Snapshot 250252
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Chili Piper The all-in-one Demand Conversion Platform Qualify, route, and schedule meetings from any inbound or outbound channel. Route CRM records to the right rep for fast follow up. Schedule more sales meetings and increase show rates. All with one platform. security@chilipiper.com Privacy PolicyOpens in new tab Compliance SOC 2 ISO 27001:2013 CCPA GDPR Resources View all Policies View 23 more Other resources View 5 more Controls Updated less than a minute ago View all Infrastructure security Unique production database authentication enforced Encryption key access restricted Unique account authentication enforced View 15 more Infrastructure security controls Organizational security Asset disposal procedures utilized Production inventory maintained Employee background checks performed View 8 more Organizational security controls Product security Data encryption utilized Control self-assessments conducted Penetration testing performed View 2 more Product security controls Internal security procedures Continuity and Disaster Recovery plans established Continuity and Disaster Recovery plans tested Cybersecurity insurance maintained View 31 more Internal security procedures controls Data and privacy Data retention procedures established Customer data deleted upon leaving Data classification policy established Data collected Customer personally identifiable information Employee personally identifiable information Credit card information Personal health information Subprocessors View all AWS • Website Hosting US East 6685 Crosby Ct, Plain City, OH 43064 Web Hosting Services Google Cloud Platform • App Hosting US Central Council Bluffs, IA 51501 Cloud infrastructure FAQ View all Updates View all Security Node2Shell (CVE-2026-111497): Chili Piper is not affected Published October 23, 2026 We have assessed Node2Shell (CVE-2026-111497), a high-severity remote code execution vulnerability in the Brotli decompression code bundled with Node.js and Bun. Chili Piper is not affected. All Chili Piper platform services run patched runtime versions. We have found no evidence of attempted or successful exploitation. No customer action is needed. Security PHP2Shell (CVE-2026-109618 / CVE-2026-109619): Chili Piper is not affected Published October 22, 2026 We have assessed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical unauthenticated remote code execution vulnerabilities in PHP. Chili Piper is not affected. The Chili Piper platform (infrastructure, apps, APIs, admin console and integrations) does not run PHP. No remediation is needed, and we have found no evidence of attempted or successful exploitation. No action is needed for the Chili Piper platform. If you use our optional WordPress plugin, it runs on your own WordPress host, so please make sure that host runs a fixed PHP version (8.5.12, 8.4.27, 8.3.36 or 8.2.35). Incident Security notice: Canny data breach Published September 17, 2026 Status: Resolved — last updated September 17, 2026 Canny, a third-party platform Chili Piper uses to collect product feedback, experienced a security incident on August 28, 2026. An unauthorized party obtained Chili Piper's Canny API key and used it to retrieve a portion of the user list from our public feedback board. Canny notified us on September 10, 2026. Chili Piper's own systems were not breached. No customer data held in the Chili Piper platform was accessed. What happened The unauthorized party made eleven read-only requests to a single Canny API endpoint over approximately 34 seconds on August 28, retrieving 1,100 user records from our feedback board. No data was created, modified, or deleted, and no other endpoint was accessed. What information was involved For the affected feedback board accounts, the retrieved records contained: Name and email address Avatar image URL Internal feedback board identifier, account creation date, and last-activity date Administrator flag for the feedback board account Job title and account-relationship fields synced from our CRM Whether you are an admin, primary decision maker, primary contact, executive sponsor, or high intent champion What was not involved Chili Piper platform data, including meeting data, calendar connections, and routing configuration Chili Piper account credentials Feedback board posts, comments, and votes What we have done The compromised API key was rotated on August 28 and September 1 We reviewed the complete log of activity performed with the key and confirmed the scope above We rotated credentials for every system connected to Canny and audited those systems for unauthorized activity, or have otherwise not reconnected those systems to Canny We are notifying all individuals whose information was involved We are reviewing our vendor assessment process and the scope of data we sync to third-party tools What we recommend The primary risk is targeted phishing. The retrieved data is sufficient to construct a convincing email impersonating Chili Piper. Please treat unexpected messages referencing Chili Piper with caution, particularly any requesting a sign-in, password reset, or account details. Chili Piper will never ask you for your password. Contact Questions about this incident can be directed to [security@chilipiper.com]. Canny has published its own disclosure and can be reached at security@canny.io. General Subscribe to Updates From Chili Piper's Trust Center Published May 1, 2024 You can now subscribe to updates from Chili Piper's Trust Center to be notified of any updates to our compliance and security program. We'll be communicating key information regarding new security documentation, messaging regarding known vulnerabilities in the market, and overall development on our security roadmap.