From a6c679fdca9017d58bc8ee6ff11910130642fefe Mon Sep 17 00:00:00 2001 From: BakirFS Date: Thu, 20 Aug 2026 11:10:54 +0200 Subject: [PATCH 1/5] added security faq and other docs pointing to trust.flagsmith.com --- .../faq/account-billing-organisation.mdx | 12 ++-- docs/docs/support/faq/index.mdx | 8 +++ docs/docs/support/faq/security-compliance.mdx | 63 +++++++++++++++++++ docs/docs/support/index.mdx | 15 ++++- 4 files changed, 93 insertions(+), 5 deletions(-) create mode 100644 docs/docs/support/faq/security-compliance.mdx diff --git a/docs/docs/support/faq/account-billing-organisation.mdx b/docs/docs/support/faq/account-billing-organisation.mdx index fc7dbf129822..3901c0ed9616 100644 --- a/docs/docs/support/faq/account-billing-organisation.mdx +++ b/docs/docs/support/faq/account-billing-organisation.mdx @@ -12,10 +12,6 @@ import Link from '@docusaurus/Link';
-### Is Flagsmith SOC 2 certified? - -Yes, Flagsmith is SOC 2 Type 2 certified. - ### How do I delete an Organisation? Go to **Organisation** > **Manage**. Scroll to the very bottom, click the trash can icon next to "Delete Organisation," and confirm the name. This is irreversible. @@ -65,8 +61,16 @@ Go to **Organisation** > **Edit** > **Manage Invoices**. **Related:** [How do I update my payment details?](#how-do-i-update-my-payment-details) +### Is Flagsmith SOC 2 certified? + +Yes, Flagsmith is SOC 2 Type 2 certified. You can request the report, along with our other certifications and security +documentation, through the [Flagsmith Trust Centre](https://trust.flagsmith.com). + +**Related:** [Security & Compliance FAQ](/support/faq/security-compliance) +
## Related FAQ Categories - [Open Source & Self-Hosted](/support/faq/open-source-self-hosted) - Questions about SSO and authentication in self-hosted deployments +- [Security & Compliance](/support/faq/security-compliance) - Questions about SOC 2, ISO 27001, GDPR and vendor reviews diff --git a/docs/docs/support/faq/index.mdx b/docs/docs/support/faq/index.mdx index 99ca67e2720d..10c271d20acd 100644 --- a/docs/docs/support/faq/index.mdx +++ b/docs/docs/support/faq/index.mdx @@ -18,6 +18,7 @@ import Link from '@docusaurus/Link';
  • What is the difference between Feature Flag and Remote Config?
  • How do I identify an anonymous user?
  • Does the % split segment feature work for non-identified users?
    • +
  • Is Flagsmith SOC 2 certified?
    • @@ -72,6 +73,13 @@ import Link from '@docusaurus/Link';

    Hosting, API endpoints, Edge API, webhooks, A/B test bucketing

    + + +
    +

    Security & Compliance

    +
    +

    SOC 2, ISO 27001, GDPR, penetration tests, sub-processors, security questionnaires

