SOC 2 policies for Fly.io teams

P03 Access Control Policy

Fly.io organization membership is limited to engineers who deploy or operate the product, and the organization admin role is held by no more than two named people. Continuous integration deploys with an app-scoped deploy token created with fly tokens create deploy and an explicit expiry, never with a person's auth token, and organization members, active tokens and WireGuard peers are reconciled against the identity provider at each quarterly access review, with any token or peer belonging to a leaver revoked the same day.

P08 Encryption and Key Management Policy

Application secrets are stored with fly secrets, which keeps them encrypted and exposes them to Machines as environment variables; flyctl lists secrets by name and digest without their values, and no secret is written into fly.toml or baked into a Docker image. Every Fly Volume is created with encryption at rest, which is the default, and none is created with the --no-encryption flag. Custom domains use certificates issued through fly certs, and force_https is set on every public HTTP service.

P12 Logging and Monitoring Policy

Logs from every production app are forwarded to the central logging tool with the Fly Log Shipper, so retention follows this policy rather than the retention of Fly.io's built-in log viewer. Health checks are defined in fly.toml for every production service, the monitoring tool alerts the incident channel when a check fails or a Machine restarts repeatedly, and each production deploy records its fly releases version and image reference in the change ticket so the running image can be traced to a reviewed commit.

P14 Business Continuity and Disaster Recovery Policy

Every production app runs at least two Machines, so the Fly Proxy can route requests away from a Machine that fails its health checks, and the disaster recovery runbook names a second region where stateless services are redeployed. Because each Fly Volume is attached to one Machine on one physical host and is not replicated by Fly.io, stateful services replicate their data at the application layer across Machines with their own volumes, and the runbook documents restoring a volume from its latest snapshot with fly volumes create --snapshot-id and the recovery point that implies.

P15 Backup and Recovery Policy

Automatic daily snapshots stay enabled on every production Fly Volume, with the snapshot retention set explicitly to the period this policy requires instead of being left at the default. Because snapshots are held inside the same Fly.io organization as the volumes they protect, each production database is also backed up daily to encrypted storage outside Fly.io under separate credentials, and a restore from both a volume snapshot and the external backup is tested each quarter.

P20 Network and Infrastructure Security Policy

Databases, caches and internal services have no public IP address and are reachable only over the organization's private network through .internal or Flycast addresses; public IP addresses are allocated only to the apps that serve the internet, and any that are not needed are removed with fly ips release. Apps that must not reach each other are placed in separate custom private networks, and administrator access to the private network is through WireGuard peers created with fly wireguard create for named people and removed when they leave.

Frequently asked questions

Does Fly.io's own security assurance cover our SOC 2?

No. Whatever independent assurance Fly.io provides, such as a SOC 2 report or an ISO 27001 certificate, covers the controls Fly.io operates for its own platform. Your examination covers how your company configures and uses Fly.io: who has access, how it is authenticated, what is logged and how data in it is protected. Auditors read the vendor's assurance to decide what they can rely on, and the Vendor and Third-Party Risk Management Policy tells you to obtain it at onboarding and annually, and to send a security questionnaire where gaps remain.

What does the generator pre-fill when I arrive from this page?

The link on this page opens the generator with a preset that sets the cloud platform to Fly.io. The other answers (company, product, headcount, owners, data types, scope and review cadence) are yours to fill in. The policies render in your browser as Markdown; nothing is sent to a server and there is no signup.

Which policies change when I add Fly.io to my answers?

6 policies name Fly.io once it is in the intake: Access Control Policy, Encryption and Key Management Policy, Logging and Monitoring Policy, Business Continuity and Disaster Recovery Policy, Backup and Recovery Policy, Network and Infrastructure Security Policy. The free generator names it in scope, roles and procedures; the Audit Kit ($59 one-time) rewrites sections 4 and 5 of each policy with statements specific to how Fly.io is configured, like the examples on this page. Refunds are available within 14 days on request.