Strict company isolation
Every record belongs to one company. Access is checked on the server for every page, action and data request, never only in the browser.
TRUST CENTER
A security company
should earn your trust first.
Here's exactly how we protect your data, keep simulations safe and ethical, and what to do if you find a vulnerability.
PLATFORM SECURITY
Safeguards built into the product.
Least-privilege roles
Owners, admins and employees each see only what they need. Employees never see colleagues' results.
Verified sending domains
Real simulation emails only go to addresses on domains your company has proven it owns with a DNS record. Baitwise can't be used to phish outsiders.
Identifiable simulations
Every simulation carries an X-Baitwise-Simulation header, so your IT team can allow-list it and recognise it in logs.
Accurate results
Clicks by email security scanners (Microsoft, Google, Barracuda and any ranges you add) are filtered out, so no one is blamed for a robot's click.
Abuse & brute-force protection
Sign-ins, registrations, invitations and AI generation are rate-limited per IP, account and company.
ETHICAL SIMULATION
Test people
without hurting trust.
A phishing program only works if employees feel it's there to help them. These are the commitments we build into Baitwise and recommend to every customer.
- Simulations lead to a short lesson, never to a real login page that captures passwords.
- Individual results are visible only to your company's admins and owners.
- We recommend announcing the program (not individual emails) to employees before it starts.
- We advise against lures that exploit grief, health scares or fake bonuses that could cause real distress.
- Reporting is always rewarded, including when someone reports a real email by mistake.
PRIVACY & DATA
Your questions, answered.
What data does Baitwise store about employees?
Name, work email, role, department and job title; training assignments and quiz answers; and how they responded to simulations (reported, ignored, clicked or replied). We don't need or store anything else.
Where is data hosted, and who are your subprocessors?
Our current hosting location and the full list of subprocessors (hosting, email delivery, AI provider) are available on request, together with our data processing agreement. Email security@baitwise.al.
Is employee data used to train AI models?
No. The AI generator receives only your company profile (name, industry, size and the tools you use) and the instructions an admin types in. It never receives employee names, emails or results.
Can we sign a data processing agreement (DPA)?
Yes. A GDPR-aligned DPA is available for every paid plan.
What happens to our data if we leave?
You can export your results at any time. On request we delete your workspace, and all of its data is deleted with it.
RESPONSIBLE DISCLOSURE
Found a vulnerability?
Tell us first.
Email security@baitwise.al with the details and steps to reproduce. We'll acknowledge your report within 2 working days, keep you updated, and credit you once it's fixed if you'd like. Please don't access other customers' data or disrupt the service while testing.
Machine-readable contact details are published at /.well-known/security.txt.
BUILD A MORE SECURITY-AWARE TEAM
Better decisions start
with the right practice.
See Baitwise with your own scenarios in a 30-minute demo, or try it with your team, first month free.