FirstIgnite Trust Center
Welcome to FirstIgnite's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this FirstIgnite Trust Center to learn about our security posture and request access to our security documentation.
Northwestern University
Oak Ridge Lab
Lurie Children's
DTU
King's College London
Universitat Politècnica de Catalunya
Duke University
University of Bristol
Lawrence Livermore National Laboratory
Georgia Tech
Johns Hopkins APL
Western University
Arizona State University
Idaho National Lab
The University of Queensland
Texas A&M University
University of Michigan
The University of Chicago
Reports
We may provide security-related reports upon request.
Data Security
We follow industry best practices for data security. We are happy to provide more details about our data security practices upon request.
AI
We take the usage of AI seriously in our organization and work to ensure security and reliability of the AI.
ESG
We prioritize and take environmental, social, and governance (ESG) considerations seriously in our operations and decision-making processes.
Legal
We take legal matters seriously and we always engage our legal counsel to review all commercial activities. Please contact us if you have any questions.
Data Privacy
Privacy of customer data is top of mind. We follow industry best practices and follow all applicable privacy regulations.
Access Control
Access is tightly monitored and controlled at our company. We are happy to provide more details about our access control practices upon request.
Endpoint Security
We follow industry best practices for endpoint security. We are happy to provide more details about our endpoint security practices upon request.
Network Security
We protect our corporate network against external & internal threats.
Corporate Security
We implement internal measures and practices to maintain a high standard of security.
Security Grades
We are constantly monitoring the security of our website. We will post our grades from public security rating agencies when they become available.
Incident Response
We have a dedicated team that responds to security incidents. We are happy to provide more details about our incident response practices upon request.
Risk Management
We have a dedicated team that manages security risks. We are happy to provide more details about our risk management practices upon request.
Asset Management
We have strict asset management policies in place to ensure that all assets are accounted for and secure.
Training
We provide security awareness training to all employees to ensure that they are aware of security best practices.
Change Management
We have a change and configuration management process in place to ensure that changes are properly reviewed and approved.
Physical & Environment
We have physical and environmental controls in place to ensure that our data centers are secure and reliable.
Continuous Monitoring
We continuously monitor our systems for security threats and vulnerabilities. We are happy to provide more details about our continuous monitoring practices upon request.
- How does FirstIgnite handle data breaches?
- What security controls are in place to protect customer data?
- Can FirstIgnite integrate with internal systems (e.g., research databases, CRMs)?
- Where is our data stored and who has access to it?
- Does FirstIgnite's AI replace human decision-making or evaluation?
FirstIgnite Trust Center Updates
SOC 2 Type 2 report now available
We’re glad to share that FirstIgnite has completed its SOC 2 Type 2 examination. Insight Assurance tested our controls for Security, Availability, Confidentiality, and Privacy over six months, December 1, 2025 to May 31, 2026. They found no exceptions.
Universities and research organizations trust us with sensitive data about their inventions, partners, and people. We take that seriously, and this report lets your security team verify it independently. It sits alongside FirstIgnite’s ISO/IEC 27001:2022 certification.
You can request the full report on our Trust Center. We share it under NDA, as is standard for SOC 2 reports. Please direct questions to security@firstignite.com.
PHP2Shell (CVE-2026-109618, CVE-2026-109619): FirstIgnite patched October 21
On October 21, the PHP project released fixes for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, widely referred to as PHP2Shell. Parts of the FirstIgnite platform run on PHP, so we treated this as urgent.
Our security tooling flagged the issue the morning of the release. We began rolling out the patched version (PHP 8.3.36) within an hour of PHP publishing it, and it was live across our US and EU production environments that same afternoon.
We reviewed our application monitoring for the period before the patch and found no evidence that these vulnerabilities were exploited against FirstIgnite. That review is continuing.
Timeline (UTC, October 21, 2026)
- 14:00: PHP releases the security fix
- 14:50: First production services running the patched version
- ~18:00: Patch live across all US and EU production environments
You don't need to take any action. If you have questions, contact security@firstignite.com.
Upcoming subprocessor additions, effective November 20, 2026
We're adding the following subprocessors to support new platform capabilities. These changes take effect on November 20, 2026. If you have questions or would like to object, please contact security@firstignite.com before then.
Langfuse (ClickHouse, Inc.). LLM observability. Langfuse records how our AI features run so we can monitor quality, cost, and reliability. Traces include prompts, model responses, and a platform user identifier. Email addresses and phone numbers are masked, and uploaded files are excluded. Data is processed in the EU (Ireland).
Unipile. Email connectivity. If a user chooses to connect their Outlook mailbox, Unipile lets them send outreach from that account. It processes mailbox access and the messages sent through it, only for users who opt in. Data is processed in the EU (France).
Temporal Technologies. Workflow orchestration. Temporal coordinates long-running platform tasks, such as Prospecting searches and Assistant requests, so they complete reliably. It processes encrypted workflow data. Data is processed in the United States.
TypeSafe AI. AI-powered classification. TypeSafe helps us make model requests more efficient and supports features where classification accuracy matters. It processes customer-provided inputs with zero data retention. Data is processed in the United States.
Each provider completed our vendor security review and is bound by a data processing agreement with FirstIgnite. Our full list is at https://firstignite.com/subprocessors.
Platform Downtime on November 18 2025
Incident Update: Cloudflare Global Outage Impacting FirstIgnite
Status: Resolved
Incident Window: November 18, 2025
Root Cause: Global Cloudflare service disruption
Summary
FirstIgnite experienced intermittent downtime and degraded performance today due to a global Cloudflare outage. This issue affected a wide range of Cloudflare customers worldwide, including our edge routing, CDN-served assets, and certain authentication flows.
Cloudflare has fully restored service, and all FirstIgnite systems are now operating normally.
Impact to FirstIgnite Users
- Intermittent downtime accessing the FirstIgnite platform
- Occasional login failures or slow load times
- Temporary routing errors for some pages
No data integrity issues, security concerns, or platform-side failures occurred.
This incident was entirely upstream from Cloudflare’s infrastructure.
Timeline (UTC)
- 11:48 – Cloudflare reports internal service degradation
- 12:21–14:34 – Global errors, latency, and dashboard/edge disruptions
- 13:09 – Cloudflare identifies the issue and begins rollout of a fix
- 14:42 – Cloudflare announces fix deployed, systems recovering
- 15:40–17:14 – Continued global stabilization
- 17:14 – Cloudflare confirms services returning to normal
Current Status
✔ FirstIgnite services fully operational
✔ No ongoing instability
✔ Monitoring complete
Next Steps
Cloudflare will provide a detailed post-mortem. Once released, we’ll review it for any follow-up actions that can further harden our resilience against upstream provider outages.
If you continue to experience any issues, please contact us at support@firstignite.com.