Is this your company? Buyers are checking Gofmx Inc here. Claim gofmx.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Gofmx Inc
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Gofmx Inc is SOC 2 Type II compliant.
About
FMX is a leading provider of Computerized Maintenance Management Systems (CMMS) that allows facilities, maintenance, and operations leaders to streamline their organizational processes, increase asset productivity, and track, manage, and improve the metrics that matter most to them. Our Software-as-a-Service (SaaS) solution has helped over 2,000 organizations optimize their operations and reach their goals. When it comes to site security, we've got you covered! Here at FMX, we know how busy your day-to-day operations can be, so we've made it our priority to make sure that you don't have to wor
Compliance & infrastructure
Hosting
AWSAzure
Data handled
Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPublic domain dataBasic personally identifiable information (name and email address)
Documents
9REPORTS
POLICIES
GENERAL
QUESTIONNAIRES
Subprocessors
23- MMicrosoft Azure · Cloud providerUnited States
- AAmazon Web Services · Cloud providerUnited States
- BBitbucket · MarketingUnited States
- AAzure DevOps · Version controlUnited States
- CCloudflare · Cloud provider
- CCloudways · Cloud provider
- DDealhub · SalesUnited States
- FFMX · Customer supportUnited States
- GGong · SalesUnited States
- GGoogle Ads · MarketingUnited States
- GGoogle Drive for desktop · Document management
- GGoogle Workspace · Other
Show all 23 subprocessorsShow fewer
- NNew Relic · Data analytics
- MMarketo · Marketing
- SSalesforce.com · Sales
- RRingCentral · Customer support
- SSlack · Collaboration
- ZZenDesk · Customer support
- ZZapier · Engineering
- VVanta · Security
- TTypeform · EngineeringUnited States
- TTwilio · Engineering
- UUserpilot · Data analytics
Compliance leadership
The person who leads Gofmx Inc's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Gofmx Inc's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Gofmx Inc SOC 2 compliant?
Gofmx Inc is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Gofmx Inc SOC 2 Type I or Type II?
Gofmx Inc is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Gofmx Inc's SOC 2 for a vendor risk assessment?
Yes. Gofmx Inc's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Gofmx Inc penetration tested?
Gofmx Inc hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Can I get Gofmx Inc's SOC 2 report?
Gofmx Inc's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Is Gofmx Inc secure?
Security isn't a single yes/no, but Gofmx Inc is SOC 2 Type II compliant and holds SOC 2 Type I, SOC 2 Type II. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Gofmx Inc have a bug bounty or vulnerability disclosure program?
Gofmx Inc hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@gofmx.com or via a /security page (Gofmx Inc lists a security contact).
Who are Gofmx Inc's subprocessors?
Gofmx Inc lists 23 subprocessors on its trust center, including Microsoft Azure, Amazon Web Services, Bitbucket, Azure DevOps, Cloudflare. Buyers use this for fourth-party risk review.
Where does Gofmx Inc host or store data?
Gofmx Inc hosts on AWS, Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Public domain data. Data residency details are on its trust center.
Where is Gofmx Inc's trust center or security page?
Gofmx Inc's trust center is at https://trust.gofmx.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Do you rely on one or more cloud service providers? If so, please confirm which controls are maintained by you and which controls are maintained by your management).
Yes, our cloud service provider, Microsoft Azure handles patch and log management for the network and operating system layers. We maintain control of patches and changes to the application as well as to our database service. We also use AWS for our email service, and maintain the same type of relationship.
Do you have a position or organization responsible for overseeing the company’s overall security program? If so, please describe the responsibilities of the position or organization.
Yes, this role is fulfilled by our Vice President of Engineering. Additionally, every FMX team member is tasked with protecting our customers’ data and privacy through proactive measures, fostering a security-aware company culture, and responding to security incidents immediately and with transparency.
Do you support Single Sign-On (SSO)?
We support the following single sign-on technologies: SAML2, WS-Federation, and OAuth for Google Apps.
Do you perform regular third-party penetration testing?
Yes, we perform a pentration test on an annual basis.
Do you perform security reviews of your application source code?
Yes, we incorporate a code review step into our normal development process for every significant code change. A component of this is validating adherence to web security best practices.
Do you enforce network segmentation between trusted and untrusted networks? (i.e., Internet, DMZ, Extranet, etc.)?
Yes, back-end servers are segmented from internet-facing servers using a firewall that blocks traffic with principle of least privilege. Back-end servers can only be accessed on limited ports from internet-facing servers and our company intranet.
What protocols will you use to protect application data in transit (e.g., TLS, SSL, SFTP, FTP/S)? Please provide technical details, including version information.
Data are transmitted over HTTP using TLS 1.2 and TLS 1.3.
If using encryption to protect data at rest and/or data in motion, please briefly describe your encryption key management processes.
SSL certificates, which encrypt data in motion, are stored in secure key management services including 1Password and Azure Key Vault. Access is restricted to several IT administrative employees.
Do you follow a formal software development process that includes application security requirements? Please explain.
Yes, our team has years of experience developing public-facing web applications that handle PHI, and stays current with web security best practices. We apply this knowledge when developing new features and use it to validate all code changes in the code review stage of our development process.
Do you purge application data according to a defined data retention schedule? Please explain
Not as long as a customer’s subscription remains active. However, we will purge data after a 730-day grace period following termination of a subscription. Customers and former customers may request their data be purged or retained before and after the end of our grace period, respectively.
How will you secure customer data in your backups?
Backups are stored encrypted at rest.
Please describe procedures in place to destroy and/or dispose of electronic media.
Electronic media destruction and disposal is handled by our Microsoft Azure, our cloud service provider, which complies with most rigorous security standards.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public