--- title: Trust Center description: Read more about how our commitment to data privacy and security is embedded in every part of our business. image: https://www.cybercoach.com/hubfs/EU%20AI%20Act%20Blog%20Banner%202.svg --- [![CyberCoach Full Logo with Bot Icon](https://www.cybercoach.com/hubfs/CyberCoach_Full_Logo_Black-2.svg)](https://www.cybercoach.com?hsLang=en) - PRODUCT ## CyberCoach at a glance An industry-changing platform built on peer-reviewed research: phishing, secure coding, and AI skills training, delivered directly in Teams, Slack, or the browser. ### [The Science Behind CyberCoach Why traditional phishing simulations don't work, according to peer-reviewed research from ETH Zurich.](https://www.cybercoach.com/science-behind-cybercoach?hsLang=en) ### [Is Phishing Simulation Legal Under GDPR? 9 steps GDPR requires before you phish your employees — and a new simulation approach that doesn't need any of them.](https://www.cybercoach.com/legal-basis-phishing-simulation?hsLang=en) ### [Pricing Flexible plans, also monthly. ](https://www.cybercoach.com/pricing?hsLang=en) ### [Blog Latest insights into security awareness and what's new with CyberCoach.](https://blog.cybercoach.com?hsLang=en) ### [Customer Stories Read more about how CyberCoach has helped organizations across different industries modernize their approach to security and AI training. ](https://www.cybercoach.com/customer-stories?hsLang=en) ### [OT Security Training Targeted training for employees working with OT technology.](https://www.cybercoach.com/ot-security-training?hsLang=en) - [AI TRAINING](https://www.cybercoach.com/ai-security-training?hsLang=en) ## [AI Training The most comprehensive role-based AI security and productivity training — built to help employees use AI effectively and safely, and keep your organization compliant with the EU AI Act.](https://www.cybercoach.com/ai-security-training?hsLang=en) ### [AI Security Training Why choose CyberCoach for your AI security training needs?](https://www.cybercoach.com/ai-security-training?hsLang=en) ### [EU AI Act Training Requirements: What You Actually Have To Do AI literacy training has been mandatory since February 2025.  ](https://www.cybercoach.com/eu-ai-act-training-requirements?hsLang=en) - [FOR DEVELOPERS](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) ## [For Developers Go beyond OWASP Top10 and offer hands-on interactive training for technical roles in secure coding and efficient use of AI. ](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) ### [Secure Coding Skills Meet ISO/IEC 27001 or SOC 2 requirements for secure development practices with no-nonsense training for your developers and other technical roles, directly in Microsoft Teams or Slack chat. ](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) - [COMPANY](https://www.cybercoach.com/about-us?hsLang=en) ## [About us We're growing into the most diverse training platform company on the planet.](https://www.cybercoach.com/about-us?hsLang=en) ### [About Us Get to know our international team.](https://www.cybercoach.com/about-us?hsLang=en) ### [Contact Us Get in touch.](https://www.cybercoach.com/contact-us?hsLang=en) ### [Careers We are hiring.](https://www.cybercoach.com/careers?hsLang=en) ### [Partner with us Learn more about our partner program.](https://www.cybercoach.com/partnerships?hsLang=en) [FREE TRIAL](https://www.cybercoach.com/free-trial?hsLang=en) [GET A DEMO](https://meetings-eu1.hubspot.com/maria-bique/cybercoach-demo?uuid=88959d26-2ff7-4dd0-8ebd-dd43eb31443e) TRUST CENTER # Trust and transparency Learn more about security and privacy at CyberCoach. T&Cs #### CyberCoach General Terms of Use Our general terms also include our Data Protection Agreement clauses under "Privacy." [READ TERMS AND CONDITIONS](https://www.cybercoach.com/general-terms?hsLang=en) Privacy Notice (Teams product) ### Privacy Notice for CyberCoach in Teams [READ FULL NOTICE](https://www.cybercoach.com/privacy-teams-app?hsLang=en) Privacy Notice (Slack product) ### Privacy Notice for CyberCoach in Slack [READ FULL NOTICE](https://www.cybercoach.com/privacy-slack-app?hsLang=en) # You don't even have to trust us. It is possible to use CyberCoach without sharing any identifiable personal data outside your organization, though this will affect some aspects of the service (e.g. reporting can only cover users that have opened the application). Every feature in CyberCoach is designed to minimize access to personal and confidential information.  ### Security Overview We are in the business of trust, and our success depends on our ability to maintain the confidentiality, integrity, and availability of information. To support this, we have established an Information Security Management System (ISMS) with the primary objectives of ensuring regulatory and contractual compliance and reducing business risk. Our security policies are based on the ISO/IEC 27001 standard, approved and reviewed on a regular basis annually by senior management. We have documented processes and routines to assess and manage information security risks in software development and in collaboration with third parties and subcontractors. At least once a year, we conduct an internal security audit, which checks for compliance with industry standard practices. Customer data in CyberCoach is minimized and protected by industry and Microsoft cloud infrastructure best practices. Data is only processed on certified Microsoft resources. ### Business Continuity We have documented and implemented business continuity and disaster recovery plans and procedures related to the CyberCoach service. The plan is tested at least once a year. ### Information Security Awareness, Education & Training We