How Data is Secured
-
Encryption at Rest: All credentials are encrypted using AES-256 in isolated, tenant-specific databases.
-
Encryption in Transit: All communications use HTTPS/TLS 1.2+.
-
Access Control: Only automated systems (not staff) can use your credentials for authorized operations.
-
Audit Logging: Every access, refresh, and revocation is logged for compliance.
-
Multi-Tenant Isolation: Your data is never mixed with other organizations.
What the Customer Needs to Do
The customer is responsible for:
· Opening the Fortinet integration in COMPASS.
· Entering the Fortinet device and credential details.
· Entering the local Fortinet service URL/IP and port.
· Installing cloudflared, if it is not already installed.
· Running the generated cloudflared tunnel run --token <token> command.
· Keeping the connector running so COMPASS can access Fortinet data.
What COMPASS Handles
COMPASS handles:
· Creating the Cloudflare tunnel.
· Creating the unique tunnel hostname.
· Mapping DNS to the tunnel.
· Configuring tunnel routing to the customer's Fortinet service.
· Securely storing the Fortinet configuration.
· Using the tunnel hostname for integration data collection.
Security Summary
This design keeps the customer environment protected because the tunnel is established outbound from the customer's network. The customer does not need to expose Fortinet directly to the internet.
Important controls:
· COMPASS Cloudflare API tokens stay in the backend only.
· Customer Fortinet credentials are stored securely and masked in the UI.
· The generated tunnel token is specific to the tunnel.
· Tunnel hostnames are unique per tenant/device.
· Access can be removed by disabling the device integration, deleting the tunnel, or stopping cloudflared.
Success Criteria
The integration is successful when:
· The Fortinet device is added in COMPASS.
· The Cloudflare tunnel hostname is generated.
· The customer runs the tunnel command successfully.
· The tunnel is active.
· COMPASS can fetch Fortinet data through the tunnel.