Security & Compliance Program: SOC 2 Report, DPA, Subprocessors and Data Location

CanIPhish stores sensitive information about your employees, such as their phishing interactions and training results. We publish our security and compliance information in our Trust Centre at caniphish.com/security. This article summarizes what's there, how to get each document, and where your data is stored.

SOC 2 and SOC 3 reports

• SOC 2 Type 2 report: Sensiba, an AICPA-certified audit firm, finalized our SOC 2 Type 2 attestation report on 22 January 2026. It covers the trust services criteria for Security, Availability and Confidentiality. The report is confidential, so you need a CanIPhish account (any plan, including Free) to download it. Sign in, open the Trust Centre, select SOC 2 Type 2 Report, tick I have read and agree to the terms. and click Accept Terms and Download. If you don't have an account, request it using Request Security Policy Access (see below).
• SOC 3 report: also finalized by Sensiba on 22 January 2026, against the same criteria. Anyone can download it: select SOC 3 Report in the Trust Centre and click Download Report.

Legal documents, including our DPA

You can download these from the Legal Documents section of the Trust Centre:

• Data Processing Agreement (DPA). It forms part of our Terms & Conditions and covers the EU GDPR, the UK GDPR (including the UK International Data Transfer Addendum to the EU Standard Contractual Clauses) and the Swiss FADP. We give you written notice before adding or replacing a subprocessor, and you have 14 days to object.
• Terms & Conditions
• Privacy Policy
• Subscription & Service Level Agreement
• Mutual Non-Disclosure Agreement (NDA)
• Business Associate Agreement
• AI Transparency Statement

Security policies

You can request our security policies from the Trust Centre. Click Request Security Policy Access, select the documents you need (for example the Information Security Policy, Incident Response Plans, Business Continuity Plans or Disaster Recovery Plans), click Continue, enter your details and the reason for your request, and click Submit Request. Our policies are based on the NIST Cybersecurity Framework and the ACSC Information Security Manual.

Subprocessors

The Subprocessors section of the Trust Centre lists each third party we use, why we use it, what data it processes and where. Administrators can see the same list for their tenant, with data locations, under Platform Settings > Privacy Settings. On Enterprise, you can turn off non-essential subprocessors there. See Privacy Settings (Subprocessor Management) - Introduction.

Where your data is stored

You choose a Storage region when you sign up for CanIPhish. Partners choose one for each customer tenant when they create it. The options are United States of America, Australia, United Kingdom, Canada, South Africa, Germany, United Arab Emirates, Singapore, India and Brazil.

Your employee lists, phishing and training campaign statistics, employee risk scores and scheduled reports are stored in that region. The region is set when the tenant is created, and you can't change it yourself. To move a tenant to another region, contact the CanIPhish support team. Any active campaigns in the tenant need to be archived before the move. To check your tenant's region, click your profile icon at the top right, choose View User Profile and look for Data Storage Location under your Tenant ID.

A few subprocessors, such as those behind some AI and voice features, process data in other locations. The Privacy Settings article lists each one's data location.

How we protect your data

• Data is encrypted in transit with at least TLS 1.2, and at rest with at least AES-256.
• Multi-factor authentication is enforced for all access to our production AWS environment and to our subprocessors.
• We never sell your data to third parties.
• Our staff have police or criminal record checks when they join.
• Our controls include annual penetration testing, daily vulnerability scanning, daily database backups and a web application firewall. The full list is in the Trust Centre.

To protect your own tenant, you can turn on multi-factor authentication for platform users on any plan (Platform Settings > Authentication Settings). Enterprise plans can also use single sign-on.

Contact us

• For security, privacy or procurement questions, email support@caniphish.com.
• To report a security vulnerability, email security@caniphish.com.