maintain a comprehensive, role-based security training program for all employees to ensure that everyone has appropriate knowledge of information security and privacy policies and procedures (including breach detection, management and handling of confidential information). ### HR Security To ensure the integrity and security of our operations, all our new employees undergo a background check and sign a non-disclosure agreement upon joining. These measures are part of our annually reviewed HR security policy. ### Third Parties Current list of third parties is found in our [General Terms. ](https://www.cybercoach.com/general-terms?hsLang=en) For now, our only necessary subprocessors are : - Cloudflare (web application security): [https://www.cloudflare.com/en-gb/privacypolicy/](https://www.cloudflare.com/en-gb/privacypolicy/) - Microsoft (cloud services): [https://www.microsoft.com/en-us/privacy/privacystatement](https://www.microsoft.com/en-us/privacy/privacystatement).  In addition, optional built-in email notifications and email log-in rely on Scaleway's email delivery service (https://www.scaleway.com/en/privacy-policy/). Alternatively, customers can choose to send email notifications through their own email infrastructure. We do not use third parties for developing or maintaining the CyberCoach service. ### Incident Response We maintain a documented Incident Response Plan that serves as our predefined procedure for handling potential security incidents. This plan is systematically reviewed, tested, and approved by appropriate stakeholders  on an annual basis to ensure readiness and effectiveness in responding to security incidents. ### Access Management We apply the following principles in access management: - Access is always granted on a least privilege basis - Access is managed according to defined roles and responsibilities - Access to systems requires strong authentication - Each system is assessed for criticality and risks. Services related to the development and operation of our CyberCoach service are also subject to the following rules: - All user IDs are personal, only for designated users. - Access to resources requires multi-factor authentication - Suspicious login attempts are monitored by automated alerts - Updates to the CyberCoach Service follow a strict change management process - No subcontractors or consultants are used for the development or maintenance of the CyberCoach product - Log information is stored for 12 months (unless agreed separately) ### Asset Management We are committed to maintaining appropriate asset management practices that span both our virtual and physical assets. Our asset management policy is designed to systematically identify and catalog organizational assets while defining appropriate protection responsibilities and is updated annually. ### Infrastructure CyberCoach infrastructure is hosted by Azure in West Europe. Additional information on Azure infrastructure security can be found at [https://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure.](https://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure) We employ infrastructure-as-code (IaC) techniques to securely deploy and manage resources within our operational environment. This enables rapid provisioning and scaling while ensuring that all deployments meet our stringent security standards. Our production and development environments are maintained as distinct entities to safeguard operational integrity and data confidentiality. In these separate environments, customer data is strictly prohibited from use in non-production settings, thus ensuring that developmental and testing activities do not compromise data security. ### Artificial Intelligence (AI) CyberCoach uses AI for evaluating open text user responses and providing intelligent feedback. We do not store users’ responses to open text questions. Responses are processed through Microsoft Azure AI Foundry services for analysis and the results are returned directly to the user. We do not store the generated responses either. We have not enabled any data sharing for model training or service improvement purposes. Our AI services are hosted in the Sweden Central region. According to Microsoft’s Azure AI Foundry documentation, prompts, completions, embeddings, and training data submitted to the service are not used to train, retrain, or improve foundation models unless customers explicitly choose to share data. More information about Microsoft Azure AI Foundry data privacy and security is available here: [https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy?tabs=azure-portal](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy?tabs=azure-portal) ## Complete your Awareness Program Today [GET A DEMO](https://meetings-eu1.hubspot.com/maria-bique/cybercoach-demo?uuid=88959d26-2ff7-4dd0-8ebd-dd43eb31443e) TRY FREE ![cybercoach_logo_white.svg.2023_03_15_16_58_04.0](https://www.cybercoach.com/hubfs/cybercoach_logo_white.svg.2023_03_15_16_58_04.0.svg) ### Product - [For Developers](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) - [AI Security](https://www.cybercoach.com/ai-security-training?hsLang=en) - [Manage Subscription](https://billing.stripe.com/p/login/28o4jRclF4gab1C6oo) - [FAQ](https://www.cybercoach.com/faq?hsLang=en) ### Connect - [Partner Program](https://www.cybercoach.com/partnerships?hsLang=en) - [Careers](https://www.cybercoach.com/careers?hsLang=en) - [For Media](https://www.cybercoach.com/media?hsLang=en) - [Contact Us](https://www.cybercoach.com/contact-us?hsLang=en) ### Legal - [Privacy](https://www.cybercoach.com/cybercoach-website-privacy?hsLang=en) - [General Terms](https://www.cybercoach.com/general-terms?hsLang=en) ### Company - [About Us](https://www.cybercoach.com/about-us?hsLang=en) - [Blog](https://blog.cybercoach.com?hsLang=en) - [ESG Policy](https://www.cybercoach.com/esg-policy?hsLang=en) © 2026 CyberCoach All rights reserved ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#organization", "@type" : "Organization", "foundingDate" : "2019", "legalName" : "Cult Security", "logo" : "https://www.cybercoach.com/hubfs/CyberCoach_Full_Logo_Black-2.svg", "name" : "CyberCoach", "sameAs" : [ "https://www.linkedin.com/company/cult-security", "https://x.com/cybercoachUS", "https://www.instagram.com/cybercoachus/", "https://www.youtube.com/@CyberCoachOfficial" ], "url" : "https://www.cybercoach.