Security - Fishbowl Inventory

Security

At Fishbowl, protecting your data is a top priority. We continuously improve our security measures and maintain dedicated expertise across engineering, operations, incident response, compliance, and application security.

Data Encryption

All external and database connections use TLS 1.2+ encryption. Data at rest in AWS services and Fishbowl MySQL is encrypted with AES-256.

Penetration Testing

Fishbowl contracts twice-per-year security audits in the form of white-hat penetration tests, with regular SAST and DAST scanning.

Vulnerability Assessments

Regular automated vulnerability scanning and code analysis with SAST integration and OWASP-aligned review processes.

Security Training

Developer training focused on OWASP Top 10, secure coding practices, input validation, parameterized queries, and output encoding.

Incident Response

Documented incident response plan to handle security breaches promptly with clear stakeholder communication protocols.

Multi-factor Authentication

MFA codes via email with 6-digit codes that expire after 10 minutes. Configurable token frequency and required for API integrations.

Business Continuity

Customer data housed in U.S. data centers with live replication. Automatic rolling seven-day backups for point-in-time recovery.

Disaster Recovery

Live replication of all customer data between primary U.S. data centers with tested DR failover procedures.

SOC 2 Compliance

Fishbowl Inventory is SOC 2 Type II certified, with ISO and PCI compliance.

Privacy

Adherence to GDPR and CCPA practices. Data Privacy Agreements (DPAs) maintained with integration partners. PII secured based on CCPA standards.

Physical Infrastructure

Customer data housed in primary U.S. data centers with live replication between geographically distributed sites.

Vendor Risk Management

Key compliance frameworks applied for vendor evaluation with regular third-party security audits and penetration tests.

High Availability

24/7 oversight by a Security Operations Center with regular backups, managed updates, and defined maintenance windows.