docs: add more visibility to trust.flagsmith.com - #8328
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
📝 WalkthroughWalkthroughAdded a Security & Compliance FAQ page covering SOC 2, GDPR, DPAs, security questionnaires, vulnerability reporting, and Trust Centre resources. Added links to this page from the FAQ index, the Account, Billing & Organisation FAQ, and the main support page. Expanded the support page with Trust Centre resources and vulnerability-reporting guidance. Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: 🟡 Moderate · up to The documentation currently advertises ISO 27001 without matching content, uses inaccurate “SOC 2 certified” terminology, and gives conflicting questionnaire-routing instructions. These issues could mislead customers about compliance status and where to request support, so the PR is not merge-ready until the wording, scope, and routing are aligned. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: eca16666-3869-4ba2-8039-9c84489cbda7
📒 Files selected for processing (4)
docs/docs/support/faq/account-billing-organisation.mdxdocs/docs/support/faq/index.mdxdocs/docs/support/faq/security-compliance.mdxdocs/docs/support/index.mdx
Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.
| description: | ||
| Flagsmith security and compliance FAQ - SOC 2 Type 2, ISO 27001, GDPR, penetration tests, sub-processors and security | ||
| questionnaires. | ||
| keywords: | ||
| - SOC 2 | ||
| - SOC2 | ||
| - ISO 27001 | ||
| - GDPR | ||
| - DPA | ||
| - penetration test | ||
| - sub-processors | ||
| - security questionnaire | ||
| - compliance | ||
| - trust centre |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Align all ISO 27001 references with the actual FAQ scope. The navigation advertises ISO 27001, but the target page does not document it.
docs/docs/support/faq/security-compliance.mdx#L5-L18: add an ISO 27001 status/scope answer or remove the topic from the metadata.docs/docs/support/faq/index.mdx#L77-L82: update the category description if the FAQ content is not expanded.docs/docs/support/faq/account-billing-organisation.mdx#L75-L76: update the related-category description to match the final FAQ scope.
📍 Affects 3 files
docs/docs/support/faq/security-compliance.mdx#L5-L18(this comment)docs/docs/support/faq/index.mdx#L77-L82docs/docs/support/faq/account-billing-organisation.mdx#L75-L76
| ### Is Flagsmith SOC 2 certified? | ||
|
|
||
| Yes, Flagsmith is SOC 2 Type 2 certified. Request the report through the | ||
| [Trust Centre](https://trust.flagsmith.com). |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- security-compliance.mdx ---'
sed -n '1,60p' docs/docs/support/faq/security-compliance.mdx
printf '%s\n' '--- account-billing-organisation.mdx ---'
sed -n '50,85p' docs/docs/support/faq/account-billing-organisation.mdx
printf '%s\n' '--- FAQ index references ---'
sed -n '60,90p' docs/docs/support/faq/index.mdx
printf '%s\n' '--- repository references to SOC 2 and Trust Centre ---'
rg -n -i 'SOC 2|SOC2|Trust Centre|trust\.flagsmith\.com|ISO 27001' docs README.md .github 2>/dev/null | head -200Repository: Flagsmith/flagsmith
Length of output: 7047
🏁 Script executed:
#!/bin/bash
set -eu
for url in \
'https://trust.flagsmith.com' \
'https://trust.flagsmith.com/faq#1-security-governance' \
'https://trust.flagsmith.com/faq'
do
printf '\n--- %s ---\n' "$url"
curl -L --max-time 20 -sS "$url" | \
tr '\n' ' ' | \
sed -E 's/<script[^>]*>.*<\/script>//g; s/<style[^>]*>.*<\/style>//g; s/<[^>]+>/ /g; s/[[:space:]]+/ /g' | \
grep -Eio '.{0,180}(SOC ?2|SOC2|Type ?[12]|attestation|certif|examination|report).{0,300}' | \
head -40 || true
done
printf '\n--- public repository references and history summary ---\n'
rg -n -i 'SOC 2|SOC2|Type II|Type 2|attestation|examination report|certif' . \
-g '!node_modules' -g '!build' -g '!dist' | head -250
git log --oneline -20 -- docs/docs/support/faq/security-compliance.mdx docs/docs/support/faq/account-billing-organisation.mdx docs/docs/support/faq/index.mdxRepository: Flagsmith/flagsmith
Length of output: 4248
🌐 Web query:
Flagsmith SOC 2 Type 2 report current examination report SOC 2 certification
💡 Result:
Flagsmith is a fully accredited SOC 2 Type 2 organization [1][2][3][4]. As of August 2026, the company maintains this certification [5][4], and copies of their audit report are available to interested parties upon request through their official communication channels [2][3][6]. In addition to SOC 2 Type 2, the company also maintains ISO 27001 certification [4].
