[{"data":1,"prerenderedAt":458},["ShallowReactive",2],{"platform-security":3},{"id":4,"title":5,"body":6,"description":12,"extension":451,"meta":452,"navigation":453,"path":454,"seo":455,"stem":456,"__hash__":457},"platformPages\u002Fplatform\u002Fsecurity.md","Security Statement - FlowFuse",{"type":7,"value":8,"toc":422},"minimark",[9,13,42,47,55,60,65,72,75,79,82,86,89,92,144,152,162,166,169,173,176,180,184,187,192,201,205,208,216,220,223,228,237,241,244,249,253,256,261,315,318,335,338,357,363,366,369,373,376,380,387,390,410,413,416,419],[10,11,12],"p",{},"Security aspects of FlowFuse are divided up into four sections;",[14,15,16,24,30,36],"ol",{},[17,18,19],"li",{},[20,21,23],"a",{"href":22},"#application","Application level",[17,25,26],{},[20,27,29],{"href":28},"#flowfuse-configuration","FlowFuse configuration",[17,31,32],{},[20,33,35],{"href":34},"#organization","Organization",[17,37,38],{},[20,39,41],{"href":40},"#gxp-readiness","GxP Readiness",[43,44,46],"h2",{"id":45},"application","Application",[10,48,49,50,54],{},"The FlowFuse platform architecture is described in our ",[20,51,53],{"href":52},"\u002Fdocs\u002Fcontribute\u002Farchitecture\u002F","documentation",".",[56,57,59],"h3",{"id":58},"users","Users",[61,62,64],"h4",{"id":63},"sessions","Sessions",[10,66,67,68,71],{},"Users are identified by an unique combination of username and password, or by a\nSAML compliant server for Single Sign-on (SSO) or LDAP. FlowFuse by default will",[69,70],"br",{},"\nclose active sessions after 14 days, or when user signs out.",[10,73,74],{},"Users can self-register on the platform, or if their SSO\u002FLDAP configuration allows, they\ncan be automatically registered on first login.",[61,76,78],{"id":77},"multi-factor-authentication","Multi-factor authentication",[10,80,81],{},"FlowFuse supports Multi-factor authentication (MFA), also known as 2-factor\nauthentication (2FA) for its users. They can configure this once they have registered\non the platform.",[61,83,85],{"id":84},"role-based-access-control","Role-Based Access Control",[10,87,88],{},"Within FlowFuse, users are organised within Teams. A user can be in multiple Teams.",[10,90,91],{},"Within the Team, a user will have a role to determine what they are able to do. The available roles are:",[93,94,95,108],"table",{},[96,97,98],"thead",{},[99,100,101,105],"tr",{},[102,103,104],"th",{},"Role",[102,106,107],{},"Description",[109,110,111,120,128,136],"tbody",{},[99,112,113,117],{},[114,115,116],"td",{},"Owner",[114,118,119],{},"Full access to the team. Create create\u002Fdelete resources and manage the billing settings",[99,121,122,125],{},[114,123,124],{},"Member",[114,126,127],{},"Can access and modify existing Node-RED instances",[99,129,130,133],{},[114,131,132],{},"Viewer",[114,134,135],{},"Has read-only access to the Node-RED instances - cannot modify anything",[99,137,138,141],{},[114,139,140],{},"Dashboard",[114,142,143],{},"Cannot access the Node-RED editor, but can access any Dashboard created within a Node-RED instance",[10,145,146,147,151],{},"Some users can also be granted ",[148,149,150],"code",{},"admin"," level access. This allows them to administer the overall FlowFuse platform.",[10,153,154,158,159,161],{},[155,156,157],"em",{},"FlowFuse Cloud",": Only FlowFuse employees have ",[148,160,150],{}," access to the platform, based on their role and business need to have that level of access.",[56,163,165],{"id":164},"audit-logs","Audit logs",[10,167,168],{},"FlowFuse features multiple layers of audit logging, both at the administrator level\nas well as at a team level. Audit logs are currently stored indefinitely.",[43,170,172],{"id":171},"flowfuse-configuration","FlowFuse