Snapshot 186248
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Branch Search the Trust Center... Ctrl +K Quick links Branch.io Report a Vulnerability Branch Legal Center Quick links Branch.io Report a Vulnerability Branch Legal Center Certifications ISO 27701 ISO 27018 CSA GDPR CCPA Featured Documents Announcements Oct 29, 2026, 02:11 UTC Statement regarding eMudhra Certificate Authority Incident (CVE-2026-111943) and Node2Shell (CVE-2026-111497) We are aware of the eMudhra Certificate Authority key-generation incident tracked as CVE-2026-111943 and the Node.js Brotli decoder vulnerability known as Node2Shell (CVE-2026-111497), both disclosed in October 2026. We completed a full impact assessment and confirmed these issues do not affect Branch’s product systems or systems that process, store, or handle customer data. Branch does not rely on eMudhra-issued certificates for any production services or systems that handle customer data. Our TLS certificates and trust stores are sourced from established, widely trusted certificate authorities and are continuously validated. In addition, Branch does not run vulnerable Node.js runtimes in any product systems or systems that process customer data in a manner that would expose them to Node2Shell. No customer action is required. Protecting the confidentiality, integrity, and availability of customer data is a core priority. We continuously monitor the threat landscape, assess emerging vulnerabilities, and maintain layered controls designed to reduce risk across our environment. We will continue monitoring this situation and will provide further updates if needed. If you have questions, please contact your Branch account team or our security team at security@branch.io. Branch Security Team October 26, 2026 Oct 23, 2026, 02:13 UTC Statement regarding PHP Remote Code Execution Vulnerabilities We are aware of the critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) disclosed on October 21, 2026. We completed a full impact assessment and confirmed these issues do not affect Branch. Branch does not run PHP, PHP-FPM, or any PHP-based web interfaces or APIs in product systems or systems that process, store, or handle customer data. Our production platforms and customer-facing services are built on modern technology stacks that do not rely on PHP. No customer action is required. Protecting the confidentiality, integrity, and availability of customer data is a core priority. We continuously monitor the threat landscape, assess emerging vulnerabilities, and maintain layered controls designed to reduce risk across our environment. We will continue monitoring this situation and will provide further updates if needed. If you have questions, please contact your Branch account team or our security team at security@branch.io. Branch Security Team October 22, 2026 Quick Summary One or more annual third-party audit(s) Has a formal mobile device management (MDM) program Annual third-party penetration testing Has a disaster recovery plan Subprocessors list available Has cyber insurance Will enter into a DPA Has a bug bounty or vulnerability disclosure program Deletes customer data on request Has an API available Uses a centralized IAM solution (SSO) to manage employee access Has a status page Has a privacy policy Subprocessors8 Subprocessor Location of Processing Usage Details Anthropic United States Non-training generative artificial intelligence services Atlassian United States Internal ticketing platform Auth0 United States SAML Single Sign On AWS United States (1) Hosting & cloud infrastructure (2) Non-training generative artificial intelligence services DataGrail United States Data subject request portal Software Mind Poland No data centers; Software Minds may access data center(s) Branch utilizes while providing support. Support team is located in Poland. ThoughtSpot United States Business analytics - authorized by Branch to process Personal Data on behalf of Customer for the analytics feature in the Branch Dashboard that may leverage generative artificial intelligence, if enabled by Customer. Zendesk United States Customer support ticketing platform Last updated June 1, 2026. . View as: Documents & Knowledge Base FAQs Powered by Conveyor, the first end-to-end customer trust platform. Learn more