Enterprise-grade security and compliance certifications you can trust.
Our cloud infrastructure and operational controls follow SOC 2 Type II framework principles for security, availability, and confidentiality.
Status: Framework Aligned
Practices: Security controls, monitoring, incident response
Note: Formal certification in progress
Information security management practices following ISO 27001 framework for systematic approach to managing sensitive information.
Status: Framework Aligned
Practices: ISMS policies, risk management, controls
Note: Formal certification in progress
Our products can be deployed in HIPAA-compliant configurations for healthcare organizations. Business Associate Agreements (BAA) available.
Status: Supported
Features: Encryption, audit logging, access controls
BAA: Available upon request
GoPhish Cloud supports organizations meeting PCI-DSS Requirement 12.6 for security awareness training and phishing simulation programs.
Status: Supported
Use Case: Security awareness training
Documentation: Auditor-ready reports
Our products support GDPR requirements through data minimization, encryption, access controls, and data subject rights. Self-hosted deployment ensures data stays within your jurisdiction.
Status: Supported
Features: Data sovereignty, right to deletion, encryption
Documentation: GDPR-ready data processing agreements
All HailBytes products are deployed with security hardening controls that align to CIS benchmarks, following industry-standard configuration best practices for secure infrastructure.
Status: Implemented
Alignment: CIS benchmarks and security best practices
Scope: All cloud deployments
We follow SOC 2 Type II and ISO 27001 security practices and controls, including systematic risk management, security monitoring, and incident response procedures.
Frameworks: SOC 2, ISO 27001 practices
Status: Following industry standards
Note: Practices implemented, certification in progress
Our security operations align with NIST CSF guidelines for identifying, protecting, detecting, responding to, and recovering from cybersecurity threats.
Status: Aligned
Framework: NIST CSF v1.1
Coverage: All five core functions
With self-hosted deployment on your AWS or Azure infrastructure, your data never leaves your control. Choose your deployment region to meet data residency requirements for GDPR, CCPA, and other privacy regulations.
Configurable data retention policies allow you to automatically purge old campaign data, scan results, and logs according to your compliance requirements. Support for data subject access requests and right to deletion under GDPR and CCPA.
Our products implement privacy-first architecture with data minimization, purpose limitation, and built-in consent management. All data processing occurs on your infrastructure, ensuring maximum privacy and control.
Comprehensive overview of our security architecture, practices, and controls for GoPhish Cloud and reNgine Cloud.
Download Whitepaper →Security assessment reports and compliance documentation available to enterprise customers.
Request Access →Annual third-party penetration testing reports available to enterprise customers.
Contact Sales →Our security team is here to help with compliance questionnaires, audits, and technical security documentation.
Contact Security Team →