Snapshot 250484
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Center
Start your security review
View & download sensitive information
Ask for information
Overview
At FrankieOne, your trust is our top priority. We understand the significance of data security in today's digital landscape and are dedicated to safeguarding your data with the utmost care. Our commitment to security is unwavering, and we employ comprehensive systems and protocols to ensure the protection of the information you entrust to us.
This commitment spans our entire services - KYC, KYB, IDV, AML/CTF, OneSDK, Fraud & Transaction Monitoring, Portal. These robust security measures are designed to safeguard the sensitive data and processes across all our solutions.
Within this Trust Centre, you'll find detailed insights into our data security practices and the robust procedures we've established. We aim to offer transparency about our security measures and to reinforce the confidence you place in FrankieOne.
Compliance
GDPR
ISO/IEC 27001:2022
SOC 2
BIMI
Frankie One is reviewed and trusted by
ANZ Bank
Commonwealth Bank of Australia
Westpac
Qantas
Finder
BTC Markets
Cointree
MYOB
Shopify.com
Afterpay
Kraken
Binance
Documents
Featured Documents
COMPLIANCESOC 2
Knowledge Base (FAQ)
Describe your organisation penetration testing approach and frequency? Please provide the latest penetration testing report.
Does your organisation hold any certifications? For example, ISO/IEC 27001, Privacy Shield, ISO9001, Cyber Essentials.
Explain how your organization handles data privacy in compliance with the Australian Privacy Act 1988 and the Notifiable Data Breach scheme.
Do you use encryption for external/internal information transmissions (i.e., over the network/internet)? What encryption standard do you use?
Has your organization experienced any information security incidents or breaches in the past 24 months? If so, what controls were implemented to mitigate risks from these breaches?"
View more
Risk Profile
Data Access LevelRestricted
Impact LevelSevere
Recovery Time Objective2 hours
View more
Policies
Acceptable Use Policy
Anti Bribery Policy
Asset Management Policy
View more
Reports
Other Reports
Pentest Report
SOC 2 Report
Product Security
Audit Logging
Data Security
Integrations
View more
Data Security
Access Monitoring
Certificates of Destruction
Data Asset Classification
View more
App Security
Responsible Disclosure
Application Penetration Testing
Code Analysis
View more
Legal
Subprocessors
Customer Audit Rights
Cyber Insurance
View more
Access Control
Access Log Management
Bring Your Own Device (BYOD)
Data Access
View more
AI
AI Security
AI Overview
AI Training Data and Bias
View more
Data Privacy
Cookies
Data Breach Notifications
Data Into System
View more
Infrastructure
Security Information and Event Management
Status Monitoring
Cross Environment Security
View more
Endpoint Security
Anti-Malware
Disk Encryption
Endpoint Detection & Response
View more
Network Security
Bot Detection
Data Loss Prevention
Distributed Denial of Service Protection (Anti-DDoS)
View more
Corporate Security
Asset Management Practices
Email Protection
Employee Training
View more
Incident Response
Incident Response Plan
Designated Response Personnel
Forensic Retainer
View more
Risk Management
Data Access/Impact Levels
Risk Assessments
Supply Chain Risk Management
View more
Asset Management
Asset Classification
Asset Inventories (Hardware/Software)
Asset Tracking
View more
BC/DR
Alternate Processing/Storage Site
Business Continuity Management System (BCMS)
Business Continuity Plan (BCP)
View more
Training
Security Awareness Training
Employee Privacy Training
Phishing Training
View more
Change Management
Change Advisory Board (CAB)
Change Management Program
Changes Notification & Verification
View more
ESG
Anti-Bribery and Corruption
Anti-Modern Slavery
Code of Ethics
View more
Security Grades
Qualys SSL Labs
Qualys SSL Scan
A
Subprocessors
Trust Center Updates
Security Notification: Brotli Decompression Vulnerability "Node2Shell" (CVE-2026-111497)
Vulnerabilities
Summary
On 23 October 2026, a critical vulnerability known as "Node2Shell" (CVE-2026-111497) was disclosed in the Brotli decompression handling used by Node.js. A specially crafted Brotli-compressed request could allow remote code execution on an affected server.
Impact assessment
FrankieOne identified Node.js services in our environment that could process Brotli-compressed data.
