LEGAL & TRUST

Security Statement

Effective date: 13 July 2026

Security by design

Angvlar Security Awareness is designed for authorised training and controlled simulation, not offensive use. Security controls are enforced server-side and are combined so that no single user action can bypass legal, tenant, domain, audience and campaign restrictions.

Core safeguards

Strict multi-tenant data separation and role-based access control.
Verified official domains and explicitly approved simulation domains.
DNS, SPF, DKIM, DMARC, SSL and authorisation readiness gates.
Campaign approval, scheduling, pause, kill-switch and incident-lock workflows.
CSRF protection, prepared database statements, output escaping and secure sessions.
Restricted file types, MIME validation, randomised filenames and blocked executable uploads.
Tokenised public links, hashed token storage and expiry controls.
Audit records for administrative, legal, campaign and security-sensitive actions.
Privacy-conscious event tracking, pseudonymisation and configurable retention.

No credential storage

Simulated pages must not store passwords, MFA codes, banking information, card data, identity documents, API keys, access tokens or other secrets. Only the educational event may be retained.

Operational security

Campaigns can be immediately paused and active links revoked. Incident mode blocks sensitive changes, records the reason, supports audit export and notifies responsible users.

Shared responsibility

Angvlar secures the platform and its operation. Customers must protect their accounts, maintain correct access assignments, obtain authorisation, configure domains correctly, review templates and use the service only within the signed scope.

Reporting concerns

Suspected vulnerabilities, misuse or security incidents should be reported through the contact details in the applicable agreement or the public Contact page. Please do not include real credentials or sensitive personal data in an initial report.