Trust Center: certifications, audits and data protection
This is BroadNet's compliance evidence hub — the certifications, attestations, data-handling controls, subprocessors and disclosure process a procurement or security reviewer needs to clear a vendor. The detailed reports are gated behind NDA; everything a reviewer should see first is right here.
- ISO/IEC 27001:2022 — Information security
- ISO/IEC 27018 — Cloud privacy (personal data)
- ISO 9001 — Quality management
- ISO 22301 — Business continuity
- SOC 2 Type II — report under NDA
- GDPR — compliant; Data Processing Agreement available
Certificate copies and audit reports shared under NDA on request to trust@broadnet.me.
What a procurement reviewer can open now, without a sales call.
The summaries below are public. Full audit reports and certificate copies stay under NDA and are sent on request.
Data Processing Agreement (DPA)
The standard Data Processing Agreement with the EU Standard Contractual Clauses, incorporated into every MSA. BroadNet acts as processor, the customer as controller.
Read the Data Processing AgreementSubprocessor list
The current list of subprocessors, with at least 30 days' notice before a new one is engaged.
View the listSecurity questionnaire (SIG / CAIQ)
Request the completed SIG / CAIQ questionnaire, the penetration-test executive summary and certificate copies. We reply within one business day.
Request the packWhere data is hosted, by market
Where customer data is hosted for each market, and how to pin a region.
See it by marketAudited where it counts.
BroadNet maintains continuous third-party audits against internationally-recognized standards for information security, quality and business continuity. Every certificate copy and report is shared on request under a mutual NDA.
| Standard | Scope of certification | Issued by | Audit cycle | Certificate and verification |
|---|---|---|---|---|
| ISO/IEC 27001:2022 | ISMS covering the messaging platform, operator products, customer-data handling and supplier relationships. | Accredited certification body (named on the certificate) | Annual surveillance · 3-year re-certification | Certificate and Statement of Applicability under NDA. Verify on IAF CertSearch (search for “BroadNet”) |
| ISO/IEC 27018 | Protection of personal data (PII) in BroadNet's cloud messaging services. ISO/IEC 27018 is the cloud-privacy code of practice that extends the ISO 27001 ISMS. | Accredited certification body (named on the certificate) | Assessed with the ISO 27001 ISMS | Certificate copy shared under NDA. Verify on IAF CertSearch (search for “BroadNet”) |
| ISO 9001:2015 | Quality Management System for the design, delivery and support of telecom messaging products. | Accredited certification body (named on the certificate) | Annual surveillance audit | Certificate copy shared under NDA. Verify on IAF CertSearch (search for “BroadNet”) |
| ISO 22301 | Business Continuity Management — incident response, recovery objectives and supplier-failure scenarios. | Accredited certification body (named on the certificate) | Annual audit · continuity plan tested every year | Certificate and continuity plan summary under NDA. Verify on IAF CertSearch (search for “BroadNet”) |
| SOC 2 Type II | Trust Services Criteria: Security, Availability and Confidentiality, over a defined reporting period. | Independent CPA firm | Annual reporting period | Full report under NDA. SOC 2 reports are not published in a public register. Request the pack |
| GDPR | EU General Data Protection Regulation (Regulation (EU) 2016/679): BroadNet processes customer personal data as a processor under the Data Processing Agreement. | EU regulation (compliance, not a certificate) | Ongoing obligation | Data Processing Agreement with the EU Standard Contractual Clauses. Read the Data Processing Agreement |
In progress: GSMA SAS-SM (Subscription Manager) accreditation for eSIM operation. It has not been awarded yet, so it is not listed as a held certification.
MobileValidate is operated by BroadNet and covered by BroadNet's ISO certifications and data-protection agreement (DPA).
Verification: latest certificate copies and audit reports are made available under NDA on request to trust@broadnet.me. BroadNet is additionally a GSMA Associate Member and a member of the Mobile Ecosystem Forum (MEF).
Privacy & sector frameworks.
Beyond certified standards, BroadNet operates its processor controls to align with the data-protection and sector regimes that our customers are held to.
GDPR
Article-28 processor controls, a standard DPA with EU SCCs, data-minimization, and Article-17 right-to-erasure tooling. EU-only routing on request.
UAE PDPL
Federal Decree-Law No. 45 of 2021: lawful basis, data-subject rights, breach notification, and cross-border transfer controls.
Saudi PDPL
Consent, data minimization, cross-border transfer restrictions, and 72-hour breach notification aligned to SDAIA enforcement.
