Skip to content
FirstSI
Sign in Request a demo FR IT

Security & compliance

Security is not an afterthought.
It is at the heart of the platform.

Last updated: July 2026

FirstSI collects sensitive data about your information system: file access, network flows, DNS queries, software inventory. That responsibility drives every technical choice in the platform, from the encryption of secrets to the signing of updates.

Technical guarantees

auth

Strong authentication

Multi-factor authentication (MFA) and WebAuthn (hardware security keys and biometrics). Sessions expire after 15 minutes and renew automatically and transparently.

encryption

End-to-end encryption

TLS-encrypted transport between agents, server and your browser. Secrets (API keys, connection credentials) are encrypted at rest in the database.

audit

Complete audit trail

Every sign-in, every administrative action and every data access is logged: who, what, when, from which address. The log can be reviewed and exported at any time.

agents

Signed updates

Agents verify the Authenticode signature of every update before installing it. An unsigned or tampered update is rejected, no exceptions.

defence

Defence in depth

Rate limiting on sensitive endpoints, strict security headers, protection against malicious redirects and forged requests to the internal network (SSRF).

GDPR compliance

FirstSI is built for European organisations and implements the requirements of the General Data Protection Regulation:

  • Right of access and portability: one-click export of a user's personal data, in a structured, readable format.
  • Right to erasure: purge of personal data on request, including within event logs.
  • Data minimisation: you choose which modules are active and therefore what data is collected; nothing is collected beyond the configured scope.
  • Controlled retention: each organisation chooses how long its operational data is kept, from 1 to 365 days (90 by default), and switches on automatic purging; file and DNS events are archived before deletion.
  • Accountability: the audit trail documents who accessed which data, a key requirement in the event of a regulatory inspection.

For any question about data protection or to exercise your rights: contact@firstsi.com.

Hosting and resilience

  • Your data stays with you: FirstSI installs on your own infrastructure (on-premises) or with the hosting provider of your choice; you keep physical control of the data.
  • Outage tolerance: agents buffer data locally if the server is unreachable, then resynchronise automatically. No data lost during ordinary outages: local buffer of up to 256 MB per module.
  • Backups: documented backup and restore procedures, with automatic integrity checks.

Report a vulnerability

Found a security flaw in FirstSI? Write to contact@firstsi.com with the technical details. You will receive an acknowledgement, then updates on the fix. Researchers acting in good faith face no legal action.