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#software", "@type" : "SoftwareApplication", "applicationCategory" : "BusinessApplication", "applicationSubCategory" : "Security awareness and AI skills training", "availableLanguage" : [ "English", "Spanish", "Portuguese (Brazil)", "Portuguese (Portugal)", "French", "Dutch", "German", "Swedish", "Finnish" ], "description" : "CyberCoach is a role-based security awareness, privacy and AI skills training platform that runs as a conversational app inside Microsoft Teams, Slack or a web browser. Employees practice AI skills and responding to social engineering in short, psychologically safe scenario-based sessions. Learning is anonymous while successful completions are recorded per user so the organization can evidence training completion for compliance. CyberCoach can also run on pseudonymous identifiers such as Slack or Microsoft UUIDs, with no personal data shared with CyberCoach.", "featureList" : [ "Conversational phishing and social engineering challenges", "Role-based training programs for technical and non-technical roles", "AI security and AI use training", "Secure coding training for developers", "OT security training", "Custom content creation", "Compliance assessments (ISO/IEC 27001, GDPR, AI compliance)", "Anonymous learning with per-user completion records for compliance", "Optional pseudonymous deployment using Slack or Microsoft UUIDs" ], "name" : "CyberCoach", "offers" : [ { "@type" : "Offer", "description" : "Cover the basics.", "name" : "Starter", "price" : "49", "priceCurrency" : "EUR" }, { "@type" : "Offer", "description" : "Broad topic coverage, custom content, hosted kick-off.", "name" : "Advanced", "price" : "159", "priceCurrency" : "EUR" }, { "@type" : "Offer", "description" : "Full coverage, 24/7 AI chat, compliance assessments, hosted kick-off.", "name" : "Complete", "price" : "179", "priceCurrency" : "EUR" } ], "operatingSystem" : "Microsoft Teams, Slack, Web browser, iOS, Android", "publisher" : { "@id" : "https://www.cybercoach.com/#organization" }, "url" : "https://www.cybercoach.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#faq", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach is a security awareness, privacy and AI skills training platform that runs inside Microsoft Teams, Slack or a web browser. Employees practice role-based skills such as responding to social engineering, ethical and productive use of AI and even secure coding skills in short conversational scenarios. Learning is anonymous, while successful completions are stored so the organization can evidence training completion for compliance frameworks such as ISO/IEC 27001 and SOC 2." }, "name" : "What is CyberCoach?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, but not by sending deceptive emails to employees. CyberCoach uses conversational phishing challenges in which employees practice recognizing and responding to social engineering scenarios in Teams, Slack or the browser. Peer-reviewed research, including Lain et al. (ETH Zurich, 2022 and 2024), finds that traditional email-based simulated phishing does not reduce risk and can increase misplaced trust in the inbox." }, "name" : "Does CyberCoach do phishing tests?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Learning is anonymous: how an employee answered a training scenario is never visible to managers or administrators. What is recorded is successful completion, so the organization can evidence who has completed required training for compliance purposes. This is privacy by design: the sensitive part of the interaction stays private, and only the completion fact is retained." }, "name" : "Are individual employee answers visible to managers?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. CyberCoach can be deployed using pseudonymous identifiers, such as Slack or Microsoft UUIDs, so no personal data is shared with CyberCoach. Compliance reporting still works: the mapping between a UUID and a real person is resolved only for authenticated and authorized administrators within the customer's own organization." }, "name" : "Can CyberCoach be used without sharing personal data?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach supports security awareness and secure development training requirements under ISO/IEC 27001 and SOC 2, and includes assessments covering ISO 27001, GDPR and AI compliance on the Complete plan." }, "name" : "Which compliance requirements does CyberCoach support?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach is available in English, Spanish, Portuguese (Brazil), Portuguese (Portugal), Polish, French, Dutch, German, Swedish, Norwegian, Danish and Finnish, with more languages in development." }, "name" : "Which languages does CyberCoach support?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Plans start at 49 EUR per month for Starter, 159 EUR per month for Advanced and 179 EUR per month for Complete, available monthly or yearly, including through the Microsoft Azure Marketplace." }, "name" : "How much does CyberCoach cost?" } ] } ```