Snapshot 12678
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Center Start your security review View & download sensitive information Ask for information Overview Medallia Proprietary and Confidential Welcome to Medallia's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation. Medallia offers a wide variety of products in order to best serve our customers. This page will provide information that is useful to every customer such as our corporate security including policies and standards. To find information that is specific to the product or products you use today or are interested in learning more about, please use the dropdown menu on the top of the screen! Trust Center Updates Security Advisory Response - Hugging Face Security Incident Incidents Medallia is aware of the security disclosure recently published by Hugging Face regarding an incident on their systems involving a model evaluation process. Following this disclosure, we’ve engaged directly with Hugging Face to evaluate any potential exposure or risk to our environments. Based on direct communication and confirmation from Hugging Face: No Medallia data was compromised or exposed during this incident. No safeguard or corrective actions are required by Medallia or our customers. No unauthorized access to Medallia systems or customer environments occurred. Hugging Face is in the final stages of its investigation and is actively reviewing its security procedures. We will continue to monitor for any material updates associated with this incident and take all recommended actions. As an act of additional caution, we recommend reviewing Medallia’s Security Best Practices Whitepaper to ensure your Medallia instance is secured against common threats. If you have any questions, please don’t hesitate to reach out to the CSA team at csa@medallia.com Security Advisory Response - Axios npm Supply Chain Incident Vulnerabilities Medallia is aware of the recently disclosed supply chain attack affecting specific versions of the axios npm package. Following this disclosure, we conducted a comprehensive review across our environment using multiple detection and analysis capabilities, including Software Composition Analysis (SCA), Static Application Security Testing (SAST), container and artifact analysis, network and runtime monitoring. Based on this investigation: No impacted versions of axios were identified in our production or managed environments No evidence of malware or secondary payload execution was detected No indication of unauthorized access or data exposure was found No active threats related to this campaign are present in our environment At this time, there is no impact to Medallia systems or customer data related to this incident. We will continue to monitor for any emerging indicators associated with this campaign and take appropriate action as needed. Security Advisory Update: TeamPCP Supply Chain Attack Vulnerabilities Medallia is aware of the ongoing TeamPCP supply chain attacks targeting Trivy, Checkmarx (KICS), and LiteLLM. Following a thorough investigation of our enterprise technology stack, our security teams have confirmed that there is no evidence of compromise to Medallia’s internal systems or customer data. Medallia remains unaffected by this campaign. We will continue to monitor the threat landscape and will issue further communications should relevant information become public. Salesforce Public-Facing Experience Cloud Sites Vulnerabilities Medallia is aware of the recent security advisory regarding potential misconfigurations affecting publicly accessible Salesforce Experience Cloud guest user access. Following the advisory, Medallia conducted a review of our Salesforce environment to assess whether the conditions described in the Salesforce guidance were present. As part of this review, we evaluated and implemented relevant configurations and performed a validation of system activity associated with our Experience Cloud environments. Based on our review and analysis of relevant system activity, no evidence of unauthorized activity was identified and no Medallia systems or customer environments were impacted. Specifically, no evidence was identified indicating that customer data or systems were accessed, exposed, or otherwise affected in connection with this advisory. Medallia CSA STAR Level 1 Registration Compliance We’re thrilled to share an important milestone in our journey to provide you with secure, reliable, and transparent services. Medallia's Medallia Experience Cloud (MEC) product is now registered for CSA STAR Level 1, a globally recognized standard for cloud security! This certification is a testament to our commitment to: Security: Safeguarding your data with robust controls. Transparency: Demonstrating our practices meet industry-leading cloud security standards. Trust: Ensuring you can rely on us to protect your critical information. What is CSA STAR Level 1? The CSA (Cloud Security Alliance) Security, Trust, Assurance, and Risk (STAR) certification is awarded to organizations that meet rigorous cloud security requirements. Achieving Level 1 means we’ve published a detailed self-assessment aligning with the industry-standard CSA Consensus Assessments Initiative Questionnaire (CAIQ). What does this mean for you? You can continue to trust Medallia with confidence, knowing our commitment to cloud security and data protection is stronger than ever. You may also download the CAIQ from the listing directly or on our Trust Center on the MEC page as well as the STAR Registry URL above. Thank you for choosing Medallia as your trusted partner. If you have any questions or would like to learn more about our security practices, please check out our Trust Center at https://trust.medallia.com/ or reach out to csa@medallia.com. Here’s to building a more secure future together! Compliance APEC CBPR APEC PRP CCPA CSA STAR Level 1 FedRAMP High GDPR HIPAA HITRUST ISO/IEC 27001 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 27701 PCI DSS Privacy Shield SOC 2 VPAT Documents DOCUMENTSOrganizational Chart LEGALCyber Insurance / COI LEGALMedallia Security Standards AIISO/IEC 42001 AIResponsible AI Statement POLICIES AND STANDARDSPolicies and Standards TRAININGEmployee Privacy Training TRAININGSecurity Awareness Training Risk Profile Data Access Level Critical Dependence Third Party Dependence AI Responsible AI Statement ISO/IEC 42001 ESG Anti-Bribery and Corruption Anti-Competitive Practices Anti-Modern Slavery View more Legal Medallia Security Standards Subprocessors Cyber Insurance / COI View more Data Privacy Data Privacy Officer Employee Privacy Training Access Control Bring Your Own Device (BYOD) Data Access Password Security View more Infrastructure Status Monitoring Endpoint Security Disk Encryption Threat Detection Corporate Security Asset Management Practices Employee Training Incident Response View more Policies and Standards Policies and Standards Training Employee Privacy Training Security Awareness Training If you need help using this Trust Center, please contact us. Contact support If you think you may have discovered a vulnerability, please send us a note. Report issue