Configuration",[10,174,175],{},"Configuration of the FlowFuse application influences security aspects of the\nsystem at large. For each section the implementation of FlowFuse Cloud is\nmentioned too. For self managed installs we advise to follow the choices made\nby FlowFuse Cloud.",[56,177,179],{"id":178},"data-storage","Data storage",[61,181,183],{"id":182},"data-at-rest","Data at Rest",[10,185,186],{},"All user data is stored in a relational database.",[10,188,189,191],{},[155,190,157],{},": Data is stored in a PostgreSQL database. All data is encrypted using the industry standard AES-256 encryption algorithm.",[10,193,194,196,197],{},[155,195,157],{},": All persistent users files are stored at rest in an Encrypted AWS EFS volume, using the AES-256 encryption algorithm. ",[20,198,200],{"href":199},"\u002Fchangelog\u002F2024\u002F07\u002Fpersistent-storage\u002F","Persistent Storage",[61,202,204],{"id":203},"data-residency","Data residency",[10,206,207],{},"Long term data storage is depended on the location of the relational database\nstorage.",[10,209,210,212,213,54],{},[155,211,157],{},": Data is stored in the European Union, specifically\nIreland, on AWS ",[148,214,215],{},"eu-west-1",[56,217,219],{"id":218},"data-in-transit","Data in Transit",[10,221,222],{},"Traffic from external sources to the FlowFuse application can be encrypted.\nWhen a load balancer is used, the encryption is terminated on the edge. Internal\ntraffic is not encrypted.",[10,224,225,227],{},[155,226,157],{},": Data in transit to and from external sources uses the latest recommended AWS Network Security policy. This enforces TLS1.2 as a minimum. Encryption is terminated at the edge, both for HTTP and MQTT traffic.",[10,229,230,231,54],{},"Adding internal SSL\u002FTLS is ",[20,232,236],{"href":233,"rel":234},"https:\u002F\u002Fgithub.com\u002FFlowFuse\u002Fflowfuse\u002Fissues\u002F910",[235],"nofollow","being investigated",[61,238,240],{"id":239},"inter-node-red-communication","Inter Node-RED communication",[10,242,243],{},"Communication between a team's instances is MQTT based. Traffic can be encrypted\nbased on the broker configuration.",[10,245,246,248],{},[155,247,157],{},": Inbound and outbound traffic is sent encrypted to\nFlowFuse. The encryption is terminated at the load balancer. Internal traffic\nis not encrypted.",[56,250,252],{"id":251},"service-endpoints","Service endpoints",[10,254,255],{},"It's recommended to run the FlowFuse application and the flow runtimes on\ndifferent domains. This will create separation of concerns and enhances security\nfor, among others, cookies.",[10,257,258,260],{},[155,259,157],{},": Our SaaS offering has multiple domains:",[93,262,263,273],{},[96,264,265],{},[99,266,267,270],{},[102,268,269],{},"domain",[102,271,272],{},"purpose",[109,274,275,285,295,305],{},[99,276,277,282],{},[114,278,279],{},[148,280,281],{},"app.flowfuse.com",[114,283,284],{},"The FlowFuse Cloud platform",[99,286,287,292],{},[114,288,289],{},[148,290,291],{},"mqtt.flowfuse.com",[114,293,294],{},"The MQTT endpoint for the platform - via secure WebSocket connection",[99,296,297,302],{},[114,298,299],{},[148,300,301],{},"*.flowfuse.cloud",[114,303,304],{},"The endpoints of individual Node-RED instances",[99,306,307,312],{},[114,308,309],{},[148,310,311],{},"*.flowforge.cloud",[114,313,314],{},"Older Node-RED instances may be served under this domain as they were created prior to the migration to the FlowFuse name",[10,316,317],{},"When running the FlowFuse Device Agent on a user's own hardware and network, it will require access to the following domains to be fully