Snapshot 243731
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Portal Start your security review View & download sensitive information Ask for information Overview At Contentsquare (to which Heap and Hotjar have recently been incorporated), the security, confidentiality and availability of your data is of utmost importance to us. We have invested heavily in our security program which is based on a Defense in Depth model. Our cybersecurity program aligns with the NIST Cybersecurity Framework and our policies, procedures, and standards are based on the International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 27001 Framework. Contentsquare is ISO 27001, ISO 27017, ISO 27018 and ISO 27701 certified and holds a SOC 2 Type II report. Contentsquare’s security program is managed by our chief information security officer (CISO). The CISO is supported by cybersecurity members that are leading and managing DevSecOps, product security, security governance, third-party risk assurance and information technology risk. Compliance ISO 9001:2015 ISO/IEC 27001 ISO/IEC 27001 SoA ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 27701 SOC 2 Type 2 Documents Featured Documents REPORTSPentest Report REPORTSSecurity Whitepaper COMPLIANCEISO/IEC 27001 COMPLIANCEISO/IEC 27701 SELF-ASSESSMENTSCAIQ POLICIESInformation Security Policy Policies Information Security Policy Information Management System (IMS) Policy Incident Response Policy View more Product Security Audit Logging Data Security Integrations View more Self-Assessments CAIQ SIG Lite Data Privacy Privacy Policies Data Processing Agreement (DPA) Details of Data Processing by Product View more Data Security Access Monitoring Data Backups Data Deletion View more AI AI Overview Data Use and Data Privacy for AI Features AI Model List App Security Responsible Disclosure Code Analysis Credential Management View more Reports Network Diagram Pentest Report Security Whitepaper Legal Master Services Agreement Service-Level Agreement Cyber Insurance View more Access Control Data Access Logging Password Security Infrastructure Amazon Web Services and Azure BC/DR Infrastructure Security View more Endpoint Security Disk Encryption Endpoint Detection & Response Mobile Device Management Network Security Security Information and Event Management Virtual Private Cloud Corporate Security Employee Training and Security Incident Response Internal Assessments View more Security Grades Qualys SSL Labs contentsquare.com A+ Availability Status Page Physical & Environment Access Monitoring Alarms & Surveillance Fire Protection View more Continuous Monitoring Automated Alert Response Automated Compliance Monitoring Data Loss Prevention System (DLP) View more Trust Portal Updates Security Update regarding CVE-2026-98432 Vulnerabilities Dear Customers, We are actively investigating CVE-2026-98432, a recently disclosed Linux kernel vulnerability. We are currently in the process of patching the impacted components across our infrastructure. At this time, we are not aware of this issue being exploited on any of our services. We are closely monitoring the situation and will provide further updates on our progress as patching continues. We remain committed to the highest standards of security and transparency. If you have any questions, please contact us at security@contentsquare.com. Sincerely, The Contentsquare Security Team Security Update regarding CVE-2026-111497 affecting the Node.js Brotli decoder Vulnerabilities On October 21, 2026, the Node.js project disclosed CVE-2026-111497, a high-severity vulnerability in the Brotli decoder bundled with Node.js. The vulnerability is an out-of-bounds write that can be triggered when an application decompresses specially crafted Brotli data. Depending on the application and deployment environment, successful exploitation could cause a process crash, disclose process memory, or potentially allow remote code execution. Contentsquare has successfully completed all remediation efforts regarding this vulnerability. We have upgraded and patched all Node.js runtimes across our infrastructure to the secure versions. Additionally, we have concluded our investigation into other components utilizing the Brotli decoder and can confirm that our systems are fully patched. Contentsquare is no longer vulnerable to or impacted by this issue. No customer action is required, and we consider this matter closed. We remain committed to the highest standards of security and transparency. If you have any questions or require a formal written confirmation, please contact us at security@contentsquare(.)com. Sincerely, The Contentsquare Security Team Security Update regarding CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) Vulnerabilities Dear Customers, Contentsquare was notified of CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities affecting PHP workloads and potentially allowing unauthenticated remote code execution in vulnerable PHP environments. Following notification, we conducted an assessment of our production environment, including a review of our deployed workloads and application components. Based on this analysis, we confirmed that Contentsquare does not use or operate any PHP workloads or PHP runtime components. As the affected technology is not present in our environment, Contentsquare is not impacted by CVE-2026-109618 or CVE-2026-109619. No remediation or customer action is required in relation to these vulnerabilities. We remain committed to the highest standards of security and transparency. If you have any questions or require a formal written confirmation, please contact us at security@contentsquare(.)com. Sincerely, The Contentsquare Security Team Security Update regarding CVE-2026-31431 (Copy Fail) Vulnerabilities Dear Customers, Following the public disclosure on April 29, 2026 of a critical Linux kernel vulnerability tracked as CVE-2026-31431 and nicknamed “Copy Fail”, we immediately initiated a comprehensive assessment of all potentially affected systems and infrastructure. We are writing to confirm that Contentsquare services and customer data remain secure. Specifically: • Proactive Assessment & Rapid Response: Upon identification of CVE-2026-31431, our security team promptly invoked our incident response protocol. We conducted a thorough scope assessment across our full infrastructure, including all Linux-based systems and workloads. Interim mitigations were applied immediately while awaiting official patches from our vendors. • Patch Deployment Near Complete: We are pleased to confirm that the vast majority of our production systems and services have been successfully patched against CVE-2026-31431, with zero downtime and zero failed deployments throughout the process. A small number of remaining workloads are actively being remediated and are expected to reach full patch coverage imminently. • No Impact on Customer Data: Our investigation confirms that no customer data was accessed, exfiltrated, or impacted as a result of this vulnerability. No breach or unauthorized access has been identified within our systems or those of our sub-processors. • Ongoing Monitoring: We’re continuously monitoring all systems for any signs of exploitation, and any newly identified affected assets are being remediated without delay. We remain committed to the highest standards of security and transparency. If you have any questions or require a formal written confirmation, please contact us at security@contentsquare(.)com. Sincerely, The Contentsquare Security Team Security Update regarding Axios supply chain compromise Vulnerabilities Dear Customers, Following recent supply chain attack reports regarding specific compromised Axios releases, our security team performed a comprehensive audit of our development and build environments. We are writing to confirm that Contentsquare services and customer data remain secure. We are also writing to confirm the following: Proactive Mitigation: Upon identification of the affected package versions, we immediately invoked our incident response protocol. As a standard proactive security best practice, we completed a comprehensive rotation of internal credentials and environment secrets to ensure the continued integrity of our systems. No Impact on Customer Data: Our investigation confirms that no customer data was accessed or impacted. The scope was limited to internal build processes, which have since been cleared. Supply Chain Resilience: To further harden our environment, we have formalized new security policies requiring stricter version-pinning and a minimum release age requirement for all third-party dependencies. We are currently implementing these architectural controls to further minimize exposure to future supply chain risks. We remain committed to transparency and the highest standards of data protection. If you have any questions, please contact us at security@contentsquare(.)com. Sincerely, The Contentsquare Security Team If you think you may have discovered a vulnerability, please send us a note. Report issue