docs: add more visibility to trust.flagsmith.com #8328
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| --- | ||
| title: Security & Compliance - FAQ | ||
| sidebar_label: Security & Compliance | ||
| sidebar_position: 8 | ||
| description: | ||
| Flagsmith security and compliance FAQ - SOC 2 Type 2, ISO 27001, GDPR, penetration tests, sub-processors and security | ||
| questionnaires. | ||
| keywords: | ||
| - SOC 2 | ||
| - SOC2 | ||
| - ISO 27001 | ||
| - GDPR | ||
| - DPA | ||
| - penetration test | ||
| - sub-processors | ||
| - security questionnaire | ||
| - compliance | ||
| - trust centre | ||
| --- | ||
|
|
||
| import Link from '@docusaurus/Link'; | ||
|
|
||
| <span id="top" /> | ||
|
|
||
| <Link to="/support/faq">← Back to FAQ</Link> | ||
|
|
||
| <div className="faq-content"> | ||
|
|
||
| Security, compliance and vendor review documentation lives in the | ||
| **[Flagsmith Trust Centre](https://trust.flagsmith.com)**. It is the single, current source | ||
| for our certifications, reports and policies — start there for any of the questions below. | ||
|
|
||
| ### Is Flagsmith SOC 2 certified? | ||
|
|
||
| Yes, Flagsmith is SOC 2 Type 2 certified. Request the report through the | ||
| [Trust Centre](https://trust.flagsmith.com). | ||
|
Comment on lines
+33
to
+36
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- security-compliance.mdx ---'
sed -n '1,60p' docs/docs/support/faq/security-compliance.mdx
printf '%s\n' '--- account-billing-organisation.mdx ---'
sed -n '50,85p' docs/docs/support/faq/account-billing-organisation.mdx
printf '%s\n' '--- FAQ index references ---'
sed -n '60,90p' docs/docs/support/faq/index.mdx
printf '%s\n' '--- repository references to SOC 2 and Trust Centre ---'
rg -n -i 'SOC 2|SOC2|Trust Centre|trust\.flagsmith\.com|ISO 27001' docs README.md .github 2>/dev/null | head -200Repository: Flagsmith/flagsmith Length of output: 7047 🏁 Script executed: #!/bin/bash
set -eu
for url in \
'https://trust.flagsmith.com' \
'https://trust.flagsmith.com/faq#1-security-governance' \
'https://trust.flagsmith.com/faq'
do
printf '\n--- %s ---\n' "$url"
curl -L --max-time 20 -sS "$url" | \
tr '\n' ' ' | \
sed -E 's/<script[^>]*>.*<\/script>//g; s/<style[^>]*>.*<\/style>//g; s/<[^>]+>/ /g; s/[[:space:]]+/ /g' | \
grep -Eio '.{0,180}(SOC ?2|SOC2|Type ?[12]|attestation|certif|examination|report).{0,300}' | \
head -40 || true
done
printf '\n--- public repository references and history summary ---\n'
rg -n -i 'SOC 2|SOC2|Type II|Type 2|attestation|examination report|certif' . \
-g '!node_modules' -g '!build' -g '!dist' | head -250
git log --oneline -20 -- docs/docs/support/faq/security-compliance.mdx docs/docs/support/faq/account-billing-organisation.mdx docs/docs/support/faq/index.mdxRepository: Flagsmith/flagsmith Length of output: 4248 🌐 Web query:
💡 Result: Flagsmith is a fully accredited SOC 2 Type 2 organization [1][2][3][4]. As of August 2026, the company maintains this certification [5][4], and copies of their audit report are available to interested parties upon request through their official communication channels [2][3][6]. In addition to SOC 2 Type 2, the company also maintains ISO 27001 certification [4]. Citations:
🌐 Web query:
💡 Result: A SOC 2 examination is an attestation engagement performed by an independent service auditor to evaluate an organization’s controls [1][2]. It is critical to note that there is no such thing as a SOC 2 "certification" [1][2]. The output of this engagement is a formal attestation report, not a certificate [1][2]. The terminology "Type 2" refers to a specific type of SOC 2 examination report [3]. The distinction between Type 1 and Type 2 reports lies in the scope and duration of the assessment [1][3]: Type 1 Report: An examination of the design and implementation of an organization's controls at a specific point in time [1][3]. Type 2 Report: An examination of the design, implementation, and operating effectiveness of an organization's controls over a specified period (typically 6 to 12 months) [1][3]. A SOC 2 Type 2 report includes the following core components [4]: Management’s assertion regarding the system and controls [4]. A description of the service organization’s system [4]. The service auditor’s opinion on the fairness of the description, the suitability of the design of controls, and the operating effectiveness of those controls throughout the specified period [4][3]. The specific tests of controls performed by the auditor and the results of those tests [4]. Because a SOC 2 engagement results in a report rather than a certification, organizations should not use terms like "SOC 2 Certified" in their marketing or communications [1][2]. Proper usage involves stating that an organization has "obtained a SOC 2 Type 2 report" or has "successfully completed a SOC 2 Type 2 examination" [1][2]. Citations:
