docs: add more visibility to trust.flagsmith.com

docs/docs/support/faq/account-billing-organisation.mdx

@@ -12,10 +12,6 @@ import Link from '@docusaurus/Link';
 
 <div className="faq-content">
 
-### Is Flagsmith SOC 2 certified?
-
-Yes, Flagsmith is SOC 2 Type 2 certified.
-
 ### How do I delete an Organisation?
 Go to **Organisation** > **Manage**. Scroll to the very bottom, click the trash can icon next to "Delete Organisation," and confirm the name. This is irreversible.
 
@@ -65,8 +61,16 @@ Go to **Organisation** > **Edit** > **Manage Invoices**.
 
 **Related:** [How do I update my payment details?](#how-do-i-update-my-payment-details)
 
+### Is Flagsmith SOC 2 certified?
+
+Yes, Flagsmith is SOC 2 Type 2 certified. You can request the report, along with our other certifications and security
+documentation, through the [Flagsmith Trust Centre](https://trust.flagsmith.com).
+
+**Related:** [Security & Compliance FAQ](/support/faq/security-compliance)
+
 </div>
 
 ## Related FAQ Categories
 
 - [Open Source & Self-Hosted](/support/faq/open-source-self-hosted) - Questions about SSO and authentication in self-hosted deployments
+- [Security & Compliance](/support/faq/security-compliance) - Questions about SOC 2, GDPR and vendor reviews

docs/docs/support/faq/index.mdx

@@ -18,6 +18,7 @@ import Link from '@docusaurus/Link';
     <li><Link to="/support/faq/feature-flags-remote-config#what-is-the-difference-between-feature-flag-and-remote-config">What is the difference between Feature Flag and Remote Config?</Link></li>
     <li><Link to="/support/faq/user-identity-management#how-do-i-identify-an-anonymous-user-what-about-running-ab-tests-with-anonymous-users">How do I identify an anonymous user?</Link></li>
     <li><Link to="/support/faq/segments-targeting#does-the--split-segment-feature-work-for-non-identified-users">Does the % split segment feature work for non-identified users?</Link></li>
+    <li><Link to="/support/faq/security-compliance#is-flagsmith-soc-2-certified">Is Flagsmith SOC 2 certified?</Link></li>
   </ul>
 </div>
 
@@ -72,6 +73,13 @@ import Link from '@docusaurus/Link';
       </div>
       <p>Hosting, API endpoints, Edge API, webhooks, A/B test bucketing</p>
     </Link>
+
+    <Link to="/support/faq/security-compliance" className="faq-category-card">
+      <div className="faq-category-header">
+        <h3>Security & Compliance</h3>
+      </div>
+      <p>SOC 2, GDPR, penetration tests, sub-processors, security questionnaires</p>
+    </Link>
   </div>
 </div>
 

docs/docs/support/faq/security-compliance.mdx

@@ -0,0 +1,62 @@
+---
+title: Security & Compliance - FAQ
+sidebar_label: Security & Compliance
+sidebar_position: 8
+description:
+  Flagsmith security and compliance FAQ - SOC 2 Type 2, GDPR, penetration tests, sub-processors and security
+  questionnaires.
+keywords:
+  - SOC 2
+  - SOC2
+  - GDPR
+  - DPA
+  - penetration test
+  - sub-processors
+  - security questionnaire
+  - compliance
+  - trust centre
+---
+
+import Link from '@docusaurus/Link';
+
+<span id="top" />
+
+<Link to="/support/faq">← Back to FAQ</Link>
+
+<div className="faq-content">
+
+Security, compliance and vendor review documentation lives in the
+**[Flagsmith Trust Centre](https://trust.flagsmith.com)**. It is the single, current source
+for our certifications, reports and policies — start there for any of the questions below.
+
+### Does Flagsmith have a SOC 2 report?
+
+Yes. Flagsmith has completed a SOC 2 Type 2 examination. Request the report through the
+[Trust Centre](https://trust.flagsmith.com).
+
+### How does Flagsmith handle GDPR and data processing agreements?
+
+Our privacy documentation, including the DPA and the list of sub-processors, is available through the
+[Trust Centre](https://trust.flagsmith.com).
+
+### Can you complete our vendor security questionnaire?
+
+Check the [Trust Centre FAQ](https://trust.flagsmith.com/faq#1-security-governance) first — most questionnaires can be answered in full from the
+documentation published there, which is faster than a manual review. If something is still outstanding, contact
+[support@flagsmith.com](mailto:support@flagsmith.com).
+
+### How do I report a security vulnerability?
+
+See [CVEs and Vulnerabilities](/support/cves-and-vulnerabilities) for how to report an issue and the remediation SLAs we
+work to. Do not report vulnerabilities through public GitHub issues.
+
+**Related documentation:** [Help and Support](/support#security-and-compliance)
+
+</div>
+
+## Related FAQ Categories
+
+- [Account, Billing & Organisation](/support/faq/account-billing-organisation) - Questions about accounts, SSO and
+  billing
+- [Open Source & Self-Hosted](/support/faq/open-source-self-hosted) - Questions about self-hosting and the Enterprise
+  Edition

docs/docs/support/index.mdx

@@ -15,22 +15,23 @@ assistants can help you navigate the codebase quickly - point them at the
 
