From a6c679fdca9017d58bc8ee6ff11910130642fefe Mon Sep 17 00:00:00 2001 From: BakirFS Date: Thu, 20 Aug 2026 11:10:54 +0200 Subject: [PATCH 1/4] added security faq and other docs pointing to trust.flagsmith.com --- .../faq/account-billing-organisation.mdx | 12 ++-- docs/docs/support/faq/index.mdx | 8 +++ docs/docs/support/faq/security-compliance.mdx | 63 +++++++++++++++++++ docs/docs/support/index.mdx | 15 ++++- 4 files changed, 93 insertions(+), 5 deletions(-) create mode 100644 docs/docs/support/faq/security-compliance.mdx diff --git a/docs/docs/support/faq/account-billing-organisation.mdx b/docs/docs/support/faq/account-billing-organisation.mdx index fc7dbf129822..3901c0ed9616 100644 --- a/docs/docs/support/faq/account-billing-organisation.mdx +++ b/docs/docs/support/faq/account-billing-organisation.mdx @@ -12,10 +12,6 @@ import Link from '@docusaurus/Link';
-### Is Flagsmith SOC 2 certified? - -Yes, Flagsmith is SOC 2 Type 2 certified. - ### How do I delete an Organisation? Go to **Organisation** > **Manage**. Scroll to the very bottom, click the trash can icon next to "Delete Organisation," and confirm the name. This is irreversible. @@ -65,8 +61,16 @@ Go to **Organisation** > **Edit** > **Manage Invoices**. **Related:** [How do I update my payment details?](#how-do-i-update-my-payment-details) +### Is Flagsmith SOC 2 certified? + +Yes, Flagsmith is SOC 2 Type 2 certified. You can request the report, along with our other certifications and security +documentation, through the [Flagsmith Trust Centre](https://trust.flagsmith.com). + +**Related:** [Security & Compliance FAQ](/support/faq/security-compliance) +
## Related FAQ Categories - [Open Source & Self-Hosted](/support/faq/open-source-self-hosted) - Questions about SSO and authentication in self-hosted deployments +- [Security & Compliance](/support/faq/security-compliance) - Questions about SOC 2, ISO 27001, GDPR and vendor reviews diff --git a/docs/docs/support/faq/index.mdx b/docs/docs/support/faq/index.mdx index 99ca67e2720d..10c271d20acd 100644 --- a/docs/docs/support/faq/index.mdx +++ b/docs/docs/support/faq/index.mdx @@ -18,6 +18,7 @@ import Link from '@docusaurus/Link';
  • What is the difference between Feature Flag and Remote Config?
  • How do I identify an anonymous user?
  • Does the % split segment feature work for non-identified users?
    • +
  • Is Flagsmith SOC 2 certified?
    • @@ -72,6 +73,13 @@ import Link from '@docusaurus/Link';

    Hosting, API endpoints, Edge API, webhooks, A/B test bucketing

    + + +
    +

    Security & Compliance

    +
    +

    SOC 2, ISO 27001, GDPR, penetration tests, sub-processors, security questionnaires