    + diff --git a/docs/docs/support/faq/security-compliance.mdx b/docs/docs/support/faq/security-compliance.mdx new file mode 100644 index 000000000000..05a54201d66f --- /dev/null +++ b/docs/docs/support/faq/security-compliance.mdx @@ -0,0 +1,63 @@ +--- +title: Security & Compliance - FAQ +sidebar_label: Security & Compliance +sidebar_position: 8 +description: + Flagsmith security and compliance FAQ - SOC 2 Type 2, ISO 27001, GDPR, penetration tests, sub-processors and security + questionnaires. +keywords: + - SOC 2 + - SOC2 + - ISO 27001 + - GDPR + - DPA + - penetration test + - sub-processors + - security questionnaire + - compliance + - trust centre +--- + +import Link from '@docusaurus/Link'; + + + +← Back to FAQ + +
    + +Security, compliance and vendor review documentation lives in the +**[Flagsmith Trust Centre](https://trust.flagsmith.com)**. It is the single, current source +for our certifications, reports and policies — start there for any of the questions below. + +### Is Flagsmith SOC 2 certified? + +Yes, Flagsmith is SOC 2 Type 2 certified. Request the report through the +[Trust Centre](https://trust.flagsmith.com). + +### How does Flagsmith handle GDPR and data processing agreements? + +Our privacy documentation, including the DPA and the list of sub-processors, is available through the +[Trust Centre](https://trust.flagsmith.com). + +### Can you complete our vendor security questionnaire? + +Check the [Trust Centre FAQ](https://trust.flagsmith.com/faq#1-security-governance) first — most questionnaires can be answered in full from the +documentation published there, which is faster than a manual review. If something is still outstanding, contact +[support@flagsmith.com](mailto:support@flagsmith.com). + +### How do I report a security vulnerability? + +See [CVEs and Vulnerabilities](/support/cves-and-vulnerabilities) for how to report an issue and the remediation SLAs we +work to. Do not report vulnerabilities through public GitHub issues. + +**Related documentation:** [Help and Support](/support#security-and-compliance) + +
    + +## Related FAQ Categories + +- [Account, Billing & Organisation](/support/faq/account-billing-organisation) - Questions about accounts, SSO and + billing +- [Open Source & Self-Hosted](/support/faq/open-source-self-hosted) - Questions about self-hosting and the Enterprise + Edition diff --git a/docs/docs/support/index.mdx b/docs/docs/support/index.mdx index f45b4c68a403..3421c1519a4d 100644 --- a/docs/docs/support/index.mdx +++ b/docs/docs/support/index.mdx @@ -80,7 +80,20 @@ depending on your issue type. - **In-app chat** - Click the support widget in the Flagsmith dashboard - **Email** - [support@flagsmith.com](mailto:support@flagsmith.com) - **Community** - [Discord](https://discord.gg/hFhxNtXzgm) -- **Trust Centre** - [trust.flagsmith.com](https://trust.flagsmith.com) + +### Security and Compliance + +Security questionnaires, compliance documentation and our SOC 2 Type 2 report are handled through the +**[Flagsmith Trust Centre](https://trust.flagsmith.com)** rather than the support channels above. Go there to: + +- Review our security posture, certifications and sub-processors +- Request access to compliance reports and policies +- Complete or shortcut a vendor security review + +Common questions about SOC 2, ISO 27001, GDPR and vendor security reviews are answered in the +[Security & Compliance FAQ](/support/faq/security-compliance). + +To report a security vulnerability, see [CVEs and Vulnerabilities](./cves-and-vulnerabilities.md). ### Enterprise Support From e15be4749a5ef2934e9c90392aacbbbae6f49993 Mon Sep 17 00:00:00 2001 From: BakirFS Date: Fri, 21 Aug 2026 14:51:07 +0200 Subject: [PATCH 2/5] fixing pr comments --- docs/docs/support/faq/security-compliance.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/docs/support/faq/security-compliance.mdx b/docs/docs/support/faq/security-compliance.mdx index 05a54201d66f..1bc249ac98ae 100644 --- a/docs/docs/support/faq/security-compliance.mdx +++ b/docs/docs/support/faq/security-compliance.mdx @@ -30,9 +30,9 @@ Security, compliance and vendor review documentation lives in the **[Flagsmith Trust Centre](https://trust.flagsmith.com)**. It is the single, current source for our certifications, reports and policies — start there for any of the questions below. -### Is Flagsmith SOC 2 certified? +### Does Flagsmith have a SOC 2 report? -Yes, Flagsmith is SOC 2 Type 2 certified. Request the report through the +Yes. Flagsmith has completed a SOC 2 Type 2 examination. Request the report through the [Trust Centre](https://trust.flagsmith.com). ### How does Flagsmith handle GDPR and data processing agreements? From 0a7748719512755600e96983cf5e28687bb97a06 Mon Sep 17 00:00:00 2001 From: BakirFS Date: Thu, 3 Sep 2026 11:12:23 +0200 Subject: [PATCH 3/5] pr comments fixes --- docs/docs/support/faq/account-billing-organisation.mdx | 2 +- docs/docs/support/faq/index.mdx | 2 +- docs/docs/support/faq/security-compliance.mdx | 3 +-- docs/docs/support/index.mdx | 2 +- 4 files changed, 4 insertions(+), 5 deletions(-) diff --git a/docs/docs/support/faq/account-billing-organisation.mdx b/docs/docs/support/faq/account-billing-organisation.mdx index 3901c0ed9616..01e491d2d856 100644 --- a/docs/docs/support/faq/account-billing-organisation.mdx +++ b/docs/docs/support/faq/account-billing-organisation.mdx @@ -73,4 +73,4 @@ documentation, through the [Flagsmith Trust Centre](https://trust.flagsmith.com) ## Related FAQ Categories - [Open Source & Self-Hosted](/support/faq/open-source-self-hosted) - Questions about SSO and authentication in self-hosted deployments -- [Security & Compliance](/support/faq/security-compliance) - Questions about SOC 2, ISO 27001, GDPR and vendor reviews +- [Security & Compliance](/support/faq/security-compliance) - Questions about SOC 2, GDPR and vendor reviews diff --git a/docs/docs/support/faq/index.mdx b/docs/docs/support/faq/index.mdx index 10c271d20acd..697b5cf9f05c 100644 --- a/docs/docs/support/faq/index.mdx +++ b/docs/docs/support/faq/index.mdx @@ -78,7 +78,7 @@ import Link from '@docusaurus/Link';