 Beyond that, many issues have already been solved. A quick search can save you time:
 
-- **[FAQ](/support/faq)** - Browse answers to common questions by category
-- **[GitHub Issues](https://github.com/Flagsmith/flagsmith/issues)** - Search open and closed issues for your problem
-- **[Release Notes](https://github.com/Flagsmith/flagsmith/releases)** - Check if your issue was fixed in a newer version
-- **SDK Repositories** - Check issues in your specific SDK repo:
-  - [Python](https://github.com/Flagsmith/flagsmith-python-client)
-  - [JavaScript/Node.js](https://github.com/Flagsmith/flagsmith-nodejs-client)
-  - [React/Next.js](https://github.com/Flagsmith/flagsmith-js-client)
-  - [Java](https://github.com/Flagsmith/flagsmith-java-client)
-  - [.NET](https://github.com/Flagsmith/flagsmith-dotnet-client)
-  - [Go](https://github.com/Flagsmith/flagsmith-go-client)
-  - [Ruby](https://github.com/Flagsmith/flagsmith-ruby-client)
-  - [iOS/Swift](https://github.com/Flagsmith/flagsmith-ios-client)
-  - [Android/Kotlin](https://github.com/Flagsmith/flagsmith-kotlin-android-client)
-  - [Flutter](https://github.com/Flagsmith/flagsmith-flutter-client)
-  - [Rust](https://github.com/Flagsmith/flagsmith-rust-client)
-  - [Elixir](https://github.com/Flagsmith/flagsmith-elixir-client)
+-   **[FAQ](/support/faq)** - Browse answers to common questions by category
+-   **[GitHub Issues](https://github.com/Flagsmith/flagsmith/issues)** - Search open and closed issues for your problem
+-   **[Release Notes](https://github.com/Flagsmith/flagsmith/releases)** - Check if your issue was fixed in a newer
+    version
+-   **SDK Repositories** - Check issues in your specific SDK repo:
+    -   [Python](https://github.com/Flagsmith/flagsmith-python-client)
+    -   [JavaScript/Node.js](https://github.com/Flagsmith/flagsmith-nodejs-client)
+    -   [React/Next.js](https://github.com/Flagsmith/flagsmith-js-client)
+    -   [Java](https://github.com/Flagsmith/flagsmith-java-client)
+    -   [.NET](https://github.com/Flagsmith/flagsmith-dotnet-client)
+    -   [Go](https://github.com/Flagsmith/flagsmith-go-client)
+    -   [Ruby](https://github.com/Flagsmith/flagsmith-ruby-client)
+    -   [iOS/Swift](https://github.com/Flagsmith/flagsmith-ios-client)
+    -   [Android/Kotlin](https://github.com/Flagsmith/flagsmith-kotlin-android-client)
+    -   [Flutter](https://github.com/Flagsmith/flagsmith-flutter-client)
+    -   [Rust](https://github.com/Flagsmith/flagsmith-rust-client)
+    -   [Elixir](https://github.com/Flagsmith/flagsmith-elixir-client)
 
 ## What We Need From You
 
@@ -39,56 +40,72 @@ depending on your issue type.
 
 ### SDK or API Issues
 
-- Which SDK and exact version number
-- Are you using a server-side or client-side environment key?
-- Your initialisation code and flag evaluation code (sanitised)
-- What you expected to happen vs what actually happened
-- Exact error messages, stack traces, or console output
+-   Which SDK and exact version number
+-   Are you using a server-side or client-side environment key?
+-   Your initialisation code and flag evaluation code (sanitised)
+-   What you expected to happen vs what actually happened
+-   Exact error messages, stack traces, or console output
 
 ### Self-Hosted Infrastructure
 
-- Flagsmith version (Docker image tag, e.g. `v2.221.1`)
-- Deployment method and version (Helm chart version, Docker Compose, etc.)
-- Relevant Helm values or Docker configuration (sanitised - remove secrets)
-- Database type and version (PostgreSQL version, managed vs self-hosted)
-- Container logs from the relevant service (API, task processor, SSE). For Docker: `docker logs <container_name>`. For
-  Kubernetes: `kubectl logs <pod_name> -c <container_name>`. Include the full output, not just the error line - context
-  around the error often matters.
-- For real-time/SSE issues: Redis configuration details
-- For upgrade issues: which version you upgraded from and to
+-   Flagsmith version (Docker image tag, e.g. `v2.221.1`)
+-   Deployment method and version (Helm chart version, Docker Compose, etc.)
+-   Relevant Helm values or Docker configuration (sanitised - remove secrets)
+-   Database type and version (PostgreSQL version, managed vs self-hosted)
+-   Container logs from the relevant service (API, task processor, SSE). For Docker: `docker logs <container_name>`. For
+    Kubernetes: `kubectl logs <pod_name> -c <container_name>`. Include the full output, not just the error line -
+    context around the error often matters.
+-   For real-time/SSE issues: Redis configuration details
+-   For upgrade issues: which version you upgraded from and to
 
