Snapshot 217827
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
2026 Penetration Re-Test Results Now Available – Celigo Integration Platform (integrator.io) Trust Center Start your security review View & download sensitive information Ask for information Overview Welcome to Celigo's Trust Center. As a Gartner Magic Quadrant™ recognized Integration Platform as a Service (iPaaS) provider operating globally, we take a proactive, risk-based approach to protecting your data and ensuring operational resilience. Our commitment to data privacy and security is embedded in every part of our business. Use this Celigo Trust Center to learn about our security controls, regulatory compliance, internal governance, and request access to our security documentation. Compliance CCPA GDPR SOC 2 Type 2 SOC 1 Type 2 ISO/IEC 27001 ISO/IEC 42001:2023 Documents REPORTSPentest Report COMPLIANCEISO/IEC 27001 COMPLIANCEISO/IEC 42001:2023 COMPLIANCESOC 1 Type 2 COMPLIANCESOC 2 Type 2 SELF-ASSESSMENTSCeligo Self-Assessment LEGALCyber Insurance LEGALData Processing Addendum LEGALMaster Services Agreement LEGALService-Level Agreement DATA PRIVACYInternational Data Protection & Regulatory Representation CORPORATE SECURITYCode of Conduct Product Security Service-Level Agreement Single Sign On Multi-Factor Authentication View more Data Security Access Monitoring Data Asset Classification Data Backups View more Regulatory Compliance HIPAA GDPR CCPA / CPRA View more AI AI Overview AI Governance & Guardrails Data Usage & Privacy View more BC/DR BC/DR Data Backup/Backup Protection Disaster Recovery Plan (DRP) Risk Profile Recovery Time Objective24 hours Recovery Point Objective2 hours HostingMajor Cloud Provider Self-Assessments Celigo Self-Assessment App Security Software Development Lifecycle Code Analysis Credential Management View more Access Control Data Access Least Privilege Password Requirements View more Data Privacy Data Residency Data Protection Officer International Data Protection & Regulatory Representation View more Infrastructure Cloud Service Providers Data Center Environment Separation View more Policies Information Security Policy Acceptable Use Policy Modern Slavery Policy Endpoint Security Anti-Malware Disk Encryption Threat Detection Network Security Distributed Denial of Service Protection (Anti-DDoS) Firewall Intrusion Detection and Monitoring View more Corporate Security Asset Management Practices Code of Conduct Employee Training View more Risk Management Risk Assessments Third Party / Subprocessor Risk Legal Subprocessors Cyber Insurance Data Processing Addendum View more Incident Response Incident Response Plan ESG ESG In Business Practice Reports Pentest Report Subprocessors Knowledge Base (FAQ) From which countries can Celigo personnel access customer data? Which AWS regions host the Celigo platform? How does Celigo protect international transfers of personal data? Do backups, logs and disaster-recovery copies stay in my selected region? Can I move my account to a different region? View more Trust Center Updates 2026 Penetration Re-Test Results Now Available – Celigo Integration Platform (integrator.io) Compliance Celigo’s 2026 penetration test documentation for the Celigo Integration Platform (integrator.io) is now available in the Trust Center. ScienceSoft, an independent security firm, ran the penetration test in July and August 2026 and completed a re-test on October 27, 2026. Testing covered the integrator.io web application, its APIs, and Ora, the in-app AI assistant, across Production North America, Production Europe, and Staging. ScienceSoft did not gain unauthorized access to Celigo’s infrastructure. Two new documents are available: Penetration Testing Re-Test Report – Redacted Excerpt: ScienceSoft’s executive summary, a summary of the testing scope, and the remediation status of each finding. 2026 Penetration Test Remediation Summary: Celigo’s status and response for each finding, including remediated items, findings reviewed and accepted, and remediation in progress. Please request access to the documents through the Trust Center. For questions, contact the Celigo Security team at security@celigo.com. Security Advisory: eMudhra Certificate Authority Compromise Vulnerabilities Action required for on-premise agent customers This update applies only to customers who use the Celigo on-premise agent. If you don’t use the on-premise agent, you don’t need to do anything. On-premise agent version 5.7.5 is now available. It removes trust in the compromised eMudhra certificates. Update every on-premise agent to version 5.7.5 or later as soon as possible, and no later than December 7, 2026. Steps are in Update your on-premise agent and in the “On-premise agent customers” section below. If you need help, contact Celigo Support and include “eMudhra agent update” in the subject line. Summary On October 20, 2026, it was publicly disclosed that eMudhra, a third-party certificate authority (CA), had generated the private keys for eight of its intermediate certificates—six used for TLS and two for code signing—with a weak method that allows the keys to be recovered. Anyone with these keys could issue certificates that systems trusting the affected intermediates would accept as legitimate. The issue was first reported to major browser root programs on October 17, 2026. eMudhra revoked all eight intermediate certificates on October 18, 2026. Chrome, Firefox, and Android have distributed updates to block the affected certificates. This is an industry-wide issue affecting systems that trust these certificates. It is not specific to Celigo. Celigo’s assessment Celigo’s certificates are not affected. integrator.io, the Celigo APIs, all regional environments (NA, EU, AU, and CA), celigo.com, and our documentation sites use certificates issued by other certificate authorities. What we evaluated: Like many cloud platforms, our backend services use trusted-certificate lists built into standard software runtimes. At the time of our assessment, those lists still trusted the affected certificates. This applies to