HIPAA-aligned
BAA availability confirmed during contracting. PHI-safe templates, restricted logging, AES-256 at rest, TLS 1.3 in transit.
SOC 2 Trust Services
Security, Availability and Confidentiality criteria evidenced by an independent SOC 2 Type II report.
ISO 27001 ISMS
A certified management system, not a point-in-time snapshot — controls are audited and maintained continuously.
Inside the bodies that set the standards.
BroadNet is a member of the industry bodies that define messaging, signalling and interconnect standards worldwide — each links to a short explainer of what the membership covers.
GSMA Associate Member
Messaging working groups, signalling-security guidelines, and interconnect documentation cycles.
MEF (Mobile Ecosystem Forum)
A2P messaging code of conduct, sender-ID best practice, and consumer-protection initiatives.
GLF (ITW Global Leaders' Forum)
Carrier-led standardisation of wholesale interconnect, fraud and messaging.
Carrier Community
Wholesale messaging interconnect and quality forums.
Regional regulators
Recognized by TDRA (UAE), CST (KSA), NTRA (Egypt), TRC (Jordan) and equivalent authorities in our routed markets.
GSMA Open Gateway
Aligning with carrier-grade network-API standards for messaging, fraud and identity.
Everything a reviewer asks for.
Detail pages and downloadable policies. Items marked NDA are shared once a mutual non-disclosure agreement is in place — bundle them by requesting the security package.
ISO 27001, 9001, 22301 and SOC 2 reports under NDA.
ISMS scope, certificate and Statement of Applicability explainer.
Quality Management System explainer and scope.
Business Continuity Management — RTO/RPO and tabletop testing.
Trust Services Criteria coverage; report under NDA.
Standard DPA with EU SCCs, auto-incorporated into every MSA.
Current subprocessors with 30-day advance change notice.
Where your data lives, and how to pin a region.
72-hour notification and coordinated disclosure.
How BroadNet handles visitor, prospect and end-user data.
The contract, acceptable-use policy and governing law.
Platform, account, operational and telecom controls.
Residency, retention, encryption, keys.
How customer and end-user data is located, protected and eventually destroyed. Full detail is captured in the DPA and the security overview.
| Control | How BroadNet implements it |
|---|---|
| Data residency | Hosted in the MENA region by default; hosting in the EU, the US and Singapore is available. EU-only routing on request; GCC residency on enterprise contracts. |
| Data retention | Message bodies 90 days standard, up to 7 years on enterprise tiers (configurable). PII/PHI scrubbed from webhook logs by default for healthcare. |
| Encryption in transit | TLS 1.3 on all API and webhook traffic. |
| Encryption of stored data | AES-256 with per-tenant key derivation for at-rest customer data. |
| Cryptographic key management | HSM-backed custody (FIPS 140-2 Level 3 minimum for eSIM signing keys) under documented key-ceremony procedures. |
| Access control | Role-based access control (RBAC), mandatory 2FA for admins, and immutable audit logging of every state-changing action. |
| Right to erasure | GDPR Article-17 tooling exposed via API — customer-initiated bulk delete by phone-number hash, message-ID range or tenant. |
| Cross-border transfers | EU Standard Contractual Clauses (2021) plus the UK International Data Transfer Agreement (IDTA) where applicable; adequacy decisions tracked. |
Where data is hosted, by market
| Market | Where data is hosted | How you get it |
|---|---|---|
| UAE and the wider GCC | Hosted in the MENA region by default: most production messaging runs on BroadNet-operated Tier-3 facilities in the region, including the Dubai data centre. | Standard. GCC data residency is written into enterprise agreements. |
| Saudi Arabia | In-Kingdom: BroadNet operates a Riyadh data centre to keep customer data for KSA accounts resident, aligned with the Saudi PDPL. | On request. |
| European Union | Hosting in the European Union; EU traffic can be isolated to EU-only routes and storage. | On request. Cross-border data transfers are governed by the EU Standard Contractual Clauses (2021). |
| United States | Hosting in the United States. | Depending on the contract. |
| Singapore | Hosting in Singapore. | Depending on the contract. |
The data residency policy has the detail, and the region is fixed in your contract. Read the data residency policy
Machine-readable versions for procurement tools and AI agents: compliance.json (certifications, residency, data handling) · sla.json (uptime, service credits, support targets)
A short list, and 30 days' notice.
BroadNet keeps its subprocessor footprint deliberately small. Most production messaging runs on BroadNet-operated Tier-3 facilities in MENA; a limited set of third parties support non-MENA workloads and operational tooling.
What we use, and why
- Infrastructure — BroadNet Tier-3 MENA facilities (primary); regional cloud for non-MENA workloads.