    + diff --git a/docs/docs/support/faq/security-compliance.mdx b/docs/docs/support/faq/security-compliance.mdx new file mode 100644 index 000000000000..05a54201d66f --- /dev/null +++ b/docs/docs/support/faq/security-compliance.mdx @@ -0,0 +1,63 @@ +--- +title: Security & Compliance - FAQ +sidebar_label: Security & Compliance +sidebar_position: 8 +description: + Flagsmith security and compliance FAQ - SOC 2 Type 2, ISO 27001, GDPR, penetration tests, sub-processors and security + questionnaires. +keywords: + - SOC 2 + - SOC2 + - ISO 27001 + - GDPR + - DPA + - penetration test + - sub-processors + - security questionnaire + - compliance + - trust centre +--- + +import Link from '@docusaurus/Link'; + + + +← Back to FAQ + +
    + +Security, compliance and vendor review documentation lives in the +**[Flagsmith Trust Centre](https://trust.flagsmith.com)**. It is the single, current source +for our certifications, reports and policies — start there for any of the questions below. + +### Is Flagsmith SOC 2 certified? + +Yes, Flagsmith is SOC 2 Type 2 certified. Request the report through the +[Trust Centre](https://trust.flagsmith.com). + +### How does Flagsmith handle GDPR and data processing agreements? + +Our privacy documentation, including the DPA and the list of sub-processors, is available through the +[Trust Centre](https://trust.flagsmith.com). + +### Can you complete our vendor security questionnaire? + +Check the [Trust Centre FAQ](https://trust.flagsmith.com/faq#1-security-governance) first — most questionnaires can be answered in full from the +documentation published there, which is faster than a manual review. If something is still outstanding, contact +[support@flagsmith.com](mailto:support@flagsmith.com). + +### How do I report a security vulnerability? + +See [CVEs and Vulnerabilities](/support/cves-and-vulnerabilities) for how to report an issue and the remediation SLAs we +work to. Do not report vulnerabilities through public GitHub issues. + +**Related documentation:** [Help and Support](/support#security-and-compliance) + +
    + +## Related FAQ Categories + +- [Account, Billing & Organisation](/support/faq/account-billing-organisation) - Questions about accounts, SSO and + billing +- [Open Source & Self-Hosted](/support/faq/open-source-self-hosted) - Questions about self-hosting and the Enterprise + Edition diff --git a/docs/docs/support/index.mdx b/docs/docs/support/index.mdx index f45b4c68a403..3421c1519a4d 100644 --- a/docs/docs/support/index.mdx +++ b/docs/docs/support/index.mdx @@ -80,7 +80,20 @@ depending on your issue type. - **In-app chat** - Click the support widget in the Flagsmith dashboard - **Email** - [support@flagsmith.com](mailto:support@flagsmith.com) - **Community** - [Discord](https://discord.gg/hFhxNtXzgm) -- **Trust Centre** - [trust.flagsmith.com](https://trust.flagsmith.com) + +### Security and Compliance + +Security questionnaires, compliance documentation and our SOC 2 Type 2 report are handled through the +**[Flagsmith Trust Centre](https://trust.flagsmith.com)** rather than the support channels above. Go there to: + +- Review our security posture, certifications and sub-processors +- Request access to compliance reports and policies +- Complete or shortcut a vendor security review + +Common questions about SOC 2, ISO 27001, GDPR and vendor security reviews are answered in the +[Security & Compliance FAQ](/support/faq/security-compliance). + +To report a security vulnerability, see [CVEs and Vulnerabilities](./cves-and-vulnerabilities.md). ### Enterprise Support From e15be4749a5ef2934e9c90392aacbbbae6f49993 Mon Sep 17 00:00:00 2001 From: BakirFS Date: Fri, 21 Aug 2026 14:51:07 +0200 Subject: [PATCH 2/4] fixing pr comments --- docs/docs/support/faq/security-compliance.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/docs/support/faq/security-compliance.mdx b/docs/docs/support/faq/security-compliance.mdx index 05a54201d66f..1bc249ac98ae 100644 --- a/docs/docs/support/faq/security-compliance.mdx +++ b/docs/docs/support/faq/security-compliance.mdx @@ -30,9 +30,9 @@ Security, compliance and vendor review documentation lives in the **[Flagsmith Trust Centre](https://trust.flagsmith.com)**. It is the single, current source for our certifications, reports and policies — start there for any of the questions below. -### Is Flagsmith SOC 2 certified? +### Does Flagsmith have a SOC 2 report? -Yes, Flagsmith is SOC 2 Type 2 certified. Request the report through the +Yes. Flagsmith has completed a SOC 2 Type 2 examination. Request the report through the [Trust Centre](https://trust.flagsmith.com). ### How does Flagsmith handle GDPR and data processing agreements? From 0a7748719512755600e96983cf5e28687bb97a06 Mon Sep 17 00:00:00 2001 From: BakirFS Date: Thu, 3 Sep 2026 11:12:23 +0200 Subject: [PATCH 3/4] pr comments fixes --- docs/docs/support/faq/account-billing-organisation.mdx | 2 +- docs/docs/support/faq/index.mdx | 2 +- docs/docs/support/faq/security-compliance.mdx | 3 +-- docs/docs/support/index.mdx | 2 +- 4 files changed, 4 insertions(+), 5 deletions(-) diff --git a/docs/docs/support/faq/account-billing-organisation.mdx b/docs/docs/support/faq/account-billing-organisation.mdx index 3901c0ed9616..01e491d2d856 100644 --- a/docs/docs/support/faq/account-billing-organisation.mdx +++ b/docs/docs/support/faq/account-billing-organisation.mdx @@ -73,4 +73,4 @@ documentation, through the [Flagsmith Trust Centre](https://trust.flagsmith.com) ## Related FAQ Categories - [Open Source & Self-Hosted](/support/faq/open-source-self-hosted) - Questions about SSO and authentication in self-hosted deployments -- [Security & Compliance](/support/faq/security-compliance) - Questions about SOC 2, ISO 27001, GDPR and vendor reviews +- [Security & Compliance](/support/faq/security-compliance) - Questions about SOC 2, GDPR and vendor reviews diff --git a/docs/docs/support/faq/index.mdx b/docs/docs/support/faq/index.mdx index 10c271d20acd..697b5cf9f05c 100644 --- a/docs/docs/support/faq/index.mdx +++ b/docs/docs/support/faq/index.mdx @@ -78,7 +78,7 @@ import Link from '@docusaurus/Link';

