Snapshot 170733
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Exterro Exterro was founded with the simple vision that applying the concepts of process optimization and data science to how companies manage digital information and respond to requests for that information would drive more successful outcomes at a lower cost. Exterro executed on this vision by building a platform-based, comprehensive software suite to address the needs of organizations to manage the risk associated with the data they stored and used. To this day, the company remains committed to our original vision as a provider of data risk management software applications, delivering solutions that help organizations manage information assets more efficiently. Exterro is based in Portland, Oregon. Exterro also has a fully owned development site in Coimbatore, India. compliance@exterro.com Privacy PolicyOpens in new tab Exterro was founded with the simple vision that applying the concepts of process optimization and data science to how companies manage digital information and respond to requests for that information would drive more successful outcomes at a lower cost. Exterro executed on this vision by building a platform-based, comprehensive software suite to address the needs of organizations to manage the risk associated with the data they stored and used. To this day, the company remains committed to our original vision as a provider of data risk management software applications, delivering solutions that help organizations manage information assets more efficiently. Exterro is based in Portland, Oregon. Exterro also has a fully owned development site in Coimbatore, India. If you wish to report a security incident or suspected vulnerability, please email security@exterro.com Compliance ISO 27001:2022 SOC 2 FedRAMP Moderate TiSAX HITRUST UK Cyber Essentials 3.2 Resources View all Policies ISMS Policy Statement Compliance 2026 Exterro HITRUST e1 Exterro ISO 27001 Certificate Exterro SOC2 Bridge Letter View 8 more SIG Questionnaire Exterro SIG Questionnaire Other resources 2023 Zapproved SOC 2 Type II Report with HIPAA Controls View all Infrastructure security Production environment access restricted Production database access restricted Production OS access restricted View 5 more Infrastructure security controls Organizational security Code of Conduct acknowledged by employees and enforced Password policy enforced Visitor procedures enforced Product security Control self-assessments conducted Vulnerability and system monitoring procedures established Internal security procedures Continuity and Disaster Recovery plans established Change management procedures enforced Production deployment access restricted View 14 more Internal security procedures controls Data and privacy Data retention procedures established Data classification policy established Subprocessors View all Amazon Web Services • Public Cloud Infrastructure US, EU, CA Regions Data hosting and storage as selected by customers | AI processing via AWS Bedrock for Exterro Assist Google, Inc • Google Cloud Platform (GCP) United States, EU Data hosting and storage as selected by customers | Exterro-managed AI infrastructure hosting for Exterro Assist Microsoft Azure • Public Cloud Infrastructure United States Data hosting and storage as selected by customers Snowflake • Data Analytics United States Analytics and Legal Hold data archival for customers hosted with AWS US Updates View all Security Security Advisory: Critical PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 / CVE-2026-109619) Published October 21, 2026 Security Advisory: Critical PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 / CVE-2026-109619) Published: October 21, 2026 Summary Exterro is aware of two critical remote code execution (RCE) vulnerabilities disclosed today in the PHP scripting language, tracked as CVE-2026-109618 and CVE-2026-109619. Our security team has completed an assessment of the Exterro product portfolio. Impact Assessment Exterro’s E-Discovery, GRC (Governance, Risk & Compliance), and Forensic Toolkit (FTK) products are not impacted by these vulnerabilities. These products are not built on PHP and do not include the affected PHP components in their application stack, whether they are deployed in Exterro’s hosted environment or on-premises. Customer Action Required Customers do not need to take any action on these vulnerabilities for the products listed above. Ongoing Monitoring Exterro continuously monitors newly disclosed vulnerabilities and assesses their relevance to our products and infrastructure as part of our vulnerability management program. If our assessment changes, we will update this notice. Questions For questions about this advisory, please contact compliance@exterro.com. Security Canny.io Security Incident – Exterro Statement Published October 5, 2026 Exterro is aware of the recent security incident at Canny.io, a third-party product feedback platform. Here are answers to the questions customers have asked: Does Exterro use Canny, and was Exterro notified? Yes. Exterro uses Canny only as a standalone product feedback forum (ideas.exterro.com), linked from our website so customers can submit product roadmap suggestions. We received Canny's incident notification and follow-up communications. Was Customer information stored in Canny or in connected systems? Canny isn't integrated with Exterro's products, CRM, support platform, or any other system, and never has been. No Customer tenant, customer, or product data has ever been stored in or passed through Canny. All tenant data stays in Exterro's AWS environment. The only Customer-related information in Canny is what users entered themselves on the forum: their names, business email addresses, and product suggestions. Was Customer information affected? No. Our investigation was based on Canny's notifications and on the fact that our Canny workspace has no integrations, which means there was no path from Canny into any Exterro system. No credentials or confidential information were involved. What actions has Exterro taken? No containment actions were needed, and no external incident-response firm was engaged. We'll update this notice if Canny provides new information that changes our assessment. Questions can be sent to security@exterro.com. Security Gainsight Communication Update Published March 10, 2026 On December 8, 2025, Exterro received an Indicator of Compromise (IOC) notification of a potential data issue with the Gainsight application. Exterro investigated the issue with guidance from the vendor. Exterro has reviewed the issue and has not seen any indication of compromise or unauthorized access to systems that hold customer data. As always, the security and integrity of our systems remain a top priority. We will continue monitoring potential threats and take necessary precautions to safeguard our operations. If you have any questions or concerns about this matter, please don't hesitate to contact us. Thank you for your attention to this update. Security Update: CVE-2024-50623 and CVE-2024-55956 (Cleo Multiple Products) – No Impact on Exterro Published December 19, 2024 We would like to provide an update regarding the recently disclosed vulnerabilities, CVE-2024-50623 and CVE-2024-55956. After thorough review we are pleased to confirm that these vulnerabilities have no impact on Exterro, as our systems do not utilize the affected components. At Exterro, the security and integrity of our systems are of the utmost importance. We remain vigilant in monitoring emerging threats and are committed to implementing all necessary measures to ensure the safety of our operations. If you have any questions or require additional information, please feel free to contact us. Thank you for your continued trust and attention to this matter.