docs: add more visibility to trust.flagsmith.com

docs/docs/support/faq/account-billing-organisation.mdx

@@ -12,10 +12,6 @@ import Link from '@docusaurus/Link';
 
 <div className="faq-content">
 
-### Is Flagsmith SOC 2 certified?
-
-Yes, Flagsmith is SOC 2 Type 2 certified.
-
 ### How do I delete an Organisation?
 Go to **Organisation** > **Manage**. Scroll to the very bottom, click the trash can icon next to "Delete Organisation," and confirm the name. This is irreversible.
 
@@ -65,8 +61,16 @@ Go to **Organisation** > **Edit** > **Manage Invoices**.
 
 **Related:** [How do I update my payment details?](#how-do-i-update-my-payment-details)
 
+### Is Flagsmith SOC 2 certified?
+
+Yes, Flagsmith is SOC 2 Type 2 certified. You can request the report, along with our other certifications and security
+documentation, through the [Flagsmith Trust Centre](https://trust.flagsmith.com).
+
+**Related:** [Security & Compliance FAQ](/support/faq/security-compliance)
+
 </div>
 
 ## Related FAQ Categories
 
 - [Open Source & Self-Hosted](/support/faq/open-source-self-hosted) - Questions about SSO and authentication in self-hosted deployments
+- [Security & Compliance](/support/faq/security-compliance) - Questions about SOC 2, GDPR and vendor reviews

docs/docs/support/faq/index.mdx

@@ -18,6 +18,7 @@ import Link from '@docusaurus/Link';
     <li><Link to="/support/faq/feature-flags-remote-config#what-is-the-difference-between-feature-flag-and-remote-config">What is the difference between Feature Flag and Remote Config?</Link></li>
     <li><Link to="/support/faq/user-identity-management#how-do-i-identify-an-anonymous-user-what-about-running-ab-tests-with-anonymous-users">How do I identify an anonymous user?</Link></li>
     <li><Link to="/support/faq/segments-targeting#does-the--split-segment-feature-work-for-non-identified-users">Does the % split segment feature work for non-identified users?</Link></li>
+    <li><Link to="/support/faq/security-compliance#is-flagsmith-soc-2-certified">Is Flagsmith SOC 2 certified?</Link></li>
   </ul>
 </div>
 
@@ -72,6 +73,13 @@ import Link from '@docusaurus/Link';
       </div>
       <p>Hosting, API endpoints, Edge API, webhooks, A/B test bucketing</p>
     </Link>
+
+    <Link to="/support/faq/security-compliance" className="faq-category-card">
+      <div className="faq-category-header">
+        <h3>Security & Compliance</h3>
+      </div>
+      <p>SOC 2, GDPR, penetration tests, sub-processors, security questionnaires</p>
+    </Link>
   </div>
 </div>
 

docs/docs/support/faq/security-compliance.mdx

@@ -0,0 +1,62 @@
+---
+title: Security & Compliance - FAQ
+sidebar_label: Security & Compliance
+sidebar_position: 8
+description:
+  Flagsmith security and compliance FAQ - SOC 2 Type 2, GDPR, penetration tests, sub-processors and security
+  questionnaires.
+keywords:
+  - SOC 2
+  - SOC2
+  - GDPR
+  - DPA
+  - penetration test
+  - sub-processors
+  - security questionnaire
+  - compliance
+  - trust centre
+---
+
+import Link from '@docusaurus/Link';
+
+<span id="top" />
+
+<Link to="/support/faq">← Back to FAQ</Link>
+
+<div className="faq-content">
+
+Security, compliance and vendor review documentation lives in the
+**[Flagsmith Trust Centre](https://trust.flagsmith.com)**. It is the single, current source
+for our certifications, reports and policies — start there for any of the questions below.
+
+### Does Flagsmith have a SOC 2 report?
+
+Yes. Flagsmith has completed a SOC 2 Type 2 examination. Request the report through the
+[Trust Centre](https://trust.flagsmith.com).
+
+### How does Flagsmith handle GDPR and data processing agreements?
+
+Our privacy documentation, including the DPA and the list of sub-processors, is available through the
+[Trust Centre](https://trust.flagsmith.com).
+
+### Can you complete our vendor security questionnaire?
+
+Check the [Trust Centre FAQ](https://trust.flagsmith.com/faq#1-security-governance) first — most questionnaires can be answered in full from the
+documentation published there, which is faster than a manual review. If something is still outstanding, contact
+[support@flagsmith.com](mailto:support@flagsmith.com).
+
+### How do I report a security vulnerability?
+
+See [CVEs and Vulnerabilities](/support/cves-and-vulnerabilities) for how to report an issue and the remediation SLAs we
+work to. Do not report vulnerabilities through public GitHub issues.
+
+**Related documentation:** [Help and Support](/support#security-and-compliance)
+
+</div>
+
+## Related FAQ Categories
+
+- [Account, Billing & Organisation](/support/faq/account-billing-organisation) - Questions about accounts, SSO and
+  billing
+- [Open Source & Self-Hosted](/support/faq/open-source-self-hosted) - Questions about self-hosting and the Enterprise
+  Edition

docs/docs/support/index.mdx

@@ -80,7 +80,23 @@ depending on your issue type.
 - **In-app chat** - Click the support widget in the Flagsmith dashboard
 - **Email** - [support@flagsmith.com](mailto:support@flagsmith.com)
 - **Community** - [Discord](https://discord.gg/hFhxNtXzgm)
-- **Trust Centre** - [trust.flagsmith.com](https://trust.flagsmith.com)
+
+### Security and Compliance
+
+Security questionnaires, compliance documentation and our SOC 2 Type 2 report start at the
+**[Flagsmith Trust Centre](https://trust.flagsmith.com)** rather than the support channels above. Go there to:
+
+- Review our security posture, certifications and sub-processors
+- Request access to compliance reports and policies
+- Complete or shortcut a vendor security review
+
+If your questionnaire still has outstanding items once you have checked the Trust Centre, email
+[support@flagsmith.com](mailto:support@flagsmith.com) with the specific questions that remain.
+
+Common questions about SOC 2, GDPR and vendor security reviews are answered in the
+[Security & Compliance FAQ](/support/faq/security-compliance).
+
+To report a security vulnerability, see [CVEs and Vulnerabilities](./cves-and-vulnerabilities.md).
 
 ### Enterprise Support