    Security & Compliance

    -

    SOC 2, ISO 27001, GDPR, penetration tests, sub-processors, security questionnaires

    +

    SOC 2, GDPR, penetration tests, sub-processors, security questionnaires

    diff --git a/docs/docs/support/faq/security-compliance.mdx b/docs/docs/support/faq/security-compliance.mdx index 1bc249ac98ae..2f3349a87d47 100644 --- a/docs/docs/support/faq/security-compliance.mdx +++ b/docs/docs/support/faq/security-compliance.mdx @@ -3,12 +3,11 @@ title: Security & Compliance - FAQ sidebar_label: Security & Compliance sidebar_position: 8 description: - Flagsmith security and compliance FAQ - SOC 2 Type 2, ISO 27001, GDPR, penetration tests, sub-processors and security + Flagsmith security and compliance FAQ - SOC 2 Type 2, GDPR, penetration tests, sub-processors and security questionnaires. keywords: - SOC 2 - SOC2 - - ISO 27001 - GDPR - DPA - penetration test diff --git a/docs/docs/support/index.mdx b/docs/docs/support/index.mdx index 3421c1519a4d..7b8561c7dc66 100644 --- a/docs/docs/support/index.mdx +++ b/docs/docs/support/index.mdx @@ -90,7 +90,7 @@ Security questionnaires, compliance documentation and our SOC 2 Type 2 report ar - Request access to compliance reports and policies - Complete or shortcut a vendor security review -Common questions about SOC 2, ISO 27001, GDPR and vendor security reviews are answered in the +Common questions about SOC 2, GDPR and vendor security reviews are answered in the [Security & Compliance FAQ](/support/faq/security-compliance). To report a security vulnerability, see [CVEs and Vulnerabilities](./cves-and-vulnerabilities.md). From d6530f7db3d205f08a54995c9186d1d3786b2cce Mon Sep 17 00:00:00 2001 From: BakirFS Date: Thu, 3 Sep 2026 11:37:03 +0200 Subject: [PATCH 4/5] contact support if you have outsdanding questions --- docs/docs/support/index.mdx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/docs/support/index.mdx b/docs/docs/support/index.mdx index 7b8561c7dc66..a7f015df5c48 100644 --- a/docs/docs/support/index.mdx +++ b/docs/docs/support/index.mdx @@ -83,13 +83,16 @@ depending on your issue type. ### Security and Compliance -Security questionnaires, compliance documentation and our SOC 2 Type 2 report are handled through the +Security questionnaires, compliance documentation and our SOC 2 Type 2 report start at the **[Flagsmith Trust Centre](https://trust.flagsmith.com)** rather than the support channels above. Go there to: - Review our security posture, certifications and sub-processors - Request access to compliance reports and policies - Complete or shortcut a vendor security review +If your questionnaire still has outstanding items once you have checked the Trust Centre, email +[support@flagsmith.com](mailto:support@flagsmith.com) with the specific questions that remain. + Common questions about SOC 2, GDPR and vendor security reviews are answered in the [Security & Compliance FAQ](/support/faq/security-compliance). From 3502c5383510146db5f3d7938c3707960472ea07 Mon Sep 17 00:00:00 2001 From: BakirFS Date: Mon, 28 Sep 2026 09:43:09 +0200 Subject: [PATCH 5/5] pr comment fix --- docs/docs/support/index.mdx | 116 ++++++++++++++++++------------------ 1 file changed, 59 insertions(+), 57 deletions(-) diff --git a/docs/docs/support/index.mdx b/docs/docs/support/index.mdx index a7f015df5c48..799150a3c833 100644 --- a/docs/docs/support/index.mdx +++ b/docs/docs/support/index.mdx @@ -15,22 +15,23 @@ assistants can help you navigate the codebase quickly - point them at the Beyond that, many issues have already been solved. A quick search can save you time: -- **[FAQ](/support/faq)** - Browse answers to common questions by category -- **[GitHub Issues](https://github.com/Flagsmith/flagsmith/issues)** - Search open and closed issues for your problem -- **[Release Notes](https://github.com/Flagsmith/flagsmith/releases)** - Check if your issue was fixed in a newer version -- **SDK Repositories** - Check issues in your specific SDK repo: - - [Python](https://github.com/Flagsmith/flagsmith-python-client) - - [JavaScript/Node.js](https://github.com/Flagsmith/flagsmith-nodejs-client) - - [React/Next.js](https://github.com/Flagsmith/flagsmith-js-client) - - [Java](https://github.com/Flagsmith/flagsmith-java-client) - - [.NET](https://github.com/Flagsmith/flagsmith-dotnet-client) - - [Go](https://github.com/Flagsmith/flagsmith-go-client) - - [Ruby](https://github.com/Flagsmith/flagsmith-ruby-client) - - [iOS/Swift](https://github.com/Flagsmith/flagsmith-ios-client) - - [Android/Kotlin](https://github.com/Flagsmith/flagsmith-kotlin-android-client) - - [Flutter](https://github.com/Flagsmith/flagsmith-flutter-client) - - [Rust](https://github.com/Flagsmith/flagsmith-rust-client) - - [Elixir](https://github.com/Flagsmith/flagsmith-elixir-client) +- **[FAQ](/support/faq)** - Browse answers to common questions by category +- **[GitHub Issues](https://github.com/Flagsmith/flagsmith/issues)** - Search open and closed issues for your problem +- **[Release Notes](https://github.com/Flagsmith/flagsmith/releases)** - Check if your issue was fixed in a newer + version +- **SDK Repositories** - Check issues in your specific SDK repo: + - [Python](https://github.com/Flagsmith/flagsmith-python-client) + - [JavaScript/Node.js](https://github.com/Flagsmith/flagsmith-nodejs-client) + - [React/Next.js](https://github.com/Flagsmith/flagsmith-js-client) + - [Java](https://github.com/Flagsmith/flagsmith-java-client) + - [.NET](https://github.com/Flagsmith/flagsmith-dotnet-client) + - [Go](https://github.com/Flagsmith/flagsmith-go-client) + - [Ruby](https://github.com/Flagsmith/flagsmith-ruby-client) + - [iOS/Swift](https://github.com/Flagsmith/flagsmith-ios-client) + - [Android/Kotlin](https://github.com/Flagsmith/flagsmith-kotlin-android-client) + - [Flutter](https://github.com/Flagsmith/flagsmith-flutter-client) + - [Rust](https://github.com/Flagsmith/flagsmith-rust-client) + - [Elixir](https://github.com/Flagsmith/flagsmith-elixir-client) ## What We Need From You @@ -39,56 +40,56 @@ depending on your issue type. ### SDK or API Issues -- Which SDK and exact version number -- Are you using a server-side or client-side environment key? -- Your initialisation code and flag evaluation code (sanitised) -- What you expected to happen vs what actually happened -- Exact error messages, stack traces, or console output +- Which SDK and exact version number +- Are you using a server-side or client-side environment key? +- Your initialisation code and flag evaluation code (sanitised) +- What you expected to happen vs what actually happened +- Exact error messages, stack traces, or console output ### Self-Hosted Infrastructure -- Flagsmith version (Docker image tag, e.g. `v2.221.1`) -- Deployment method and version (Helm chart version, Docker Compose, etc.) -- Relevant Helm values or Docker configuration (sanitised - remove secrets) -- Database type and version (PostgreSQL version, managed vs self-hosted) -- Container logs from the relevant service (API, task processor, SSE). For Docker: `docker logs `. For - Kubernetes: `kubectl logs -c `. Include the full output, not just the error line - context - around the error often matters. -- For real-time/SSE issues: Redis configuration details -- For upgrade issues: which version you upgraded from and to +- Flagsmith version (Docker image tag, e.g. `v2.221.1`) +- Deployment method and version (Helm chart version, Docker Compose, etc.) +- Relevant Helm values or Docker configuration (sanitised - remove secrets) +- Database type and version (PostgreSQL version, managed vs self-hosted) +- Container logs from the relevant service (API, task processor, SSE). For Docker: `docker logs `. For + Kubernetes: `kubectl logs -c `. Include the full output, not just the error line - + context around the error often matters. +- For real-time/SSE issues: Redis configuration details +- For upgrade issues: which version you upgraded from and to ### Dashboard or UI Issues -- Screenshot or short screen recording showing the problem -- Steps to reproduce - what you clicked, in what order -- Which project, environment, and flag name are affected -- Browser and version -- Any errors in the browser console (open with F12 -> Console tab) -- For API/network issues: a - [HAR file](https://support.zendesk.com/hc/en-us/articles/4408828867098-Workflow-Generating-a-HAR-file-for-troubleshooting) - captures