G2

Brucz D.

Senior Cybersecurity & Network Defence Specialist

Computer & Network Security

Mid-Market (51-1000 emp.)

11/4/2026

Business partner of the seller or seller's competitor, not included in G2 scores.

"Simvoly Makes GDPR-Friendly Funnels and Secure Client Portals Fast"

4.5/5

What do you like best about Simvoly?

What I value most about Simvoly is how it lets our small UK cybersecurity consultancy spin up compliant landing pages, lead funnels and secure client portals without dragging our dev team away from critical threat detection work. As someone focused heavily on GDPR and NIS 2 readiness for our clients, the native cookie consent controls and built-in data capture opt-in workflows are a massive win for us, and that’s the feature I lean on every single week.

We build landing pages for our NIS 2 readiness audits, phishing simulation awareness sign-ups and GDPR gap assessment enquiries. The drag-and-drop funnel builder saves me several hours each week. Previously, I would have to brief a web developer, write custom cookie scripts, and manually add opt-out links for every new campaign, which often meant waiting two or three days before a security awareness campaign could go live. Now I can duplicate our pre-approved security service templates, tweak copy for a manufacturing or healthcare client, and launch a funnel the same working day. The form builder lets me toggle explicit consent checkboxes separately for marketing emails and security assessment follow-ups, which is non-negotiable under UK GDPR; I don’t have to patch together third-party form tools that often mess up consent records and create compliance exposure.

Another regularly used feature is the native white-label client portal capability. We deploy these portals to share redacted vulnerability scan reports, remediation roadmaps and post-audit documentation with our managed clients. We lock folder access at the contact level, so a client’s finance lead can only view compliance invoice paperwork, while their IT manager gets full access to technical security findings. This removes the risk we had before, where we were sending large scan PDFs over regular email, creating unencrypted data transit risks that our NIS 2 auditors kept flagging.

I stumbled on an unexpected benefit: the granular submission log and timestamped consent audit trail. Every lead form entry records exactly when a prospect ticked each consent box, their IP address, and the page they submitted from. Last quarter, one of our clients was undergoing a ICO pre-audit review for GDPR, and we were able to pull that consent log directly from Simvoly to demonstrate lawful basis for our outreach. That avoided a lot of stressful scrambling to reconstruct records, and our auditor noted the logs met their evidence requirements.

The integrated affiliate and referral tracking is also handy for our trusted IT partner network across the UK. We create unique referral links for MSP partners that send us security assessment leads, and Simvoly automatically tags those leads so we can track conversion back to the partner without messy Zapier hacks. It keeps our pipeline attribution clean, so our team can focus on incident response and threat intelligence rather than manually reconciling lead sources. It’s rare for a funnel and website builder to hit this balance: flexible enough for custom security service workflows, but with baked-in privacy guardrails that align with the strict UK cyber compliance rules we operate under. It doesn’t try to be a SIEM or endpoint tool, but it removes a whole layer of compliance friction from our client acquisition and reporting workflows. Review collected by and hosted on G2.com.

What do you dislike about Simvoly?

Where Simvoly falls short for our UK cybersecurity consultancy mostly ties back to the granular audit, data residency, and API controls we need to satisfy UK GDPR and NIS 2 obligations, and these gaps create real headaches when we’re supporting regulated clients. The biggest pain point for me is the limited custom retention rule engine for form submission and consent logs. Right now, I cannot set rule-based auto-purging for different categories of prospect data; all records follow one global retention window, and manual bulk deletion is clunky and slow. We work with critical national infrastructure clients bound by strict NIS 2 rules, where we have to erase prospect personal data once an assessment engagement finishes or a data subject submits an erasure request. Last quarter, we had a formal ICO subject access request come in, and it took me almost three hours to manually filter, verify, and remove the relevant consent records across three separate funnels, rather than triggering an automated, audited purge. That introduces unnecessary human error risk and leaves us exposed if we miss a record and fall out of UK GDPR compliance.

A second major limitation is the lack of configurable UK-only data residency locking. Even though Simvoly offers GDPR safeguards in its DPA, I can’t lock our project and submission data exclusively to UK-based hosting zones. Some of our public-sector and critical infrastructure clients we support have mandatory data localization clauses, which forbid personal or project-related data from leaving the UK. Every time we onboard one of these clients, we have to run through extra contractual risk assessments and issue bespoke supplementary data transfer documentation, which adds layers of admin and slows down our funnel launch timeline by several days. It’s frustrating because the tool is otherwise built for European privacy workflows, but this one setting stops us rolling it out to a big slice of our highest-security client base.

