Skip to main content
Support Fusion

Security at Support Fusion

Support Fusion is ISO 27001 certified. For IT service providers working with regulated enterprise clients, security posture is part of every procurement conversation. Ours is independently audited and continuously monitored.

How we protect your data

Security built into the platform from the ground up, not bolted on after the fact.

No credential storage

Credentials are never hardcoded or stored in the application database. All secrets are held in a dedicated secrets manager.

Data minimisation

The platform transmits only what is needed to sync tickets - using record IDs and metadata rather than raw ticket content.

Encrypted in transit and at rest

All data is encrypted via TLS in transit and encrypted at rest in storage. Data types are segregated across systems.

Continuous monitoring

Unusual activity is monitored continuously with detailed event logging across the platform.

Certifications

Independent verification that our security controls are real, not just documented.

ISO/IEC 27001

Information Security Management

Certified

Support Fusion is certified to ISO/IEC 27001, the international standard for information security management. The certification covers our risk management processes, security controls, and ongoing operational practices — independently audited and verified by an accredited body.

For enterprise procurement teams, we can provide our certificate and Statement of Applicability on request.

SOC 2 Type II

Service Organisation Controls

In progress

SOC 2 Type II certification is currently underway. The audit evaluates our security, availability, and confidentiality controls over a defined operating period. Completion is expected before the end of 2026.

If you have a procurement requirement that needs our current security posture in writing, get in touch and we can provide documentation.

Visit the Support Fusion Trust Center

Register for self-serve access to policy details, certifications, and compliance documentation. Need something specific? Submit a vendor security questionnaire directly through the portal.

Visit the Trust Center

Security questions

Do we need to create user accounts for our IT service providers in our ITSM?
No. IT service providers connect via their own Support Fusion account using a secure connection code. There are no external user accounts to create, no licences to assign, and no identities to manage or revoke in your ITSM.
Does Support Fusion store our ticket data?
No. Support Fusion processes ticket data in transit but does not retain it. We store only the record IDs and metadata needed to keep tickets linked between platforms. Raw ticket content is never persisted in our systems. Support Fusion is ISO 27001 certified, with customers in healthcare, finance, and retail.
What authentication method does Support Fusion use to connect to my ITSM?
Support Fusion connects using OAuth2 where the platform supports it - no passwords are stored, and access is granted through a secure OAuth flow that you authorise and can revoke at any time. Basic authentication is also supported for platforms that require it.
What permissions does Support Fusion need on our ITSM?
Support Fusion provides a configuration guide that sets out the recommended role and permissions. The guide covers all available modalities - if you only need incidents and not service requests, for example, you can scope the role accordingly. Enterprise environments typically create a dedicated integration service account with a custom role limited to what the integration actually requires. Our team is happy to work through the right permission set with your ITSM admin.
How does Support Fusion handle data security?
Support Fusion is ISO 27001 certified. All data is encrypted in transit via TLS and at rest in storage. Data types are segregated across systems, and continuous monitoring is in place with detailed event logging. Support Fusion is used in healthcare, finance, energy, and retail environments.
Is Support Fusion SOC 2 certified?
SOC 2 Type II certification is currently in progress and expected to complete before the end of 2026. Support Fusion is already ISO 27001 certified, which covers a comparable scope of security controls. If you have a procurement requirement in the meantime, get in touch and we can provide documentation on our current security posture.
Does Support Fusion support single sign-on?
Yes. Support Fusion supports Google and Microsoft Entra SSO. Enterprise teams can manage access through their existing identity provider, with MFA enforced across all accounts.
How does Support Fusion handle API credentials and secrets?
Support Fusion never hardcodes credentials or stores them in the application database. All secrets are held in a dedicated secrets manager with strictly controlled access.
What ticket data does Support Fusion actually transmit?
Support Fusion is built on a data minimisation principle. The platform transmits only the information required to keep records in sync - using record IDs and metadata rather than raw ticket content wherever possible, limiting exposure of sensitive data.
How is payment data protected?
Support Fusion does not handle payment card data directly. All payment processing is managed by Stripe and Chargebee, and transactions are referenced via tokenisation - cardholder data never enters the Support Fusion environment.
How does Support Fusion test for security vulnerabilities?
The engineering process follows a structured software development lifecycle with promotion gates and automated testing. Support Fusion also conducts static code analysis and regular penetration testing as ongoing security measures.
Who controls API keys and permissions in Support Fusion?
Each organisation manages its own API keys and permissions independently. Support Fusion does not have centralised control over your platform credentials - access is scoped entirely to your own configuration.
Where do I submit a vendor security questionnaire?
Vendor security questionnaires can be submitted directly through the Support Fusion Trust Center at trust.suppfusion.com. Register there for self-serve access to policy details, certifications, and compliance documentation alongside your questionnaire.

Have a specific security question?

An integration specialist will run the session, tailored to your platforms. We'll walk through how sync would work for your team and answer any questions along the way.

Get in touch