{ "name": "BroadNet compliance and data protection", "description": "Certifications and attestations, memberships, data residency by market and data-handling controls, as published on the BroadNet Trust Center.", "publisher": { "name": "BroadNet Technologies Sarl", "url": "https://www.broadnet.me" }, "source": "https://www.broadnet.me/trust", "reviewed": "2026-10-02", "certifications": [ { "name": "ISO/IEC 27001:2022", "category": "certification", "recognizedBy": "International Organization for Standardization", "scope": "ISMS covering the messaging platform, operator products, customer-data handling and supplier relationships.", "auditCycle": "Annual surveillance · 3-year re-certification", "availability": "Certificate and Statement of Applicability under NDA.", "verify": "https://www.iafcertsearch.org/", "confirmed": "2026-07-25" }, { "name": "ISO/IEC 27018", "category": "certification", "recognizedBy": "International Organization for Standardization", "scope": "Protection of personal data (PII) in BroadNet's cloud messaging services. ISO/IEC 27018 is the cloud-privacy code of practice that extends the ISO 27001 ISMS.", "auditCycle": "Assessed with the ISO 27001 ISMS", "availability": "Certificate copy shared under NDA.", "verify": "https://www.iafcertsearch.org/", "confirmed": "2026-07-25" }, { "name": "ISO 9001:2015", "category": "certification", "recognizedBy": "International Organization for Standardization", "scope": "Quality Management System for the design, delivery and support of telecom messaging products.", "auditCycle": "Annual surveillance audit", "availability": "Certificate copy shared under NDA.", "verify": "https://www.iafcertsearch.org/", "confirmed": "2026-07-25" }, { "name": "ISO 22301", "category": "certification", "recognizedBy": "International Organization for Standardization", "scope": "Business Continuity Management — incident response, recovery objectives and supplier-failure scenarios.", "auditCycle": "Annual audit · continuity plan tested every year", "availability": "Certificate and continuity plan summary under NDA.", "verify": "https://www.iafcertsearch.org/", "confirmed": "2026-07-25" }, { "name": "SOC 2 Type II", "category": "attestation", "recognizedBy": "American Institute of Certified Public Accountants", "scope": "Trust Services Criteria: Security, Availability and Confidentiality, over a defined reporting period.", "auditCycle": "Annual reporting period", "availability": "Full report under NDA. SOC 2 reports are not published in a public register.", "verify": "https://www.broadnet.me/trust/audit-reports", "confirmed": "2026-07-25" }, { "name": "GDPR (EU General Data Protection Regulation)", "category": "compliance", "recognizedBy": "EU GDPR (Regulation (EU) 2016/679)", "scope": "EU General Data Protection Regulation (Regulation (EU) 2016/679): BroadNet processes customer personal data as a processor under the Data Processing Agreement.", "auditCycle": "Ongoing obligation", "availability": "Data Processing Agreement with the EU Standard Contractual Clauses.", "verify": "https://www.broadnet.me/legal/dpa", "confirmed": "2026-09-29" } ], "accreditationsInProgress": [ { "name": "GSMA SAS-SM (Subscription Manager) accreditation", "status": "in-progress", "held": false, "recognizedBy": "GSMA", "note": "In progress: GSMA SAS-SM (Subscription Manager) accreditation for eSIM operation. It has not been awarded yet, so it is not listed as a held certification.", "asOf": "2026-09-29" } ], "certificateCopies": "Certificate copies and audit reports are shared under NDA on request.", "requestSecurityPackage": "https://www.broadnet.me/contact?topic=security-package", "memberships": [ { "name": "GSMA", "level": "Associate Member since 2015", "url": "https://www.gsma.com" }, { "name": "MEF", "url": "https://mobileecosystemforum.com" }, { "name": "Carrier Community", "level": "Platinum Member", "url": "https://carriercommunity.com" }, { "name": "ITW Global Leaders' Forum (GLF)", "url": "https://glfcommunity.com" } ], "dataResidency": [ { "market": "UAE and the wider GCC", "whereDataIsHosted": "Hosted in the MENA region by default: most production messaging runs on BroadNet-operated Tier-3 facilities in the region, including the Dubai data centre.", "howYouGetIt": "Standard. GCC data residency is written into enterprise agreements." }, { "market": "Saudi Arabia", "whereDataIsHosted": "In-Kingdom: BroadNet operates a Riyadh data centre to keep customer data for KSA accounts resident, aligned with the Saudi PDPL.", "howYouGetIt": "On request." }, { "market": "European Union", "whereDataIsHosted": "Hosting in the European Union; EU traffic can be isolated to EU-only routes and storage.", "howYouGetIt": "On request. Cross-border data transfers are governed by the EU Standard Contractual Clauses (2021)." }, { "market": "United States", "whereDataIsHosted": "Hosting in the United States.", "howYouGetIt": "Depending on the contract." }, { "market": "Singapore", "whereDataIsHosted": "Hosting in Singapore.", "howYouGetIt": "Depending on the contract." } ], "dataResidencyPolicy": "https://www.broadnet.me/security/data-residency", "dataHandling": [ { "control": "Data residency", "implementation": "Hosted in the MENA region by default; hosting in the EU, the US and Singapore is available. EU-only routing on request; GCC residency on enterprise contracts." }, { "control": "Data retention", "implementation": "Message bodies 90 days standard, up to 7 years on enterprise tiers (configurable). PII/PHI scrubbed from webhook logs by default for healthcare." }, { "control": "Encryption in transit", "implementation": "TLS 1.3 on all API and webhook traffic." }, { "control": "Encryption of stored data", "implementation": "AES-256 with per-tenant key derivation for at-rest customer data." }, { "control": "Cryptographic key management", "implementation": "HSM-backed custody (FIPS 140-2 Level 3 minimum for eSIM signing keys) under documented key-ceremony procedures." }, { "control": "Access control", "implementation": "Role-based access control (RBAC), mandatory 2FA for admins, and immutable audit logging of every state-changing action." }, { "control": "Right to erasure", "implementation": "GDPR Article-17 tooling exposed via API — customer-initiated bulk delete by phone-number hash, message-ID range or tenant." }, { "control": "Cross-border transfers", "implementation": "EU Standard Contractual Clauses (2021) plus the UK International Data Transfer Agreement (IDTA) where applicable; adequacy decisions tracked." } ], "documents": [ { "name": "Data Processing Agreement", "url": "https://www.broadnet.me/legal/dpa" }, { "name": "Subprocessor list", "url": "https://www.broadnet.me/legal/sub-processors" }, { "name": "Breach notification policy", "url": "https://www.broadnet.me/security/breach-notification" }, { "name": "Audit reports (under NDA)", "url": "https://www.broadnet.me/trust/audit-reports" }, { "name": "Security overview", "url": "https://www.broadnet.me/security" }, { "name": "Privacy policy", "url": "https://www.broadnet.me/legal/privacy-policy" } ], "related": { "sla": "https://www.broadnet.me/ai/sla.json", "facts": "https://www.broadnet.me/about/facts.json" } }