The API is also fairly restricted for security teams. We rely on pulling consent and lead submission logs into our SIEM and compliance ticketing platform for centralized audit review, but Simvoly’s API endpoints don’t expose the full timestamped consent metadata we need. I can pull basic contact CSV exports, but those exports don’t include every contextual field the ICO expects, like page referrer, cookie banner interaction logs, and IP anonymisation flags. That means we can’t feed a complete, immutable audit trail directly into our existing security stack, and we’re forced to keep separate, manually maintained spreadsheets as a backup audit source, which breaks our single-source-of-trust compliance workflow.

I also find the platform’s admin activity logs quite shallow. As the primary Simvoly admin for our firm, I need to track every change our team makes to funnel forms, consent checkboxes, and client portal permissions, to prove we maintain separation of duties for NIS 2 audits. The built-in logs only capture high-level login and save events, with no detail on which specific form field or consent setting was edited, who edited it, and the before-and-after values. If one of our junior team members accidentally disables a mandatory opt-in box on a phishing awareness sign-up funnel, there is no easy way to trace that change for audit evidence.

My core recommendation would be threefold: first, add granular, tag-based data retention policies so we can assign different expiry rules to marketing leads, client portal users, and temporary assessment respondents. Second, introduce a hard UK data residency toggle for projects, so regulated UK operators can satisfy localization requirements without extra transfer paperwork. Third, expand the API and admin audit log schema to export full consent context and field change history, formatted to integrate cleanly with SIEM and GRC tools used by security teams. These changes wouldn’t turn Simvoly into a security product, but they would close the compliance gaps that currently limit its use for UK cyber consultancies and NIS 2-regulated organisations like ours. Review collected by and hosted on G2.com.

What problems is Simvoly solving and how is that benefiting you?

Before Simvoly, our cybersecurity consultancy was piecing together disjointed tools for lead capture, client document sharing, and campaign landing pages, and every combination created fresh UK GDPR and NIS 2 compliance risk. We struggled with mismatched consent logging, insecure file delivery for vulnerability reports, and slow page builds that pulled our senior security analysts away from threat hunting and incident response work, but now we can build fully branded funnels and gated client portals in a single platform, which has resulted in us cutting routine campaign setup time by roughly 60% and dramatically lowering the chance of privacy non-compliance findings during ICO audits.

Back then, we relied on separate WordPress landing pages, third-party form tools, encrypted file transfer services and manual spreadsheets to log prospect consent. Every time we launched a sign-up page for our NIS 2 gap assessment or phishing awareness workshop, we had to manually embed cookie scripts, build separate opt-in checkboxes, and cross-reference consent records across three or four different platforms. We also sent redacted vulnerability scan reports and remediation plans via password-protected email attachments, which our auditors repeatedly flagged as inadequate for controlled personal and client technical data. A single new campaign launch would eat up four to six hours of billable security resource, and our consent records were fragmented, making subject access requests incredibly time-consuming to resolve.

Simvoly consolidated all these front-of-house workflows into one environment aligned with our core compliance obligations. The native form builder with split consent checkboxes, timestamped submission logs and built-in cookie controls means every prospect’s opt-in is captured and stored together, ready to export for ICO review. We duplicate our pre-vetted, compliance-approved funnel templates for each new service offering; for example, our critical infrastructure NIS 2 readiness enquiry funnel can go live in under an hour, rather than waiting days for web changes. The white-label, role-restricted client portal is the biggest win for our delivery workflow. We create dedicated portal spaces for each managed client, lock permissions so only their nominated IT lead can view full security findings, while finance contacts only access invoices and statements. We upload sanitised audit reports directly inside Simvoly instead of emailing PDFs, removing that unencrypted transit risk entirely.

We also use the built-in referral tracking for our partner MSP network across the UK. Previously, we manually tagged leads and logged referrals in our ticketing system, which often led to missed attribution and awkward partner reconciliation at quarter-end. Now unique referral links automatically tag incoming enquiries, so we can track which partners are sending NIS 2 and GDPR assessment leads without extra manual logging. This has saved our operations team around 3–4 hours every month on partner lead reconciliation alone.

That said, I’m not treating Simvoly as a replacement for our SIEM, endpoint detection or GRC compliance suite. It solves the specific, often overlooked problem of bringing our client-facing marketing and document-sharing workflows up to the same privacy standard as our core security services. For our small specialist security firm, the main benefit is that it lets us present a polished, auditable client experience without forcing our cyber defence specialists to become full-time web developers or consent administrators. It has let us take on more regulated clients in healthcare and critical infrastructure, because we can demonstrate a controlled, traceable capture and sharing process from the first enquiry all the way through to final audit report delivery. Review collected by and hosted on G2.com.