- Transactional email — account and alert notifications only.
- Status page — public incident communication hosting.
- Analytics — self-hosted; no third-party or Google Analytics.
How changes are notified
Customers are notified at least 30 days before any new subprocessor is engaged, giving time to review or object before it processes any data. The authoritative, current list is maintained on the subprocessor page and referenced by the DPA.
View the current subprocessor list →Who you contract with, on paper.
The group entity behind the platform, and the policy documents that govern the relationship.
BroadNet Technologies Sarl
- Founded
- 2003
- HQ
- Dubai, United Arab Emirates
- Legal form
- Sarl (limited liability company)
- Contracting
- Signed by the BroadNet branch serving your market; your agreement names the contracting entity.
- Regulator
- TDRA (Telecommunications & Digital Government Regulatory Authority)
- Footprint
- MENA-wide, plus partnerships across Africa, Asia, Europe and LATAM
Coordinated disclosure, tested regularly.
BroadNet runs regular third-party penetration tests and operates a coordinated vulnerability-disclosure process. Report anything you find — we respond fast.
Report a vulnerability
Email security@broadnet.me, or read the machine-readable policy and preferred languages at /.well-known/security.txt.
Penetration testing
Independent penetration tests on a recurring cadence; the executive summary is shared under NDA with evaluators.
Remediation SLA
High-severity findings are remediated on a 30-day SLA; critical issues are prioritized immediately.
Procurement questions, answered.
The questions security and procurement teams ask most. Anything not covered here is in the security package.
Which certifications and attestations does BroadNet hold?
BroadNet maintains ISO/IEC 27001 (information security), ISO/IEC 27018 (protection of personal data in the cloud), ISO 9001 (quality management) and ISO 22301 (business continuity), holds a SOC 2 Type II report covering Security, Availability and Confidentiality, and complies with the GDPR (a Data Processing Agreement is available). GSMA SAS-SM (Subscription Manager) accreditation for its eSIM infrastructure is in progress. BroadNet is also a GSMA Associate Member and a member of the Mobile Ecosystem Forum (MEF).
Can I get the audit reports and certificates for a procurement review?
Yes. Certificate copies, the ISO 27001 Statement of Applicability, the SOC 2 Type II report, and the latest penetration-test executive summary are shared with prospective and current enterprise customers under a mutual NDA. Request the evaluator package from trust@broadnet.me and we typically respond within one business day.
Do you sign a DPA, and is there a subprocessor list?
A standard Data Processing Agreement (DPA) incorporating the EU Standard Contractual Clauses is included with every Master Services Agreement — BroadNet acts as Processor and the customer as Controller under GDPR. A current subprocessor list is published, and customers are notified at least 30 days before any new subprocessor is engaged so they can object.
Where is customer data stored, and can we choose the region?
BroadNet supports MENA-resident (default), EU-resident, US-resident and Singapore-resident hosting depending on the contract. EU customer data can be isolated to EU-only routes and storage on request, and GCC data residency is available on enterprise agreements. Cross-border transfers are governed by the EU SCCs plus region-appropriate addenda.
How is data encrypted, and how are keys managed?
All API and webhook traffic uses TLS 1.3 in transit. Data at rest is encrypted with AES-256 using per-tenant key derivation. Key custody for the eSIM subscription-management platform runs in HSMs meeting FIPS 140-2 Level 3 minimum, under documented, dual-control key-ceremony procedures.
How long do you retain message content?
Message bodies are retained for 90 days on standard tiers and up to 7 years on enterprise tiers, configurable by contract. PII and PHI are scrubbed from webhook logs by default for healthcare workloads, and GDPR Article-17 right-to-erasure tooling is exposed via API for customer-initiated bulk deletion.
Do you support HIPAA workloads?
BroadNet is HIPAA-aligned. If you plan to send PHI, tell us your HIPAA requirements first; BAA availability is confirmed during contracting. Controls include PHI-safe templates, restricted logging, AES-256 encryption at rest and TLS 1.3 in transit. HIPAA alignment is a contractual and control commitment rather than a certification.
How do I report a security vulnerability?
Email security@broadnet.me or see /.well-known/security.txt for the coordinated-disclosure policy and preferred languages. BroadNet runs regular third-party penetration tests and shares the executive summary under NDA; high-severity findings are remediated on a 30-day SLA.
Need the security package
for procurement review?
We'll send certificate copies, the SOC 2 report, pen-test summary, completed security questionnaire (SIG/CAIQ), DPA template and subprocessor list within one business day under NDA.