docs: add more visibility to trust.flagsmith.com - #8328
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review. 📝 WalkthroughWalkthroughAdded a Security & Compliance FAQ page covering SOC 2, GDPR, DPAs, security questionnaires, vulnerability reporting, and Trust Centre resources. Added links to the page from the FAQ index, the Account, Billing & Organisation FAQ, and the main support page. Expanded the support page with Trust Centre resources and vulnerability-reporting guidance. Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: 🟡 Moderate · up to The new security and compliance documentation may direct customers to FAQ content with potentially inaccurate SOC 2 terminology, which could create compliance-information confusion. Confirm and correct the wording before merging. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: eca16666-3869-4ba2-8039-9c84489cbda7
📒 Files selected for processing (4)
docs/docs/support/faq/account-billing-organisation.mdxdocs/docs/support/faq/index.mdxdocs/docs/support/faq/security-compliance.mdxdocs/docs/support/index.mdx
Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.
| ### Is Flagsmith SOC 2 certified? | ||
|
|
||
| Yes, Flagsmith is SOC 2 Type 2 certified. Request the report through the | ||
| [Trust Centre](https://trust.flagsmith.com). |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- security-compliance.mdx ---'
sed -n '1,60p' docs/docs/support/faq/security-compliance.mdx
printf '%s\n' '--- account-billing-organisation.mdx ---'
sed -n '50,85p' docs/docs/support/faq/account-billing-organisation.mdx
printf '%s\n' '--- FAQ index references ---'
sed -n '60,90p' docs/docs/support/faq/index.mdx
printf '%s\n' '--- repository references to SOC 2 and Trust Centre ---'
rg -n -i 'SOC 2|SOC2|Trust Centre|trust\.flagsmith\.com|ISO 27001' docs README.md .github 2>/dev/null | head -200Repository: Flagsmith/flagsmith
Length of output: 7047
🏁 Script executed:
#!/bin/bash
set -eu
for url in \
'https://trust.flagsmith.com' \
'https://trust.flagsmith.com/faq#1-security-governance' \
'https://trust.flagsmith.com/faq'
do
printf '\n--- %s ---\n' "$url"
curl -L --max-time 20 -sS "$url" | \
tr '\n' ' ' | \
sed -E 's/<script[^>]*>.*<\/script>//g; s/<style[^>]*>.*<\/style>//g; s/<[^>]+>/ /g; s/[[:space:]]+/ /g' | \
grep -Eio '.{0,180}(SOC ?2|SOC2|Type ?[12]|attestation|certif|examination|report).{0,300}' | \
head -40 || true
done
printf '\n--- public repository references and history summary ---\n'
rg -n -i 'SOC 2|SOC2|Type II|Type 2|attestation|examination report|certif' . \
-g '!node_modules' -g '!build' -g '!dist' | head -250
git log --oneline -20 -- docs/docs/support/faq/security-compliance.mdx docs/docs/support/faq/account-billing-organisation.mdx docs/docs/support/faq/index.mdxRepository: Flagsmith/flagsmith
Length of output: 4248
🌐 Web query:
Flagsmith SOC 2 Type 2 report current examination report SOC 2 certification
💡 Result:
Flagsmith is a fully accredited SOC 2 Type 2 organization [1][2][3][4]. As of August 2026, the company maintains this certification [5][4], and copies of their audit report are available to interested parties upon request through their official communication channels [2][3][6]. In addition to SOC 2 Type 2, the company also maintains ISO 27001 certification [4].