operational:",[319,320,321,325,329],"ul",{},[17,322,323],{},[148,324,281],{},[17,326,327],{},[148,328,291],{},[17,330,331,334],{},[148,332,333],{},"registry.npmjs.org"," - to enable installing of Node-RED modules",[10,336,337],{},"When running the Node-RED editor on a user's own network, it will require access to the following domains to be fully operational:",[319,339,340,344,348,352],{},[17,341,342],{},[148,343,281],{},[17,345,346],{},[148,347,291],{},[17,349,350],{},[148,351,301],{},[17,353,354],{},[148,355,356],{},"catalogue.nodered.org",[10,358,359,360,54],{},"Outbound connections from Node-RED instances running within FlowFuse Cloud will always come from the IP address ",[148,361,362],{},"63.33.85.112",[43,364,35],{"id":365},"organization",[10,367,368],{},"Keeping our customer's data secure is dependant on our internal practises too.",[56,370,372],{"id":371},"certifications","Certifications",[10,374,375],{},"FlowFuse obtained the SOC 2 Type 1 and Type 2 certification, audited by Advantage Partners.",[56,377,379],{"id":378},"security-governance","Security Governance",[10,381,382,383,54],{},"FlowFuse has information and data policies, the full list can be found in ",[20,384,386],{"href":385},"\u002Fhandbook\u002Fcompany\u002Fsecurity\u002F","our handbook",[10,388,389],{},"Most notably for (prospective) customers assessing FlowFuse:",[14,391,392,398,404],{},[17,393,394],{},[20,395,397],{"href":396},"\u002Fhandbook\u002Fcompany\u002Fsecurity\u002Finformation-security\u002F","Information Security Policy and Acceptable Use Policy",[17,399,400],{},[20,401,403],{"href":402},"\u002Fhandbook\u002Fcompany\u002Fsecurity\u002Fdata-management\u002F","Data Management Policy",[17,405,406],{},[20,407,409],{"href":408},"\u002Fhandbook\u002Fcompany\u002Fsecurity\u002Fhuman-resources\u002F#information-security-awareness-education-training","Information security awareness training",[43,411,41],{"id":412},"gxp-readiness",[10,414,415],{},"FlowFuse is built with enterprise-grade architecture and controls that support deployment in regulated environments.",[10,417,418],{},"Features such as role-based access control, audit logging of flow changes and user actions, versioning and snapshotting of Node-RED instances, configuration via infrastructure-as-code and containerized deployments, and integration with SSO\u002FLDAP align with many of the security, traceability and change-control expectations found in GxP systems (e.g., FDA 21 CFR Part 11, EU GMP Annex 11).",[10,420,421],{},"FlowFuse itself is designed to be validation-ready: we provide the necessary architecture, documentation, and controls to enable our customers to perform their own validation and supplier qualification in accordance with their GxP obligations.",{"title":423,"searchDepth":424,"depth":424,"links":425},"",4,[426,436,446,450],{"id":45,"depth":427,"text":46,"children":428},2,[429,435],{"id":58,"depth":430,"text":59,"children":431},3,[432,433,434],{"id":63,"depth":424,"text":64},{"id":77,"depth":424,"text":78},{"id":84,"depth":424,"text":85},{"id":164,"depth":430,"text":165},{"id":171,"depth":427,"text":172,"children":437},[438,442,445],{"id":178,"depth":430,"text":179,"children":439},[440,441],{"id":182,"depth":424,"text":183},{"id":203,"depth":424,"text":204},{"id":218,"depth":430,"text":219,"children":443},[444],{"id":239,"depth":424,"text":240},{"id":251,"depth":430,"text":252},{"id":365,"depth":427,"text":35,"children":447},[448,449],{"id":371,"depth":430,"text":372},{"id":378,"depth":430,"text":379},{"id":412,"depth":427,"text":41},"md",{},true,"\u002Fplatform\u002Fsecurity",{"title":5,"description":12},"platform\u002Fsecurity","Oanfu9narqUEx-6PRqGXFIDPQ1DE6R_c9bgKkWaTST0",1790367317177]