the outbound connections integrator.io makes to customer and third-party endpoints. Actions we are taking We started our response on October 22, 2026, and have treated it as our highest priority. We are rebuilding and redeploying our services on updated runtimes that no longer trust the eight compromised intermediate certificates. The rollout begins on October 23, 2026, at 9:30 PM PT (12:30 AM ET on October 24) and will proceed in phases, with our core platform services updated first and adaptors updated afterward. What this means for you Most customers don’t need to do anything. If an endpoint your integrations connect to uses a certificate issued under one of the revoked eMudhra intermediates, connections to that endpoint will fail with a certificate (TLS/SSL) error once the update reaches your account. That certificate has already been revoked by eMudhra, and the affected intermediates have been blocked in major browsers. To restore the connection, the endpoint owner—your IT team or the vendor—must replace the certificate with one from a different certificate authority. You don’t need to change anything in integrator.io once the certificate is replaced. On-premise agent customers The on-premise agent also needs to be updated to stop trusting the compromised certificates. Agents already installed in your environment are not updated automatically by the integrator.io platform update. We are preparing an updated agent release and will post the version number and upgrade instructions here when it is available. When it is released, all customers using the on-premise agent must upgrade to that version or higher. Frequently asked questions Is this a Celigo vulnerability? No. This is a compromise at a third-party certificate authority that affects software across the industry. Celigo is updating its platform so it no longer trusts the affected certificates. How do I know if I’m affected? If any of your connections start returning a certificate error after the update, the endpoint may be using an affected certificate. We are also contacting customers we’ve identified as likely to be affected. Can Celigo fix an affected endpoint for me? No. The certificate belongs to the endpoint owner, who has to replace it. Celigo Support can help confirm the cause of the error. Do I need to change my integrations? No. Once the endpoint’s certificate is replaced, your connections will resume without any configuration changes. Contact For questions or help, contact Celigo Support. Update log October 23, 2026: Initial advisory published. References Google Security Blog Mozilla Security Blog eMudhra statement Celigo Response to PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Vulnerabilities Last updated: October 22, 2026 Summary Celigo’s Security team has assessed CVE-2026-109618 and CVE-2026-109619, two vulnerabilities affecting PHP. Our assessment found no impact on the integrator.io platform, Integration Apps, or the systems that support customer integration environments. Remediation for Celigo’s PHP-based marketing websites is complete. No action is required within your Celigo environment. integrator.io Platform and Integration Apps The integrator.io platform and Integration Apps are not built on PHP. Our assessment found no exposure to these vulnerabilities in the systems that support customer integration environments. Celigo Marketing Websites Some Celigo public marketing websites run on WordPress, which uses PHP. These websites are separate from the integrator.io platform and do not host or process customer integration data. For these websites, Celigo has: Enabled managed web application firewall (WAF) rules for these CVEs in blocking mode to help block exploit attempts. Upgraded PHP to a release that addresses both vulnerabilities. The upgrade was completed on October 21, 2026, at 8:19 p.m. Central Time (CDT). Evidence of Exploitation As of October 22, 2026, Celigo has found no evidence of exploitation of these vulnerabilities against Celigo systems. Customer Action No action or configuration changes are required within your Celigo environment. If your organization operates PHP-based applications that connect to Celigo, such as a self-hosted Magento or Adobe Commerce store, work with your application administrator or hosting provider to assess those systems and apply applicable security updates. Additional Information If your security team needs additional information or written confirmation of Celigo’s assessment, contact your Celigo account representative. General security and compliance documentation is available in the Celigo Trust Center. Celigo’s New SOC 1 Type 2 Report is Now Available Compliance Celigo is pleased to announce the availability of our latest SOC 1 Type 2 report, reflecting our continued commitment to maintaining strong controls and earning the trust of our customers. The SOC 1 Type 2 examination provides independent assurance regarding the design and operating effectiveness of controls relevant to our customers’ internal control over financial reporting over the examination period. This latest report reinforces Celigo’s ongoing investment in a strong security and compliance program and our commitment to providing customers with the assurance and transparency they need when evaluating and using our services. Accessing the Report The latest SOC 1 Type 2 report is available to eligible customers and prospects through the Celigo Trust Center. If you require access, please request the report directly through the Trust Center. We’re proud to continue strengthening our security and compliance program and providing our customers with independent assurance over the controls that support their use of Celigo. 2025 SOC 2 Type 2 Report Now Available Compliance We’re excited to share that our 2025 SOC 2 Type 2 Report for the Celigo Platform is now available in the Celigo Trust Center. The report is accessible to authorized users under NDA. 👉 Visit https://trust.celigo.com/ to request access, view, or download the report. If you need help using this Trust Center, please contact us. Contact support