Trust centre
Trust is part of what we teach.
Simblia teaches people to stay safe online, so we hold ourselves to the same standard. This is how we build and operate the platform, with an honest status on every item.
Last updated
3 November 2026
Security questions: security@simblia.com
Our commitments
EU only
All data is stored and processed in the EU by Scaleway, a European cloud provider.
No ads, no data selling
We never sell or share data for marketing.
Designed for children
As little data as possible, nothing public by default, no messages between learners.
Safe simulations
The Scam Lab never sends real messages or uses pupils' own accounts.
Compliance
| Framework | Status | How we address it |
|---|---|---|
| GDPR | Active | Simblia's standard DPA and records of processing; an impact assessment for children's data is completed before pupils' data enters the platform |
| NIS2 | Active | Operated as if the requirements applied to us; we support customers' own obligations |
| EU AI Act | Active | Transparency about AI features; people approve all AI-assisted content |
| Cyber Resilience Act (CRA) | Active | The CRA's essential requirements (Annex I) are our security baseline for the website and the platform: secure by default, a minimal attack surface, no known exploitable vulnerabilities at release, monitored dependencies, and vulnerabilities handled under our responsible disclosure policy. We apply them whether or not our services are legally in scope. |
| Accessibility (EAA) | Active | WCAG 2.2 AA as the design target, automated checks on every change and a public accessibility statement |
| ISO 27001 | Roadmap | Information security management system built from day one; certification planned |
Our hosting provider
Simblia runs on Scaleway.
Simblia runs entirely on Scaleway, a French cloud provider. Scaleway SAS hosts our platform, databases, backups and transactional email in its data centres in Paris, and is listed as one of our sub-processors.
Scaleway's certifications
ISO/IEC 27001:2022
CertifiedInformation security management system, audited by an independent certification body.
CSA STAR Level 1
Self-assessmentPublished against the Cloud Security Alliance's Cloud Controls Matrix.
Who is responsible for what
Scaleway
Secures the data centres, hardware, network and the cloud services it provides.
Simblia
Secures everything we build and run on top: the application, its configuration, access control, encryption settings and how we handle your data.
These are Scaleway's certifications, not Simblia's. Simblia's own ISO 27001 certification is on our roadmap. Scaleway publishes its current certificates and their scope in the Scaleway Trust Center (opens in a new tab).
How we build and run Simblia
Expected controls for launch. Each one is confirmed against the real implementation before this page goes live.
Infrastructure and data separation
EU hosting on Scaleway with encryption in transit and at rest. Production, test and development run in separate accounts. Each customer's data is logically separated, and that separation is tested on every release. Infrastructure is defined as code and built on portable open standards.
Access and privileged access
No standing administrative access to production. Elevated access is approved by a second person, limited in time and removed automatically. Staff use phishing-resistant multi-factor authentication, and access rights are reviewed every quarter.
Logging and monitoring
Security-relevant events are logged centrally in the EU, protected against tampering and kept for 12 months. Automated alerts cover unusual sign-ins, privilege changes and traffic spikes, with monitoring around the clock.
Secure development
A secure development lifecycle mapped to OWASP SAMM, OWASP ASVS and NIST SSDF. Every change is peer reviewed and scanned before release, and a software bill of materials is produced for each release.
Vulnerability management
Continuous scanning of systems and dependencies. Proposed fix times: critical within 72 hours, high within 14 days, medium within 60 days. Independent penetration testing before general release and every year after.
Incident response
A written incident response plan. Customers are notified without undue delay and in time to meet GDPR's 72-hour duty, with support for their own NIS2 reporting. Every significant incident gets a blameless review.
AI and data
AI features run on EU-hosted models wherever possible. Learners' personal data is never used to train AI models, and people approve AI-assisted content before learners see it.
Retention and deletion
Data is kept while the contract is active and deleted within 30 days after it ends, with written confirmation. Once Unilogin is connected, pupils who leave a school are removed automatically.
Backup and recovery
Targets we design and test for.
Documents
Data processing agreement
Simblia's standard DPA · read the summary
Sub-processors list
Who processes data, and where · see the list
Security overview
For procurement and supplier assessments · on request
Found a vulnerability?
Researchers can report findings safely under our responsible disclosure policy.
Report to
security@simblia.com
Where is our data stored?
In the EU, with Scaleway in Paris, France.
Can we use our own DPA?
We work from Simblia's standard DPA, which covers public-sector requirements.
What is in place today?
Every item on this page is labelled with its status, and the page shows when it was last updated.