Trust center

Security built into every support decision.

Fctr helps organizations verify caller identity in support workflows and through person-to-person verification with Fctr Mobile. This center summarizes the public assurance posture of the Fctr-hosted Identity Platform and links to policies used in Platform customer review.

Public assurance overviewUpdated October 13, 2026

What this covers

Fctr-hosted Identity Platform services under a customer agreement. Separately deployed Tako and Fctr GitHub projects are outside this scope unless an executed agreement expressly includes Fctr hosting or management.

Read the full scope

Scope: This Trust Center applies only to the Fctr Identity Platform and related services that Fctr hosts, operates, or maintains under an applicable customer agreement. It does not describe or warrant Tako AI Agent for Okta, Tako MCP, or another separately licensed Fctr GitHub project deployed in a customer- or third-party-controlled environment. Those deployments are governed by their repository documentation and the operator's configuration, unless an executed agreement expressly states that Fctr will host or manage the deployment. The Platform supports verification through identity-provider factors and enrolled Fctr Mobile devices, applies organizational access and action policies, and records security-relevant activity.

Policies & resources

Public documents cover our standard posture. Customer-specific architecture, questionnaires, and supporting evidence are handled through the security-review process.

Security ModelArchitecture and control overview Privacy PolicyData handling and individual rights Terms of ServiceStandard service terms U.S. Data Processing AddendumStandard service-provider commitments Okta Integration NetworkFctr integration listing Responsible DisclosureReport a potential vulnerability

Our approach

Verify identity. Constrain authority. Preserve evidence.

Provider-backed access

Operators sign in through configured Microsoft Entra ID or Okta.
Live identity context without a parallel workforce directory.

Full explanation

Operators authenticate through the organization's configured Microsoft Entra ID or Okta environment. Fctr retrieves identity context for the active workflow without creating a parallel workforce identity directory, and limits retained operational records to defined service, security, support, and audit purposes.

Technical context: OIDC · Protected sessions

Identity verification

Use supported identity-provider factors or, where enabled, enrolled Fctr Mobile devices.
Verification is time-limited and tied to the request.

Full explanation

Fctr supports organizational identity verification through supported identity-provider factors and enrolled Fctr Mobile devices. Verification is time-limited and bound to the request; a successful result does not itself authorize a separate business action.

Technical context: Device-bound proof · Scoped state

Policy before action

The backend evaluates roles, verification state, provider capability, and customer policy.
Checks run before a support action is exposed or executed.

Full explanation

Roles, provider capability, verification state, and customer policy are evaluated by the backend before a support action is exposed or executed.

Technical context: RBAC · Server enforced

Privacy-conscious auditability

Structured audit events support operational and security reviews.
Excludes secrets, credentials, raw tokens, and unapproved personal data.

Full explanation

Security-relevant workflows generate structured audit events designed for operational, compliance, incident-response, and cyber-insurance evidence requests while excluding secrets, credentials, raw tokens, and unapproved personal data.

Technical context: Audit trail · Data minimization

Planning a security review?

Contact security