Why on-prem

A phishing-simulation vendor holds a list of everyone who fell for it. Ours is on your server.

Awareness data is sensitive. It names people, it records mistakes, and in regulated sectors it is subject to the same rules as the systems it protects. Phosigil keeps it where your other sensitive data already lives.

Data residency

Employee names, addresses, phone numbers, click and report events, training records, captured form data and the audit log are stored in a database on a server you run. Backups are yours. Retention is a setting you control, per data class.

No vendor access to employee data

There is no remote console, no support back door and no sync of results to us. We cannot see who clicked, and we do not need to. The only data we hold about an install is its licence check-in: an install id, a version and a seat count.

Works behind web filtering

Allow one host name, gateway.phosigil.com on port 443, and the install is fully functional. TLS inspection is fine: the Windows build trusts the Windows certificate store, and system proxy settings are honoured.

What leaves the server

Every outbound connection, published.

The product computes the list from its live configuration and shows it under Settings, License, "What leaves this server". The same list is on our security page, with each field named.

In one paragraph: the install contacts gateway.phosigil.com for licence check-in every 15 minutes, signed updates once a day and the content library once a day. With Managed mode on, AI prompts, SMS and voice numbers and OSINT lookups also go through the gateway; one setting keeps them in-house. Everything else is a service you configured: your mail relay, SIEM, webhooks, identity provider. Nothing in the list is analytics or usage telemetry beyond the fields named.

Read the egress list

What never leaves

Recipient email addresses, names and results
Click and open events, captured form data
Training records and policy acknowledgements
The audit log, unless you forward it to your own SIEM
Geolocation of click IPs: an offline database, no lookups
Landing pages and lures: rendered and served by your install

Offline grace

If our gateway is unreachable, nothing stops.

Campaigns keep sending, training keeps running, reports keep generating. The licence stays valid for 14 days without a successful check-in, then shows a licence screen until the connection returns.

Updates and new library content pause; everything already installed keeps working.
Managed AI, SMS and voice fall back to your own provider keys, or wait.
Air-gapped networks: fully offline licensing is available on request.

14 days

of full operation without the gateway, counted from the last successful check-in.

Our stance

We do not sell certifications. We give you evidence.

Some vendors show a wall of badges and a single compliance score. We think that misleads the people who have to answer an assessor.

What Phosigil says

"Evidence toward" a control, never "compliant with" a law.
Status words: Configured, Needs attention, Not configured, Unknown.
Third-party certifications shown as "vendor states", with the page and date they were read from.
"Confirm clause references and scope with your assessor" on every pack.

What Phosigil does not say

That it is certified under SOC 2, ISO 27001, HIPAA or FedRAMP. It is not, and those programmes do not certify products this way.
That any setting makes you compliant. The product cannot know whether you are a covered entity.
That a vendor-side report exists when it does not. Our document list shows a file only when there is one.

The compliance page in the product is tested for this: a check fails the build if the adjective form of "compliance" appears in the interface or API.

Next step

Ask us the hard questions.

Send your security questionnaire with the demo request. We answer it before the call.

Request a demo Security page