Citations:
- 1: https://docs.flagsmith.com/support/faq/account-billing-organisation
- 2: https://www.flagsmith.com/feature-flag-governance
- 3: https://www.flagsmith.com/enterprise
- 4: https://www.europeanstack.com/software/flagsmith
- 5: https://www.zendikt.com/product/flagsmith
- 6: https://www.flagsmith.com/ship-trustworthy-ai-powered-features
🌐 Web query:
site:aicpa-cima.com SOC 2 examination report certification Type 2 terminology
💡 Result:
A SOC 2 examination is an attestation engagement performed by an independent service auditor to evaluate an organization’s controls [1][2]. It is critical to note that there is no such thing as a SOC 2 "certification" [1][2]. The output of this engagement is a formal attestation report, not a certificate [1][2]. The terminology "Type 2" refers to a specific type of SOC 2 examination report [3]. The distinction between Type 1 and Type 2 reports lies in the scope and duration of the assessment [1][3]: Type 1 Report: An examination of the design and implementation of an organization's controls at a specific point in time [1][3]. Type 2 Report: An examination of the design, implementation, and operating effectiveness of an organization's controls over a specified period (typically 6 to 12 months) [1][3]. A SOC 2 Type 2 report includes the following core components [4]: Management’s assertion regarding the system and controls [4]. A description of the service organization’s system [4]. The service auditor’s opinion on the fairness of the description, the suitability of the design of controls, and the operating effectiveness of those controls throughout the specified period [4][3]. The specific tests of controls performed by the auditor and the results of those tests [4]. Because a SOC 2 engagement results in a report rather than a certification, organizations should not use terms like "SOC 2 Certified" in their marketing or communications [1][2]. Proper usage involves stating that an organization has "obtained a SOC 2 Type 2 report" or has "successfully completed a SOC 2 Type 2 examination" [1][2].
Citations:
- 1: https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy
- 2: https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2/
- 3: https://www.aicpa-cima.com/resources/download/illustrative-service-auditors-soc-2-r-type-2-report
- 4: https://www.aicpa-cima.com/resources/download/illustrative-soc-2-r-report-with-description-and-assertion
🌐 Web query:
site:flagsmith.com "SOC 2 Type 2"
💡 Result:
SOC 2 Type 2 is a compliance certification that verifies an organization's internal controls and processes related to information security over a specific period of time [1]. While SOC 2 Type 1 evaluates the design of an organization's security controls at a single point in time, SOC 2 Type 2 assesses whether those controls are not only designed correctly but also operating effectively over a sustained duration [2]. This makes Type 2 a more rigorous standard, as it provides evidence that the organization's security and data protection processes perform as intended during daily operations [2]. SOC 2 compliance, in general, focuses on organizational processes—such as software patching, access management, and vulnerability scanning—to ensure data security [1]. Organizations often pursue SOC 2 Type 2 certification to demonstrate their security maturity to customers and stakeholders, particularly in regulated industries where verifying operational security is a key requirement [2][3][4].
Citations:
- 1: https://www.flagsmith.com/podcast/armo
- 2: https://www.flagsmith.com/compare/flagsmith-vs-growthbook
- 3: https://www.flagsmith.com/podcast/moderne
- 4: https://www.flagsmith.com/podcast/project-calico
🌐 Web query:
site:docs.flagsmith.com "SOC 2 Type 2"
💡 Result:
A SOC 2 Type 2 report is an attestation of an organization's security controls over a specific period, typically covering how those controls operated in practice [1]. While a SOC 2 Type 1 report assesses the design of security controls at a single point in time, a SOC 2 Type 2 report evaluates both the design and the operational effectiveness of those controls over an extended duration, often spanning several months [1]. This allows auditors to verify that the controls not only exist but have been consistently applied throughout the observation period [1]. Organizations undergo SOC 2 Type 2 audits to demonstrate their commitment to data security and to meet the compliance requirements often requested by enterprise clients during procurement and partnership processes [2][1]. Obtaining this certification involves working with auditors to review system security, control implementation, and overall risk management practices [2][1].
Citations:
Use accurate SOC 2 terminology across both FAQ entries. SOC 2 produces an attestation report, not a certification. Replace “SOC 2 certified” with wording such as “completed a SOC 2 Type 2 examination” and “obtained a SOC 2 Type 2 report” in both files. Update the FAQ index anchor if the heading changes.
📍 Affects 2 files
docs/docs/support/faq/security-compliance.mdx#L33-L36(this comment)docs/docs/support/faq/account-billing-organisation.mdx#L64-L67
| ### Security and Compliance | ||
|
|
||
| Security questionnaires, compliance documentation and our SOC 2 Type 2 report are handled through the | ||
| **[Flagsmith Trust Centre](https://trust.flagsmith.com)** rather than the support channels above. Go there to: | ||
|
|
||
| - Review our security posture, certifications and sub-processors | ||
| - Request access to compliance reports and policies | ||
| - Complete or shortcut a vendor security review | ||
|
|
||
| Common questions about SOC 2, ISO 27001, GDPR and vendor security reviews are answered in the | ||
| [Security & Compliance FAQ](/support/faq/security-compliance). | ||
|
|
||
| To report a security vulnerability, see [CVEs and Vulnerabilities](./cves-and-vulnerabilities.md). |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Make the questionnaire routing consistent.
This section says questionnaires are handled through the Trust Centre rather than support channels. However, the Security & Compliance FAQ tells users to contact support@flagsmith.com when a questionnaire remains outstanding. State the exception explicitly, or use the same route in both pages.
1 participant
Thanks for submitting a PR! Please check the boxes below:
docs/if required so people know about the feature.How did you test this code?
Ran it locally