Citations:
- 1: https://docs.flagsmith.com/support/faq/account-billing-organisation
- 2: https://www.flagsmith.com/feature-flag-governance
- 3: https://www.flagsmith.com/enterprise
- 4: https://www.europeanstack.com/software/flagsmith
- 5: https://www.zendikt.com/product/flagsmith
- 6: https://www.flagsmith.com/ship-trustworthy-ai-powered-features
🌐 Web query:
site:aicpa-cima.com SOC 2 examination report certification Type 2 terminology
💡 Result:
A SOC 2 examination is an attestation engagement performed by an independent service auditor to evaluate an organization’s controls [1][2]. It is critical to note that there is no such thing as a SOC 2 "certification" [1][2]. The output of this engagement is a formal attestation report, not a certificate [1][2]. The terminology "Type 2" refers to a specific type of SOC 2 examination report [3]. The distinction between Type 1 and Type 2 reports lies in the scope and duration of the assessment [1][3]: Type 1 Report: An examination of the design and implementation of an organization's controls at a specific point in time [1][3]. Type 2 Report: An examination of the design, implementation, and operating effectiveness of an organization's controls over a specified period (typically 6 to 12 months) [1][3]. A SOC 2 Type 2 report includes the following core components [4]: Management’s assertion regarding the system and controls [4]. A description of the service organization’s system [4]. The service auditor’s opinion on the fairness of the description, the suitability of the design of controls, and the operating effectiveness of those controls throughout the specified period [4][3]. The specific tests of controls performed by the auditor and the results of those tests [4]. Because a SOC 2 engagement results in a report rather than a certification, organizations should not use terms like "SOC 2 Certified" in their marketing or communications [1][2]. Proper usage involves stating that an organization has "obtained a SOC 2 Type 2 report" or has "successfully completed a SOC 2 Type 2 examination" [1][2].
Citations:
- 1: https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy
- 2: https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2/
- 3: https://www.aicpa-cima.com/resources/download/illustrative-service-auditors-soc-2-r-type-2-report
- 4: https://www.aicpa-cima.com/resources/download/illustrative-soc-2-r-report-with-description-and-assertion
🌐 Web query:
site:flagsmith.com "SOC 2 Type 2"
💡 Result:
SOC 2 Type 2 is a compliance certification that verifies an organization's internal controls and processes related to information security over a specific period of time [1]. While SOC 2 Type 1 evaluates the design of an organization's security controls at a single point in time, SOC 2 Type 2 assesses whether those controls are not only designed correctly but also operating effectively over a sustained duration [2]. This makes Type 2 a more rigorous standard, as it provides evidence that the organization's security and data protection processes perform as intended during daily operations [2]. SOC 2 compliance, in general, focuses on organizational processes—such as software patching, access management, and vulnerability scanning—to ensure data security [1]. Organizations often pursue SOC 2 Type 2 certification to demonstrate their security maturity to customers and stakeholders, particularly in regulated industries where verifying operational security is a key requirement [2][3][4].
Citations:
- 1: https://www.flagsmith.com/podcast/armo
- 2: https://www.flagsmith.com/compare/flagsmith-vs-growthbook
- 3: https://www.flagsmith.com/podcast/moderne
- 4: https://www.flagsmith.com/podcast/project-calico
🌐 Web query:
site:docs.flagsmith.com "SOC 2 Type 2"
💡 Result:
A SOC 2 Type 2 report is an attestation of an organization's security controls over a specific period, typically covering how those controls operated in practice [1]. While a SOC 2 Type 1 report assesses the design of security controls at a single point in time, a SOC 2 Type 2 report evaluates both the design and the operational effectiveness of those controls over an extended duration, often spanning several months [1]. This allows auditors to verify that the controls not only exist but have been consistently applied throughout the observation period [1]. Organizations undergo SOC 2 Type 2 audits to demonstrate their commitment to data security and to meet the compliance requirements often requested by enterprise clients during procurement and partnership processes [2][1]. Obtaining this certification involves working with auditors to review system security, control implementation, and overall risk management practices [2][1].
Citations:
Use accurate SOC 2 terminology across both FAQ entries. SOC 2 produces an attestation report, not a certification. Replace “SOC 2 certified” with wording such as “completed a SOC 2 Type 2 examination” and “obtained a SOC 2 Type 2 report” in both files. Update the FAQ index anchor if the heading changes.
📍 Affects 2 files
docs/docs/support/faq/security-compliance.mdx#L33-L36(this comment)docs/docs/support/faq/account-billing-organisation.mdx#L64-L67
| ### Security and Compliance | ||
|
|
||
| Security questionnaires, compliance documentation and our SOC 2 Type 2 report are handled through the | ||
| Security questionnaires, compliance documentation and our SOC 2 Type 2 report start at the |
There was a problem hiding this comment.
This doesn't really make sense - I'm not sure why the change was necessary? The SOC 2 Type 2 report for example is categorically available on the trust centre so 'start at' doesn't make sense in that context. In my opinion, we should go back to what you had before. We can still add the fallback to support@flagsmith.com either way. People are still going to use that bail out regardless of whether we give it to them or not tbh!
2 participants
Thanks for submitting a PR! Please check the boxes below:
docs/if required so people know about the feature.How did you test this code?
Ran it locally