Fastly’s technology compliance program includes safeguards that help protect your data as it moves through the Fastly service. Information about these safeguards is organized by category. Our security program guide describes additional safeguards we maintain.
Information security roles and responsibilities. We have formally assigned information security duties to Fastly personnel. Our Chief Security Officer and Security organization work with other departments to safeguard sensitive information related to the Fastly service.
Policies and procedures. Our policies and procedures help us maintain security in our systems, processes, and employee practices. Fastly’s Security organization formally reviews these policies and procedures at least annually.
Risk management. We integrate risk assessment activities with various processes to identify and address information security risk to the company and customer data on our network.
Vendor security oversight. Fastly performs risk-based evaluations of the security measures of our vendors. We review these security measures before we begin using a vendor, and we ask the vendor to formally acknowledge these measures. We re-evaluate vendor security measures on a recurring basis thereafter.
Human resources security
Employee background screening. We screen new employees as part of the hiring process. Screening activities depend on applicable local regulations and may include criminal background checks and reference checks.
Confidentiality agreement. Our employees formally agree to safeguard the sensitive information they may view, process, or transmit as part of their job functions.
Security awareness training. We train our people to protect the data and devices they use. Each employee receives security awareness training as part of new hire procedures, and current employees take this training annually.
Personal data transfer. The Fastly services by default do not process personal data. However, our service can be configured or used at the direction of the customer to process personal data. Our guide about our terms provides additional information about data privacy compliance related to the processing of personal data.
Technology change management
Change management process. We follow a defined set of procedures to develop and deploy technology changes. These changes include updates to software, configurations, and devices that support the Fastly service.
Testing. We test technology changes at various stages of development, and we confirm those tests are successful before completing a deployment into the Fastly service.
Change approval and notification. As part of our deployment process, we prepare, approve, and communicate change notices to maintain awareness among personnel who manage the Fastly network and systems.
Post-implementation review. We confirm the success of changes after their deployment. Should we experience issues during implementation, we also maintain procedures to revert changes.
Identity and access management
User requests and approval. We document and approve requests for user access to the Fastly network. Our security administrators confirm appropriate documentation is in place before granting requested user rights.
Access modification. We promptly update or remove an employee’s access to the Fastly network to match that employee’s current job function or employment status.
User access review. We periodically inspect access privileges to make sure our personnel have appropriate access to Fastly systems and data.