- AuditedSOC 1Type II
- AuditedSOC 2Type II
- GDPR
Security & Compliance
Fazeshift reads the email your remittance arrives in, signs into the portals your team already signs into, and posts entries back to your ERP. Here’s how that access is controlled.
This is what makes AR different from almost anything else you’ll buy. Remittance shows up in an inbox. The backup for a short pay sits behind a customer’s portal login. The open-invoice ledger lives in your ERP, and the cash lands at your bank. Every customer pays the way that works for them, so the work ends up spread across all of those places.
Any system that actually does it has to reach all of them, which makes three questions worth asking: what can it see, what can it do on its own, and who’s accountable. This page answers them in that order.
Independently audited
The reports are in our Trust Center, available for your team to review.
- AuditedSOC 1Type II
SOC 1 Type II
Because Fazeshift touches invoicing, cash application, and your ERP, our controls sit inside your financial reporting environment. SOC 1 Type II is the report your auditor will ask for, and we have it.
- AuditedSOC 2Type II
SOC 2 Type II
Controls for security, availability, and confidentiality, tested over a period rather than on a single day. Our auditor’s attestation letter is viewable on the Trust Center with no request; the full report is available to your team on request.
- GDPR
GDPR
GDPR compliant. It sets some of the strictest requirements in the world for how personal data is handled and what rights people hold over their own information — requirements Fazeshift’s controls satisfy in full.
- PCI
PCI
Card payments in the Customer Portal are handled by Stripe, which is certified to PCI Service Provider Level 1 — the most stringent level of certification in the payments industry. Fazeshift never stores raw card numbers at all.
What it can see, and how you authorize it
The agent reaches your inbox, your portals, and your ERP. Every one of those connections is authorized by you, from your own systems, and can be switched off the same way.
Your inbox, without a password
You approve the connection in your provider’s own admin console. We hold a token, never a password, and you can revoke it from your side at any time without involving us.
Portal sign-ins, when there’s no API
Those sign-in details are held per customer, isolated to your tenant, and used only for the AR work you’ve configured.
Your ERP stays the system of record
Your ledger stays where it is. The agent reads what it needs and writes back only the entries you authorized. Turn Fazeshift off and your records are exactly where they always were.
AI and your data
Not ours, not our providers’, not ever. Here’s what backs that up.
Fazeshift runs on models from OpenAI and Anthropic under zero-data-retention agreements. Those agreements bar training on your data and bar the provider from storing the inputs and outputs of our API calls. Your invoices, your customer emails, and your payment records stay yours.
Your data stays encrypted in your tenant for as long as you’re a customer. When you leave, it’s deleted under our retention and deletion policy, except where the law requires us to keep a record for longer.
Our active controls cover infrastructure, organizational, product, and internal security, and our SOC 2 Type II audit tests them over a period rather than on a single day. An executive summary of our third-party penetration test is in the Trust Center.
What it can do on its own, and who says so
The strongest control in an agentic product is the approval step, and you decide where it applies. A person stays in front of anything you’re not ready to hand over.
Review before it acts, for as long as you want
Keep a person reviewing replies for as long as you want, or turn on auto-send. You set it per scenario, not with one global switch.
AR InboxThe agent shows its work
When the agent escalates, it hands over what it found, what it recommends, and why. Your team approves a decision it can see in full.
Agentic AR PlatformEnterprise SSO
Enterprise SSO via SAML/OIDC, including Okta, Microsoft Entra ID, and Google Workspace. Your identity provider stays the front door.
Audit history
Every action and change is tracked, so a reviewer can reconstruct what happened to an invoice and who touched it.
Documentation
- SOC 1 Type II reportThe one your auditor will ask forOn request
- SOC 2 Type II attestation letterSigned by our auditorViewable now
- SOC 2 Type II reportSecurity, availability, confidentialityOn request
- Subprocessor listKept currentPublished
- Active controlsInfrastructure, organizational, product, internalPublished
For your security team
Our Trust Center hosts the SOC 1 Type II and SOC 2 Type II reports, an executive summary of our third-party penetration test, our subprocessor list, and our active controls across infrastructure, organizational, product, and internal security.
The SOC 2 attestation letter is viewable by anyone; the reports are available on request. If your review needs something that isn’t posted, ask and we’ll get it to you quickly.
Bring your security questionnaire
Send over your team’s security requirements and we’ll go through them with you.