Snapshot 179200
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Whatfix Whatfix Founded in 2014 Your Security Is Our Priority At Whatfix, protecting the confidentiality, integrity, and availability of customer data is central to the design and operation of our DAP services. Security and privacy are embedded throughout the SaaS lifecycle, from development through ongoing operations. Our program is supported by industry-recognized frameworks, strong technical and organizational controls, and continuous monitoring to safeguard data against unauthorized access, disclosure, alteration, and loss. We operate under a shared responsibility model and support our customers in meeting applicable regulatory and data protection requirements. This Trust Center provides transparency into our security, privacy, and compliance practices, including relevant policies, certifications, and documentation. **Note: All documents, materials, and information accessed through this Trust Center are Confidential and subject to the terms of your Non-Disclosure Agreement (NDA) with Whatfix. By accessing this content, you agree to handle all information responsibly and not disclose it to unauthorized parties.* Founded in 2014 | | | | Overview Compliances Trusted by Controls Resources Subprocessors Updates Your Data Compliances ISO 27001 v2022 Compliant ISO 42001 Certified ISO 27701 Compliant ISO 27017 Compliant ISO 27018 Compliant CSA Star Compliant SOC 2 Compliant GDPR Compliant UK GDPR Compliant HIPAA Compliant CPRA (formerly CCPA) Compliant EU_US Data Privacy Framework Compliant Cyber Essentials Plus Compliant TISAX Compliant CrefoZert Compliant CyberVadis Compliant Cyber Essentials Certified GxP Compliant EU Artificial Intelligence Act Compliant Companies Act, 2013 Compliant Trusted by Shell UPS Caterpillar Cisco Microsoft Manpower Group Resources Acceptable Usage Policy Policy Information Security Policy Policy Data Privacy Policy Policy Access Control Policy Policy Anti-Malware Policy Policy Media Disposal Policy Policy Controls Product security Role Based Access Controls Audit Logging Data Security Data security Access Monitoring Backups Enabled Encryption at Rest Network security Data Loss Prevention Firewall IDS/IPS App security Conspicuous Link To Privacy Notice Secure system modification Regression Testing Corporate security Code of Business Conduct Roles & Responsibilities Personnel Screening Subprocessors Microsoft Azure Hosting Providers United Stat... Switzerland +1 more Cloudflare IT infrastructure United States of America Datadog Infra Monitoring Providers United Stat... Germany Descope Identity Providers United Stat... Germany Zendesk Customer Service United States of America Mindtickle Collaboration United States of America Updates Latest External VAPT Reports Available Oct 29, 2026 We are pleased to inform you that the latest external Vulnerability Assessment and Penetration Testing (VAPT) reports for our web application and network infrastructure are now available on our Trust Center. Whatfix Security Advisory: No Impact from Recent PHP Vulnerabilities Oct 22, 2026 Dear Customer, In response to recent security disclosures regarding PHP vulnerabilities, Whatfix has conducted a thorough security assessment across our applications, infrastructure, and delivery pipelines. Assessment Findings & Operational Impact: Application & Platform Stack: Whatfix does not utilize PHP in its source code, application architecture, or runtime environments. As a result, our core software and customer data are inherently unaffected by this vulnerability. Server Infrastructure: Whatfix server environments (hosted on Microsoft Azure) do not have PHP installed or enabled, nor is PHP required for any platform functionality. Internal Operations & Sub-processors: Our Information Security team has reviewed our corporate tools and core sub-processors. No critical operational systems or sub-processor environments supporting the delivery of Whatfix services are exposed or vulnerable to this issue. Conclusion: There is zero impact to Whatfix services, infrastructure, or customer data as a result of these PHP vulnerabilities, and no action is required on your part. Whatfix continues to monitor threats proactively as part of our continuous vulnerability management program. If you have any further questions, please contact our Trust & Security Team at infosec@whatfix.com Sincerely, Whatfix Information Security & Compliance Team Whatfix Achieves ISO/IEC 42001:2023 Certification Oct 12, 2026 Whatfix is pleased to announce that it is now ISO/IEC 42001:2023 certified, demonstrating its commitment to responsible AI governance, effective AI risk management, and continual improvement in its AI Management System (AIMS). Your Data Want to access or modify your data? Send a request to request access, updates, migration, or deletion, and we'll get it done for you. Create your own Trust Center | Powered by