the exact request/response cycle and is extremely helpful. Note: HAR files can contain sensitive data like - auth tokens - sanitise before sharing. +- Screenshot or short screen recording showing the problem +- Steps to reproduce - what you clicked, in what order +- Which project, environment, and flag name are affected +- Browser and version +- Any errors in the browser console (open with F12 -> Console tab) +- For API/network issues: a + [HAR file](https://support.zendesk.com/hc/en-us/articles/4408828867098-Workflow-Generating-a-HAR-file-for-troubleshooting) + captures the exact request/response cycle and is extremely helpful. Note: HAR files can contain sensitive data like + auth tokens - sanitise before sharing. ### SaaS Account or Billing Issues -- Your organisation name in Flagsmith -- Which project and environment is affected -- For billing issues: your subscription plan and the change you're requesting +- Your organisation name in Flagsmith +- Which project and environment is affected +- For billing issues: your subscription plan and the change you're requesting ## Getting in Touch -- **In-app chat** - Click the support widget in the Flagsmith dashboard -- **Email** - [support@flagsmith.com](mailto:support@flagsmith.com) -- **Community** - [Discord](https://discord.gg/hFhxNtXzgm) +- **In-app chat** - Click the support widget in the Flagsmith dashboard +- **Email** - [support@flagsmith.com](mailto:support@flagsmith.com) +- **Community** - [Discord](https://discord.gg/hFhxNtXzgm) ### Security and Compliance -Security questionnaires, compliance documentation and our SOC 2 Type 2 report start at the +Security questionnaires, compliance documentation and our SOC 2 Type 2 report are handled through the **[Flagsmith Trust Centre](https://trust.flagsmith.com)** rather than the support channels above. Go there to: -- Review our security posture, certifications and sub-processors -- Request access to compliance reports and policies -- Complete or shortcut a vendor security review +- Review our security posture, certifications and sub-processors +- Request access to compliance reports and policies +- Complete or shortcut a vendor security review If your questionnaire still has outstanding items once you have checked the Trust Centre, email [support@flagsmith.com](mailto:support@flagsmith.com) with the specific questions that remain. @@ -102,9 +103,9 @@ To report a security vulnerability, see [CVEs and Vulnerabilities](./cves-and-vu [Flagsmith Enterprise](https://www.flagsmith.com/pricing) customers can also use these support channels: -- Dedicated Customer Success manager for personalised assistance and training. -- Shared Slack channel for real-time group support between your organisation and the Flagsmith team (available as an - add-on). +- Dedicated Customer Success manager for personalised assistance and training. +- Shared Slack channel for real-time group support between your organisation and the Flagsmith team (available as an + add-on). ## Bug Reports and Pull Requests @@ -115,10 +116,10 @@ or code change, you can open an issue or pull request directly in the Other repositories: -- [Edge Proxy](https://github.com/Flagsmith/edge-proxy) -- [Terraform provider](https://github.com/Flagsmith/terraform-provider-flagsmith) -- [Flagsmith CLI](https://github.com/Flagsmith/flagsmith-cli) -- [Kubernetes Helm charts](https://github.com/Flagsmith/flagsmith-charts) +- [Edge Proxy](https://github.com/Flagsmith/edge-proxy) +- [Terraform provider](https://github.com/Flagsmith/terraform-provider-flagsmith) +- [Flagsmith CLI](https://github.com/Flagsmith/flagsmith-cli) +- [Kubernetes Helm charts](https://github.com/Flagsmith/flagsmith-charts) ## CVEs and Vulnerability Reports @@ -134,4 +135,5 @@ Severity is assigned using CVSS together with the exploitability of the componen Flagsmith evaluates exploitability for each reported finding. -For further details on how we handle CVEs, and how to report them, see [CVEs and Vulnerabilities](./cves-and-vulnerabilities.md). +For further details on how we handle CVEs, and how to report them, see +[CVEs and Vulnerabilities](./cves-and-vulnerabilities.md).