🌐 Web query:
💡 Result: SOC 2 Type 2 is a compliance certification that verifies an organization's internal controls and processes related to information security over a specific period of time [1]. While SOC 2 Type 1 evaluates the design of an organization's security controls at a single point in time, SOC 2 Type 2 assesses whether those controls are not only designed correctly but also operating effectively over a sustained duration [2]. This makes Type 2 a more rigorous standard, as it provides evidence that the organization's security and data protection processes perform as intended during daily operations [2]. SOC 2 compliance, in general, focuses on organizational processes—such as software patching, access management, and vulnerability scanning—to ensure data security [1]. Organizations often pursue SOC 2 Type 2 certification to demonstrate their security maturity to customers and stakeholders, particularly in regulated industries where verifying operational security is a key requirement [2][3][4]. Citations:
🌐 Web query:
💡 Result: A SOC 2 Type 2 report is an attestation of an organization's security controls over a specific period, typically covering how those controls operated in practice [1]. While a SOC 2 Type 1 report assesses the design of security controls at a single point in time, a SOC 2 Type 2 report evaluates both the design and the operational effectiveness of those controls over an extended duration, often spanning several months [1]. This allows auditors to verify that the controls not only exist but have been consistently applied throughout the observation period [1]. Organizations undergo SOC 2 Type 2 audits to demonstrate their commitment to data security and to meet the compliance requirements often requested by enterprise clients during procurement and partnership processes [2][1]. Obtaining this certification involves working with auditors to review system security, control implementation, and overall risk management practices [2][1]. Citations: Use accurate SOC 2 terminology across both FAQ entries. SOC 2 produces an attestation report, not a certification. Replace “SOC 2 certified” with wording such as “completed a SOC 2 Type 2 examination” and “obtained a SOC 2 Type 2 report” in both files. Update the FAQ index anchor if the heading changes. 📍 Affects 2 files
|
||
|
|
||
| ### How does Flagsmith handle GDPR and data processing agreements? | ||
|
|
||
| Our privacy documentation, including the DPA and the list of sub-processors, is available through the | ||
| [Trust Centre](https://trust.flagsmith.com). | ||
|
|
||
| ### Can you complete our vendor security questionnaire? | ||
|
|
||
| Check the [Trust Centre FAQ](https://trust.flagsmith.com/faq#1-security-governance) first — most questionnaires can be answered in full from the | ||
| documentation published there, which is faster than a manual review. If something is still outstanding, contact | ||
| [support@flagsmith.com](mailto:support@flagsmith.com). | ||
|
|
||
| ### How do I report a security vulnerability? | ||
|
|
||
| See [CVEs and Vulnerabilities](/support/cves-and-vulnerabilities) for how to report an issue and the remediation SLAs we | ||
| work to. Do not report vulnerabilities through public GitHub issues. | ||
|
|
||
| **Related documentation:** [Help and Support](/support#security-and-compliance) | ||
|
|
||
| </div> | ||
|
|
||
| ## Related FAQ Categories | ||
|
|
||
| - [Account, Billing & Organisation](/support/faq/account-billing-organisation) - Questions about accounts, SSO and | ||
| billing | ||
| - [Open Source & Self-Hosted](/support/faq/open-source-self-hosted) - Questions about self-hosting and the Enterprise | ||
| Edition | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Align all ISO 27001 references with the actual FAQ scope. The navigation advertises ISO 27001, but the target page does not document it.
docs/docs/support/faq/security-compliance.mdx#L5-L18: add an ISO 27001 status/scope answer or remove the topic from the metadata.docs/docs/support/faq/index.mdx#L77-L82: update the category description if the FAQ content is not expanded.docs/docs/support/faq/account-billing-organisation.mdx#L75-L76: update the related-category description to match the final FAQ scope.📍 Affects 3 files
docs/docs/support/faq/security-compliance.mdx#L5-L18(this comment)docs/docs/support/faq/index.mdx#L77-L82docs/docs/support/faq/account-billing-organisation.mdx#L75-L76There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@bakirFS this is legitimate. We are not ISO27001 so please remove all references to it.