TheSimpleClub GmbH

TheSimpleClub GmbH publishes an ISO certificate on its trust center; you can request access through SOC2C.

TheSimpleClub GmbH publishes a DPA on its trust center; you can request access through SOC2C.

Security isn't a single yes/no, but TheSimpleClub GmbH is SOC 2 compliant and holds GDPR, ISO 27001. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

TheSimpleClub GmbH hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@simpleclub.com or via a /security page (TheSimpleClub GmbH lists a security contact).

TheSimpleClub GmbH lists 10 subprocessors on its trust center, including Google Cloud Platform, Braze, Cloudflare, Zendesk, Ory. Buyers use this for fourth-party risk review.

TheSimpleClub GmbH hosts on GCP, Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Focus Learning Topics, Watched, started and completed videos, lessons and exercises. Data residency details are on its trust center.

TheSimpleClub GmbH publishes a DPA on its trust center. You can request access through SOC2C.

TheSimpleClub GmbH's trust center is at https://trust.simpleclub.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Wherever possible or feasible and it is not possible to use Google Single Sign-on (SSO), passwords for confidential systems shall be configured for at least: - twelve (12) or more characters - The password should be randomly generated using the password manager - Passwords shall be set to lock out after 6 failed attempts - Initial passwords must be set to a unique value and changed after first log in - For manual password resets, a user’s identity must be verified prior to changing passwords - Enforce appropriate account lockout and brute-force protection on account access - Passwords must not be used twice_ - The reuse of passwords is not allowed

Yes, SSO is available to customers via common protocols. https://docs.simpleclub.com/docs/sso/keatkog5qma9j-getting-started

No, MFA support is not currently available. However, we are working on implementing of an MFA solution by the end of 2025.

Yes, we encrypt data at rest, particularly for confidential information.

All data at rest is encrypted via GCP by default: https://cloud.google.com/docs/security/encryption/default-encryption

Yes, all data in transit is encrypted using at least TLS version 1.2.

The cryptographic keys are managed by simpleclub using GCP Key-Management.

No, that is not possible at this time.

All servers are located in the EU.

Yes, this is generally compliant with GDPR. First of all, processing takes place on EU servers. In addition, all US providers used by simpleclub are certified under the US-EU Data Privacy Framework. This means that the requirements for the EU Commission's adequacy decision are met and data transfer in accordance with Art. 45 GDPR is permitted.

Yes, all sub-processors we use are certified to at least ISO 27001 or SOC 2 Type 2, thus ensuring an adequate level of protection for all relevant processing activities. In addition, the sub-processors used by simpleclub are evaluated as part of our annual security assessments.

All sub-processors used are certified to at least ISO 27001 or SOC 2 Type 2 and are themselves audited annually by independent bodies. These audit reports are reviewed annually by simpleclub as part of our own ISO27001-certified ISMS, and a security assessment is carried out.