    Security & Compliance

    -

    SOC 2, ISO 27001, GDPR, penetration tests, sub-processors, security questionnaires

    +

    SOC 2, GDPR, penetration tests, sub-processors, security questionnaires

    diff --git a/docs/docs/support/faq/security-compliance.mdx b/docs/docs/support/faq/security-compliance.mdx index 1bc249ac98ae..2f3349a87d47 100644 --- a/docs/docs/support/faq/security-compliance.mdx +++ b/docs/docs/support/faq/security-compliance.mdx @@ -3,12 +3,11 @@ title: Security & Compliance - FAQ sidebar_label: Security & Compliance sidebar_position: 8 description: - Flagsmith security and compliance FAQ - SOC 2 Type 2, ISO 27001, GDPR, penetration tests, sub-processors and security + Flagsmith security and compliance FAQ - SOC 2 Type 2, GDPR, penetration tests, sub-processors and security questionnaires. keywords: - SOC 2 - SOC2 - - ISO 27001 - GDPR - DPA - penetration test diff --git a/docs/docs/support/index.mdx b/docs/docs/support/index.mdx index 3421c1519a4d..7b8561c7dc66 100644 --- a/docs/docs/support/index.mdx +++ b/docs/docs/support/index.mdx @@ -90,7 +90,7 @@ Security questionnaires, compliance documentation and our SOC 2 Type 2 report ar - Request access to compliance reports and policies - Complete or shortcut a vendor security review -Common questions about SOC 2, ISO 27001, GDPR and vendor security reviews are answered in the +Common questions about SOC 2, GDPR and vendor security reviews are answered in the [Security & Compliance FAQ](/support/faq/security-compliance). To report a security vulnerability, see [CVEs and Vulnerabilities](./cves-and-vulnerabilities.md). From d6530f7db3d205f08a54995c9186d1d3786b2cce Mon Sep 17 00:00:00 2001 From: BakirFS Date: Thu, 3 Sep 2026 11:37:03 +0200 Subject: [PATCH 4/4] contact support if you have outsdanding questions --- docs/docs/support/index.mdx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/docs/support/index.mdx b/docs/docs/support/index.mdx index 7b8561c7dc66..a7f015df5c48 100644 --- a/docs/docs/support/index.mdx +++ b/docs/docs/support/index.mdx @@ -83,13 +83,16 @@ depending on your issue type. ### Security and Compliance -Security questionnaires, compliance documentation and our SOC 2 Type 2 report are handled through the +Security questionnaires, compliance documentation and our SOC 2 Type 2 report start at the **[Flagsmith Trust Centre](https://trust.flagsmith.com)** rather than the support channels above. Go there to: - Review our security posture, certifications and sub-processors - Request access to compliance reports and policies - Complete or shortcut a vendor security review +If your questionnaire still has outstanding items once you have checked the Trust Centre, email +[support@flagsmith.com](mailto:support@flagsmith.com) with the specific questions that remain. + Common questions about SOC 2, GDPR and vendor security reviews are answered in the [Security & Compliance FAQ](/support/faq/security-compliance).