Trust Centre FAQs

Is FMIS cloud-based or on-premise?

FMIS solutions can be delivered via secure UK-based cloud hosting or deployed on-premise. We support both models depending on client requirements. More information.

Is FMIS cloud hosting secure?

Yes. FMIS cloud hosting is designed with security built in at multiple levels, including infrastructure, access, and application controls. This includes encryption in transit and at rest, role-based access control, multi-factor authentication, continuous monitoring, and regular security testing as part of our ISO 27001-aligned ISMS. More information.

Where is FMIS hosted?

FMIS cloud solutions are hosted in the UK. Systems are accessed securely by organisations internationally, and we also support on-premise installations where required. More information.

Where is FMIS available?

FMIS is used by organisations in over 40 countries. Our flexible cloud-based platform allows users to access the system securely from any location, at any time, supporting distributed teams and multiple sites. More information.

Who owns the data?

All client data held within FMIS remains the property of the client. FMIS acts as a data processor, with the client retaining full control as the data controller. More information.

How is data protected?

Data is protected through encryption in transit and at rest, combined with controlled access, system monitoring, and secure application design. More information.

Do you use subprocessors?

FMIS minimises the use of subprocessors. Where third-party services are required, they are managed in line with defined security and data protection policies. More information.

Do you support multi-factor authentication (MFA)?

Yes. Multi-factor authentication is supported, alongside configurable password policies and role-based access controls. More information.

How is user access managed?

User access is managed within the system by client administrators. Access is controlled through role-based permissions, allowing users to be provisioned with specific rights based on their role, location, or responsibilities. More information.

Do you have SOC 2 certification?

FMIS does not currently hold SOC 2 certification. We are certified to ISO 27001, which underpins our approach to information security, and our controls align closely with the principles assessed under SOC 2. Further information can be provided on request. More information.

What security certifications does FMIS hold?

FMIS holds ISO 27001, ISO 9001, and Cyber Essentials Plus certifications. These are supported by regular audits and ongoing internal review. More information.

How is FMIS tested and reviewed for security?

FMIS operates an ongoing Information Security Management System (ISMS) that combines regular internal testing, external penetration testing, and independent audits. This includes continuous monitoring and vulnerability scanning, alongside annual infrastructure and application penetration testing. More information.

Do you carry out penetration testing?

Yes. FMIS carries out regular independent penetration testing as part of a wider security testing programme. External testing is conducted by CHECK or CREST-accredited providers and is complemented by internal testing, including automated scanning and code review. Findings are reviewed and addressed through defined processes, and confirmation of our most recent testing can be provided on request. More information.

What happens if there is a security incident?

Incidents are identified, logged, and managed through a structured process under our ISMS. Issues are escalated as appropriate in line with our disaster recovery and business continuity plans, with actions taken to contain, resolve, and prevent recurrence. Communication is managed in accordance with ISO 27001 processes and ICO guidelines. More information.

How do you ensure system availability?

System availability is supported through continuous monitoring, resilient infrastructure, and defined operational controls. This includes regular backups, redundant systems, and tested recovery processes to maintain service continuity. Business continuity and disaster recovery arrangements are in place to support restoration in the event of disruption. More information.

Can you support security audits or questionnaires?

Yes. FMIS regularly supports client security reviews, audits, and questionnaires. Additional documentation can be provided on request. More information.

Can we request security documentation?

Yes. Supporting documentation can be provided to assist with procurement and compliance reviews. Please contact us at privacy@fmis.co.uk, call +44 (0) 1227 773003, or use our contact page. More information.

Where can I find your privacy policy?

Our privacy policy is available here: Privacy policy. More information.

Where can I find your cookie policy?

Our cookie policy is available here: Cookie policy. More information.

Do you maintain other policies?

Yes. FMIS maintains a full range of policies covering key business areas, including information security, data protection, and operational processes, in line with ISO 27001 and other recognised industry standards. Additional information can be provided on request. More information.

Still have a question?

If you require further information or would like to discuss a specific requirement, please contact:

privacy@fmis.co.uk
Visit the Trust Centre.