Phishing training on autopilot, that proves it ran.

That is the only thing it is built for. Fallax sends only to recipients you upload, delivered inside your own tenant, and every link points at your own landing page. Treat it like any other internal security test: get sign-off from HR or your works council before the first campaign, and tell people afterwards that the programme exists.

Nobody, which is the point. Switch the continuous programme on and every person gets their own schedule, with the cadence and difficulty set by how they handled the last one: frequent clickers are tested more often on easier lures, consistent reporters get the hardest ones less often. Each send lands at a random minute inside that person's working hours, and hard guardrails bound it: a monthly cap, a minimum gap between sends, and a pause that drops everything queued the moment you hit it.

No. When someone submits a simulated login form, Fallax records that a submission occurred and the field names only, never the values typed into them. There is no code path that persists a submitted password, so there is nothing for us, or an attacker, to leak.

It can't. Fallax never sends simulations over the public email system, so there is no sending domain and no SPF/DKIM/DMARC to configure. Each simulation is injected straight into the target's mailbox through your own Microsoft 365 or Google Workspace tenant, so nothing ever touches the deliverability of the domain your real business mail depends on.

Security awareness training is a control in nearly all of them, and they want the same artefact: a dated, per-person record that training happened. One Fallax export answers ISO 27001 A.6.3, SOC 2 CC1.4 and CC2.2, NIS2 Article 21(2)(g), DORA Article 13(6), PCI DSS 12.6.3.1, HIPAA §164.308(a)(5), GDPR Article 32 and NIST CSF PR.AT-01. Connect Vanta, Drata, Secureframe or Sprinto and Fallax files the same evidence for you, with a blocked or undelivered message never reported as completed training.

Yes, and the paperwork is published rather than promised. Customer data is stored in the European Union, all 4 sub-processors are EU-hosted and named in Annex III of our data processing agreement, and the DPA is incorporated into the terms, so there is nothing to negotiate before you start. Submitted credential values are never written to storage, there is no advertising or ad-tech tracking anywhere, and the one optional cookie, product analytics, stays switched off until you accept it. Read the privacy notice and DPA in full from the footer.

Sign-in is Google Workspace and Microsoft Entra ID out of the box, so there is no extra password for your admins to manage and access follows your directory. Production deployments are SSO-only; the email and password form exists only for local development.