Every exchange visible, controllable and provable.
FTAPI detects sensitive data leaving your organisation, not only via FTAPI but also by email and in the browser. Your policies apply automatically. Dashboards show you every exchange, and you can export it as audit evidence.
Governance that works in everyday practice.
Visible
EVERY ROUTE OUT IN VIEW
See in a dashboard what leaves your organisation (coming soon)
Governable
ONE POLICY FOR EVERY EXCHANGE
In email, the browser and all FTAPI features (coming soon)
Provable
EVERY EXCHANGE LOGGED
Traceable who sent what, to whom and when
How governance works with FTAPI: from exchange to audit evidence.
1. Employee
Exchanging data as usual
By email, upload, data room or workflow, without having to think about rules.
2. FTAPI
Detects sensitive content
Using your classification, DLP rules and AI data detection (coming soon).
3. Policy
Applies automatically
Encrypts, warns, blocks or redirects, according to your rules. In every channel.
4. CISO
Proves every exchange
Via audit trail, export or SIEM, ready for the next audit at any time.
See, govern, prove. From overview to policy to audit evidence, for email, the browser and FTAPI.
Every route out at a glance
You can see what leaves your organisation, by which route and where it’s going. This lets you spot risks early and know where policies need to apply.
– Email monitoring dashboard showing how emails go out encrypted and which rules apply
– Data exchange monitoring & analytics dashboard with all external data exchange in a single overview (coming soon)
– Shadow IT detection that makes tools and AI chatbots visible (coming soon)
Policies apply automatically on sending
You define once what is permitted. FTAPI enforces it in every channel. Your team doesn’t need to memorise any rules.
– Policies for email and FTAPI covering security levels, retention periods, file types and recipients, with your Microsoft Purview labels if required
– AI data detection finds sensitive content before it leaves (coming soon)
– Browser policies that define which data may be uploaded to which websites (coming soon)
Every exchange documented when an audit comes up
Every exchange is logged without gaps. For audits, you export the evidence directly instead of gathering it from many different systems.
– Complete audit trail, exportable and connected to your SIEM via Syslog
– Permissions based on the need-to-know principle
– Sign-in via two-factor authentication or single sign-on
– Automatic deletion in line with your retention periods
What matters for data protection and audits.
Data location: Germany
Processing takes place exclusively in Germany, at SysEleven and IONOS, both German companies. FTAPI is not owned by a US corporation.
Data protection built in
Automatic retention periods, traceable logs and end-to-end encryption for special categories of personal data.
Independently audited
Attested to BSI C5 Type 2, SOC 2 Type 2 and ISAE 3402 Type 2, certified to ISO 27001, 27017 and 27018. The audit reports are available to download.
What your regulations require and what FTAPI contributes. For the exchange of sensitive data, FTAPI provides the technical measures and evidence that auditors ask for. Responsibility for your compliance remains with you; FTAPI makes it workable day to day.
NIS-2
Demonstrating due diligence
State-of-the-art encryption, enforced policies and complete logs for the exchange of sensitive data.
DORA
Making ICT service providers auditable
ISAE 3402 Type 2 and SOC 2 Type 2 audit reports for your service provider assessment, audit trails for every exchange and operation at two sites in Germany.
GDPR
Protecting personal data
Processing in Germany, automatic retention periods and end-to-end encryption for special categories of data.
KRITIS
Recognised cloud evidence
Attested to BSI C5 Type 2 and operated in German data centres run by SysEleven and IONOS, both German companies.
Independently audited, by conviction.
BSI C5 Type 2 attestation
Cloud criteria catalogue of the German Federal Office for Information Security (BSI).
ISO 27001, 27017, 27018 certification
Information security, cloud security and personal data in the cloud.
SOC 2 Type 2 attestation
International audit standard for security and availability.
ISAE 3402 Type 2 attestation
Audit standard for outsourcing, relevant for banks and insurers, among others.
Accessibility (External audit)
92% accessibility to WCAG 2.1 AA, externally audited for data transfer and the Digital Mailbox.
TISAX® (in progress)
Audit standard for the automotive industry. Registration with ENX is complete and the audit has been approved.
From policy on paper to policy in the system. Stored data is governed within your systems, but your System of Exchange often isn’t: every route by which sensitive data leaves your organisation. FTAPI enforces your policies there and proves every exchange.
Without FTAPI
Handbook, training, spot checks.
Whether the policy is followed depends on each individual. What goes out via private clouds or AI chatbots remains invisible. Evidence has to be gathered from many systems.
With FTAPI
Policies, visibility, evidence.
Policies apply automatically on sending. You can see what goes out and where to (coming soon). Every exchange is logged, exportable as audit evidence and available in your SIEM.
With FTAPI, you manage security end to end. Data exchange, orchestration and governance are the three pillars of an infrastructure for your System of Exchange.
For your IT
Your team works in Outlook, Explorer and the browser. The secure route is the easiest one, so shadow IT disappears.
For your business units
Automated processes follow the same policies, so even bulk dispatches remain auditable.
For your system landscape
Connection to identity providers and SIEM, with events going straight into your monitoring.
Frequently asked questions about governance and data protection with FTAPI
Through three types of detection: your Microsoft Purview labels, rules for fixed patterns such as IBANs or tax IDs, and AI data detection that understands the content itself (coming soon). At launch, the AI detects special categories of data under Art. 9 GDPR, such as health data in free text. You define in your policy what happens when there’s a match.
Yes. FTAPI reads your labels and enforces the policy accordingly. AI data detection also checks the content (coming soon) and applies even if a label is missing or has been downgraded. Without Purview, AI data detection works on its own.
In German data centres, not in a US cloud (coming soon). The file is only held in memory for the duration of the check and discarded afterwards.
No. You define one policy centrally. It applies to email, the browser and all FTAPI features (coming soon). Existing email rules remain in place.
Via export, streaming or Syslog (TCP, UDP or TLS), for example into Microsoft Sentinel, configured directly in the admin interface.
For the exchange of sensitive data, FTAPI provides the technical measures and evidence these regulations require: encryption, enforced policies, logs and audited supply chain security. Overall responsibility remains with your organisation.
The email monitoring dashboard is available from Secure Intelligence upwards, and the SIEM connection in Secure Enterprise. You’ll find all other details on the pricing page. Find out more about packages & pricing.
Your policies. Enforced in every channel.
Talk to our information security and data protection experts. We give you expert answers, not sales slides.
TISAX® is a registered trademark of the ENX Association. FTAPI Software GmbH has no business relationship with ENX. The mention of the TISAX® trademark does not imply any statement by the trademark owner regarding the suitability of the services advertised here.