What we can see, what we cannot, and how to check.

Summary

Phosigil runs on your network. The install contacts gateway.phosigil.com for licence check-in every 15 minutes, signed updates and the content library, and keeps working for 14 days without that connection. With Managed mode on (the default), AI prompts, SMS and voice numbers and scripts, and OSINT lookups also go through the gateway; set PHOSIGIL_MANAGED_MODE=false to keep them in-house. Everything else is a service you configured. Fully offline licensing is available on request. Nothing in the list below is analytics or usage telemetry beyond the fields named.

Recipient email addresses never go to the vendor. Phone numbers and prompt text reach the vendor only through Managed mode, and only when you use SMS, voice or AI features.

What leaves the server

To the vendor, or to a fixed third party the product itself calls

To services you configured

Your mail relay, email API or OAuth mailbox (recipient address, rendered email, your credentials). Your Twilio and ElevenLabs accounts when Managed mode is off. Your AI provider when Managed mode is off. Your SIEM (audit events), your webhook endpoints (signed campaign events), Slack or Teams for chat commands, your identity provider for sign-in, your LDAP directory for imports, and the URL an operator types when importing a page or fetching a logo. Each one is listed live in the product with the same detail as the table above.

What never leaves

• Recipient emails, names, results, click and open events, captured form data, training records, policy acknowledgements and the audit log stay in your database, except what you yourself forward through SIEM or webhooks.
• Geolocation of click IPs uses an offline database and never calls out.
• Landing pages and lures are rendered and served by your install.

Third parties

These organisations receive data only when Managed mode routes a request through gateway.phosigil.com. In the default self-managed configuration with Managed mode off, none of them receives anything. Each row repeats what the vendor's own public trust page stated on the date we checked it. Phosigil lists; it does not certify, and it does not display any badge of its own.

The hosting provider for gateway.phosigil.com will be named here once the legal entity and region are confirmed. The product's Compliance page carries the same list and refreshes it through the signed content channel.

Sub-processors

Phosigil is an on-premises product. In the default self-managed configuration, employee data is stored and processed on your own server and sent only to systems you configure. Those providers are your own vendors, not Phosigil sub-processors. The third parties above become sub-processors only for the specific Managed-mode request that reaches them, and only for the data in the table.

What the gateway itself retains

Feature	Retained on the gateway
AI generation, SMS, OSINT	Not stored; one usage log line per call (licence id, customer name, endpoint, time)
Voice	The synthesised clip is held in memory for minutes until the carrier fetches it; usage log line
Licence check-in	Stored per licence in the vendor console (install id, fingerprint hash, version, seat count, campaign count, install state)
Support tickets	Stored with attachments until 24 months after the ticket closes; each message is also emailed (text and a console link, never the files) to our support addresses

Change notice

We give customers at least 30 days' written notice before adding or replacing a sub-processor that will process customer personal data, by email to the registered contact and by updating this page. A customer may object in writing within that period; if the objection cannot be resolved, the customer may switch Managed mode off, which removes every third party above from the data flow, or end the affected Managed features without penalty.

Network requirements

Outbound from the Phosigil server

Destination	Port	Why	If blocked
gateway.phosigil.com	443/TCP	Licence check-in, signed updates, content library, Managed-mode relays, support tickets	Keeps working for 14 days, then shows the licence screen until reachable. Updates and new content stop.
Your SMTP server or email API	As configured	Sending simulations and training emails	Campaigns cannot send.
Your identity provider, LDAP, SIEM, webhooks	As configured	Only what you set up under Settings	That feature only.

• No inbound connection from the internet is required. Nothing listens on the internet unless you publish the platform's address yourself.
• Web filtering, Zscaler, Netskope, proxies: allow gateway.phosigil.com:443 by host name (the IP can change). TLS inspection is fine; the Windows install verifies HTTPS against the Windows certificate store. System proxy settings and HTTPS_PROXY, HTTP_PROXY, NO_PROXY are honoured. The installer tests the connection at the end.
• Inbound from your employees: the address and port you chose during setup, typically your own host name on 443 behind HTTPS. Emailed links use the address under Settings, Public links; it must resolve on your network.

Product security

• Sign-in: single sign-on (OIDC, SAML), MFA with authenticator apps and passkeys, backup codes, a break-glass account, lockout, IP allow-list and an optional sign-in challenge after repeated failures.
• Audit: every admin action is appended to a hash-chained log you can verify, export and stream to your SIEM.
• Updates: releases are signed (Ed25519) and checksummed; the install verifies both before applying. A software bill of materials (CycloneDX) ships with each release.
• Secrets: provider keys for the managed relays live only on our gateway. The customer artefact never holds them.
• Simulations: a second administrator must approve lures that mention pay, health, layoffs or legal action. SMS and voice carry a consent gate, quiet hours, caller-ID attestation and a suppression list.
• Testing: an automated test suite runs against every change; API hardening followed the OWASP API Security Top 10.

Documents

Phosigil does not currently hold a SOC 2 report or an ISO 27001 certificate, and we do not show badges we have not earned. The following are available to customers and evaluators:

• Data processing addendum and business associate agreement templates, for the optional Managed-mode relays.
• Employee notice templates: CCPA notice at collection, New York Labor Law §52-c electronic monitoring notice, and a simulation programme notice.
• Egress list, network requirements and sub-processor list, as shipped inside the product.
• Software bill of materials for the installed release.
• Third-party penetration test results and an accessibility conformance report, under NDA, when available.

Ask for any of these through the contact form.

Responsible disclosure

We want to hear about security problems in Phosigil before anyone else does. Email [email protected] with the affected version or host name, steps to reproduce, and the impact as you understand it. We acknowledge within 3 business days, triage within 10, and aim to fix within 90. We do not run a paid bounty programme; we credit researchers publicly with their consent, and good-faith research under the policy is authorised.

Read the full vulnerability disclosure policy