts, permission changes, data exports, and administrative actions — are logged with timestamps, User IDs, and IP addresses. Logs are retained for 12 months.

5. Network Security

• Firewalls and network ACLs: All traffic to and from FurnViz services passes through stateful firewall rules and network access control lists.
• DDoS mitigation: FurnViz employs cloud-native and third-party DDoS mitigation solutions to detect and absorb volumetric attack traffic at the network edge.
• Web Application Firewall (WAF): A WAF is deployed in front of all public-facing application endpoints to detect and block OWASP Top 10 threats including SQL injection and cross-site scripting (XSS).

6. Application Security

• Secure Development Lifecycle (SDL): Security is integrated throughout our software development process. Our engineers follow OWASP secure coding guidelines.
• Dependency management: Automated dependency scanning tools identify and remediate known vulnerabilities in third-party libraries on a continuous basis.
• Code review: All code changes undergo peer review before merging. Security-sensitive changes receive additional review from our security team.
• Secrets management: API keys, passwords, and other secrets are never hardcoded in source code.

7. Vulnerability Management

• Penetration testing: FurnViz conducts regular internal security assessments and engages independent third-party security firms to perform penetration tests at least annually.
• Vulnerability scanning: Automated vulnerability scanners run continuously across our infrastructure and application layers.
• Bug bounty program: We are actively developing a formal bug bounty program. In the interim, we welcome reports at [email protected].

8. Incident Response

FurnViz maintains a documented Security Incident Response Plan (SIRP). In the event of a personal data breach, affected customers will be notified within 72 hours of FurnViz becoming aware of the breach, in accordance with GDPR Article 33 and the Egyptian PDPL. Every significant incident is followed by a formal post-mortem to identify lessons learned and implement improvements.

9. Employee Security

• Background checks: All employees and contractors with access to production systems undergo background screening prior to onboarding, in accordance with applicable Egyptian law.
• Security training: All employees complete mandatory security awareness training upon joining and annually thereafter.
• Access deprovisioning: Employee access to all systems is revoked promptly upon termination or role change.

10. Business Continuity and Disaster Recovery

• Daily backups: Customer data is backed up daily with automated verification of backup integrity.
• Geographic distribution: Backups are stored in geographically separate locations from primary data.
• Recovery objectives: Target RPO: less than 24 hours. Target RTO: less than 4 hours. These targets are tested through periodic disaster recovery drills.

11. Responsible Disclosure

If you believe you have discovered a security vulnerability in the FurnViz platform or website, please report it responsibly to [email protected] before public disclosure. Include a detailed description of the issue, steps to reproduce, and your assessment of the potential impact. We commit to: acknowledging your report within 2 business days; keeping you informed of our investigation; remediating confirmed vulnerabilities on a timeline proportional to their severity; and not taking legal action against researchers who act in good faith.