Security Policies
      Back to home
      1. Help Centre
      2. Technical & Security
      3. Security Policies

      Data Sovereignty and Ownership

      Describes where customer data is stored and who has rights and responsibilities for the data

      This article is for IT and security professionals

      Data Sovereignty

      FMI Works provides services through the Microsoft Azure cloud.  FMI allows customers to request the region for the delivery of their services from the following regions:

      • Australia
      • Canada
      • United Kingdom
      • United States
      • Ask for other regions, more are being added...

      While all data is stored within a single region, the nature of the Internet does not guarantee that data in transit will not be routed through other jurisdictions.

      Data Ownership

      FMI Works does not take ownership of customer data.  The data remains at all times the property of the customer.  While FMI has backup, retention, and destruction policies related to customer data, this is based on the best practices and expectations of customers.  Customers ownership includes:

      • The ability to access, create, modify, and derive benefit from their own data.
      • The ability to sell their own data or assign rights and privileges to others.
      • The power to have their data deleted on request
      • The responsibility for the content of data.  FMI does not monitor content for regulatory or other third party purposes.  FMI may restrict the type of data uploaded, when that data can be automatically determined to be a threat to the FMI servers or a threat to customers when they download the data.  This includes:
        • Checking of content for viruses and other threats to the FMI servers
        • Content that if re-downloaded could threaten the customers systems
        • Content that might compromise web browser security, e.g. script injections

      Data Destruction

      In line with our Terms & Conditions, customers data is securely destroyed either on request or shortly after termination of service agreements.  FMI uses the Microsoft Azure platform to store data in a combination of locations.  After a defined delay from account terminations, or earlier if requested, all these are deleted:

      • Large file storage locations (commonly called BLOB storage).  These storage accounts have soft-delete disabled and are then deleted from Azure.  This deletion removes all six copies of data, three in the primary data center (PDC) and three in the secondary data center (SDC).
      • Database files.  Primary database files are deleted by the deletion of the Azure database.  This includes disaster recovery copies in the PDC and SDC.
      • Database backups and audits.  Additional backups are maintained on a monthly basis for six months, these files are in BLOB storage and are deleted.  Audit logs for regulatory purposes are also stored in BLOB storage and are also deleted.
      • In addition to the deletion of the data, FMI and Azure also delete the cryptographic keys for the at-rest data storage.

      Once FMI takes these actions, Microsoft Azure performs several additional steps as they are the custodians of the physical media.  Microsoft follows "strict standards for deleting data"  both when the data is deleted and during media disposal, following NIST 800-88 Guidelines for Media Sanitation.  

      Aggregate Data

      FMI maintains aggregate data about access to our systems.  FMI uses aggregate data to continuously improve our services.  This data is aggregated across customers and does not contain details specific to customer data, and remains the property of FMI Works.