Trust Center
Built to be trusted, on the record.
One page. Every document, every certification, every subprocessor. No NDA wall for the public stuff.
SOC 2 Type 2
Latest report dated November 2025. Available under NDA.
ISO 27001
Certified across our London and Dubai entities. Audit by BSI.
GDPR
EU SCCs and the UK IDTA in our standard DPA. DPO: privacy@simuphish.com.
CCPA
California consumer rights honoured globally. No sale of personal data.
UAE PDPL
Aligned terms for customers contracted out of our Dubai entity.
HIPAA
BAA available on Enterprise. Workforce training scopes covered.
How we run
Five pillars.
Compliance posture
SOC 2 Type 2 and ISO 27001 audits run annually. Customer pen testing welcome on 30 days notice.
Infrastructure
AWS across five regions. Encryption at rest with KMS managed AES-256. TLS 1.3 in transit. No customer data on engineer laptops.
Privacy by design
Aggregated views by default. Audit log every drill into individual data. No third party advertising tags.
Identity and access
SAML SSO and SCIM included on every plan. Break glass admin recovery with split key custody.
Residency
Local data residency in 170+ countries. EU only, US only, UAE only, India only available on Enterprise.
Subprocessors