 ### Dashboard or UI Issues
 
-- Screenshot or short screen recording showing the problem
-- Steps to reproduce - what you clicked, in what order
-- Which project, environment, and flag name are affected
-- Browser and version
-- Any errors in the browser console (open with F12 -> Console tab)
-- For API/network issues: a
-  [HAR file](https://support.zendesk.com/hc/en-us/articles/4408828867098-Workflow-Generating-a-HAR-file-for-troubleshooting)
-  captures the exact request/response cycle and is extremely helpful. Note: HAR files can contain sensitive data like
-  auth tokens - sanitise before sharing.
+-   Screenshot or short screen recording showing the problem
+-   Steps to reproduce - what you clicked, in what order
+-   Which project, environment, and flag name are affected
+-   Browser and version
+-   Any errors in the browser console (open with F12 -> Console tab)
+-   For API/network issues: a
+    [HAR file](https://support.zendesk.com/hc/en-us/articles/4408828867098-Workflow-Generating-a-HAR-file-for-troubleshooting)
+    captures the exact request/response cycle and is extremely helpful. Note: HAR files can contain sensitive data like
+    auth tokens - sanitise before sharing.
 
 ### SaaS Account or Billing Issues
 
-- Your organisation name in Flagsmith
-- Which project and environment is affected
-- For billing issues: your subscription plan and the change you're requesting
+-   Your organisation name in Flagsmith
+-   Which project and environment is affected
+-   For billing issues: your subscription plan and the change you're requesting
 
 ## Getting in Touch
 
-- **In-app chat** - Click the support widget in the Flagsmith dashboard
-- **Email** - [support@flagsmith.com](mailto:support@flagsmith.com)
-- **Community** - [Discord](https://discord.gg/hFhxNtXzgm)
-- **Trust Centre** - [trust.flagsmith.com](https://trust.flagsmith.com)
+-   **In-app chat** - Click the support widget in the Flagsmith dashboard
+-   **Email** - [support@flagsmith.com](mailto:support@flagsmith.com)
+-   **Community** - [Discord](https://discord.gg/hFhxNtXzgm)
+
+### Security and Compliance
+
+Security questionnaires, compliance documentation and our SOC 2 Type 2 report are handled through the
+**[Flagsmith Trust Centre](https://trust.flagsmith.com)** rather than the support channels above. Go there to:
+
+-   Review our security posture, certifications and sub-processors
+-   Request access to compliance reports and policies
+-   Complete or shortcut a vendor security review
+
+If your questionnaire still has outstanding items once you have checked the Trust Centre, email
+[support@flagsmith.com](mailto:support@flagsmith.com) with the specific questions that remain.
+
+Common questions about SOC 2, GDPR and vendor security reviews are answered in the
+[Security & Compliance FAQ](/support/faq/security-compliance).
+
+To report a security vulnerability, see [CVEs and Vulnerabilities](./cves-and-vulnerabilities.md).
 
 ### Enterprise Support
 
 [Flagsmith Enterprise](https://www.flagsmith.com/pricing) customers can also use these support channels:
 
-- Dedicated Customer Success manager for personalised assistance and training.
-- Shared Slack channel for real-time group support between your organisation and the Flagsmith team (available as an
-  add-on).
+-   Dedicated Customer Success manager for personalised assistance and training.
+-   Shared Slack channel for real-time group support between your organisation and the Flagsmith team (available as an
+    add-on).
 
 ## Bug Reports and Pull Requests
 
@@ -99,10 +116,10 @@ or code change, you can open an issue or pull request directly in the
 
 Other repositories:
 
-- [Edge Proxy](https://github.com/Flagsmith/edge-proxy)
-- [Terraform provider](https://github.com/Flagsmith/terraform-provider-flagsmith)
-- [Flagsmith CLI](https://github.com/Flagsmith/flagsmith-cli)
-- [Kubernetes Helm charts](https://github.com/Flagsmith/flagsmith-charts)
+-   [Edge Proxy](https://github.com/Flagsmith/edge-proxy)
+-   [Terraform provider](https://github.com/Flagsmith/terraform-provider-flagsmith)
+-   [Flagsmith CLI](https://github.com/Flagsmith/flagsmith-cli)
+-   [Kubernetes Helm charts](https://github.com/Flagsmith/flagsmith-charts)
 
 ## CVEs and Vulnerability Reports
 
@@ -118,4 +135,5 @@ Severity is assigned using CVSS together with the exploitability of the componen
 
 Flagsmith evaluates exploitability for each reported finding.
 
-For further details on how we handle CVEs, and how to report them, see [CVEs and Vulnerabilities](./cves-and-vulnerabilities.md).
+For further details on how we handle CVEs, and how to report them, see
+[CVEs and Vulnerabilities](./cves-and-vulnerabilities.md).