Data & Compliance
Effective September 23, 2026
This page describes, in practical terms, where the information in fsg.supply and FSG OS lives, the controls that protect it, and how we handle email, incidents and data requests. It supplements our Privacy Policy.
Where data lives
FSG OS data is stored in a managed PostgreSQL database and file storage hosted by Supabase in the United States (AWS us-east-2). Both sites are hosted by Vercel. We use the following service providers:
| Provider | Purpose | Information involved |
|---|---|---|
| Supabase | Database, file storage and sign-in for FSG OS. Hosted in the United States (AWS us-east-2). | All FSG OS records and uploaded documents |
| Vercel | Hosting for fsg.supply and FSG OS | Requests to the sites, including IP address and browser details |
| Resend | Delivery of account, order and notification emails from FSG OS | Name, email address and message content |
| Instantly | Delivery of business outreach emails and collection of replies | Business name, contact name, business email address and replies |
| Backup record of website registrations and notification to Ygrene | The information entered in the website registration form | |
| DocuSign | Electronic signature of FSG agreements after registration | Information you enter into the signing form |
| Cloudflare Turnstile | Bot protection on FSG OS registration forms | Browser and device signals used to tell people from automated traffic |
| U.S. Census Bureau Geocoder and OpenStreetMap Nominatim | Verifying and mapping business and job site addresses | Street addresses only |
Uptime monitoring checks that our systems respond and receives no personal information.
Security controls in place
- Encryption in transit: every connection uses HTTPS, and browsers are instructed to refuse unencrypted connections (HSTS).
- Encryption at rest: the database and file storage are encrypted at rest by our hosting provider.
- Access control: permissions are enforced by the database itself, not only by the application, and each staff role sees only what it needs.
- Multi factor authentication: available to every staff account and required at sign-in once enabled.
- Security audit log: sign-ins, failed sign-ins, multi factor and password changes, document access links and registration decisions are recorded.
- Documents are delivered through short lived signed links rather than public addresses.
- Abuse protection: rate limiting on sign-in and public forms, bot protection on registration forms, and signed, single use requests between fsg.supply and FSG OS.
- Browser protections: FSG OS sends security headers, including a content security policy and protection against being embedded in other sites.
- Backups: daily automated database backups.
- Monitoring: automated uptime and scheduled job monitoring with alerts.
Payments
Neither fsg.supply nor FSG OS collects payment card numbers.
Email practices
Our business outreach emails follow the U.S. CAN-SPAM Act:
- They identify FSG as the sender and use accurate subject lines and sender details.
- They include our postal address.
- They tell you how to opt out. Reply STOP or email info@fsg.supply, and we honor the request within 10 business days.
- Opt out records are kept so you are not contacted again, and they are never sold or transferred.
Security incidents
We maintain a written incident response plan. If a breach affects your personal information, we will notify you and the appropriate authorities as required by law, including Florida's data breach notification statute (Section 501.171, Florida Statutes), which requires notice no later than 30 days after a breach is determined.
Reporting a vulnerability
If you believe you have found a security issue, email info@fsg.supply. Our disclosure policy is published at os.fsg.supply/security, with a machine readable contact at os.fsg.supply/.well-known/security.txt.
Data requests
To see, correct or delete the information we hold about you, or to stop outreach emails, email info@fsg.supply. We verify identity before acting and aim to respond within 30 days.