Security at FairConsent
Last updated: Sep, 2026
FairConsent is operated by Fairpicture AG. We build tools that help organisations collect and manage informed consent. Protecting the confidentiality, integrity and availability of the service and the information entrusted to us is a core part of how we operate.
This page gives a high-level overview of our current security and privacy approach. It is not a certification or a contractual commitment; contractual obligations are set out in the applicable agreement and data-processing documentation.
Our approach
Security is owned by Fairpicture’s CTO, who is responsible for security governance, risk decisions and coordination of incident response. Engineering is responsible for implementing and maintaining technical controls.
We maintain security policies and operational processes covering access control, information handling, vulnerability management, incident response, third-party risk and change management. These are reviewed as our service, risks and operations change.
Protecting data
FairConsent is designed to support responsible collection and management of consent information. For customer content processed through FairConsent, Fairpicture generally acts as a processor on the documented instructions of the customer acting as controller.
Our approach includes encryption for data in transit and at rest; least-privilege and role-based access controls; restricted access for authorised personnel; privacy and data-handling requirements for staff and service providers; and processes for requests, incidents and changes affecting the service.
Secure operation and development
We use operational controls intended to identify, assess and address security risks. These include vulnerability-management activities, security reviews, controlled production access and documented incident-response processes.
We do not state that we are ISO 27001 certified, SOC 2 certified, or subject to a continuously operating security operations centre. Fairpicture uses recognised security and privacy frameworks as references when improving its controls.
Third parties
We assess third parties that support the service and require appropriate contractual and data-protection safeguards where they process personal data on our behalf.
Reporting a security concern
If you believe you have found a security issue affecting FairConsent, contact info@fairpicture.org with enough detail for us to investigate. Please do not include unnecessary personal data or sensitive credentials in an initial report.