We have found no evidence of exploitation affecting FrankieOne systems or customer data.
No action is required from customers.
Remediation
FrankieOne opened a security event on 23 October 2026.
Immediate mitigation (23 October): Within hours of disclosure, we deployed a web application firewall rule at our edge that blocks Brotli-compressed request bodies to all public endpoints.
Permanent fix: We upgraded Node.js to patched versions and updated the Brotli system library used. Updated builds were deployed to production, and the event was closed on 27 October 2026.
A small number of internal components that are not reachable from the internet are being updated as patched versions become available.
Security Notification: eMudhra Intermediate Certificate Authority (CA) Compromise
Vulnerabilities
Summary
On 21 October 2026, the compromise of an intermediate certificate authority operated by eMudhra was publicly disclosed. The compromise could allow an attacker to issue fraudulent TLS certificates that would be trusted by systems that had not yet removed the affected CA. Major browser and operating system vendors have since distrusted it.
Impact assessment
FrankieOne's services, like most software, rely on standard trusted-CA bundles in their container images and runtimes. Until those bundles are updated, an attacker who held a fraudulent certificate and could intercept network traffic could, in theory, impersonate a site our systems connect to.
We have found no evidence of exploitation affecting FrankieOne systems or customer data.
No action is required from customers.
Remediation
FrankieOne opened a security event on 22 October 2026 and took the following steps:
Inventoried all affected services, functions and infrastructure across production and non-production environments
Rebuilt and redeployed services with updated trust stores that remove the compromised CA.
Rebuilt our hardened base images, CI/CD build runners and administrative hosts.
Updated trust stores on employee workstations.
FrankieOne is not affected by PHP2Shell security issue
Vulnerabilities
On 21 October 2026, the PHP project released emergency security updates for two critical vulnerabilities in the PHP engine, known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities can allow an unauthenticated attacker to run code on web servers running unpatched versions of PHP.
Summary
Based on our assessment to date, FrankieOne's platform and services are not affected.
What we did
Our Security team assessed our cloud environments. This assessment found:
No PHP or PHP-based technologies in our production or non-production environments
No vulnerability findings for CVE-2026-109618 or CVE-2026-109619
No internet-exposed assets vulnerable to these issues
No threat detections related to PHP2Shell exploitation
FrankieOne's platform is not built on PHP. Our corporate website is hosted on a managed SaaS platform that does not require us to operate or patch PHP servers.
Ongoing monitoring
We continue to monitor for new information about these vulnerabilities, including updated detection guidance and exploitation activity, and we are reviewing our third-party providers for potential exposure. We will update this notice if our assessment changes.
Questions
If you have questions about this notice, please contact your FrankieOne account manager or our Security team at security@frankieone.com.
Mini Shai-Hulud / TanStack npm and PyPI Supply Chain Campaign
Vulnerabilities
Mini Shai-Hulud / TanStack npm and PyPI Supply Chain Campaign
What happened: On 12 May 2026, the TeamPCP threat group ran a coordinated supply chain attack ("Mini Shai-Hulud") against the npm and PyPI ecosystems. Several malicious versions of packages were published across the @tanstack, @uipath, and @mistralai npm namespaces, as well as two PyPI packages (mistralai 2.4.6 and guardrails-ai 0.10.1). The payload targeted cloud credentials, CI/CD secrets, SSH keys, and GitHub and npm tokens, and used stolen CI/CD tokens to self-propagate to additional downstream packages. The compromised versions were available for approximately 20 minutes before external researchers detected the attack.
FrankieOne's response:
Impact assessment: We conducted a comprehensive Software Bill of Materials (SBOM) audit across all FrankieOne repositories, covering every package implicated in the campaign. No compromised package versions were present in any FrankieOne system, and no FrankieOne or customer data were affected.
GitHub Actions hardening: We reviewed our CI/CD workflows for related supply chain risks. Third-party GitHub Actions are pinned to specific commit SHAs in line with GitHub's own security recommendations, preventing attackers from introducing malicious code via tampered action versions.
Detection improvements: Indicators of Compromise (IOCs) published by StepSecurity, Socket, and Wiz, including attacker infrastructure domains such as filev2.getsession.org, api.masscan.cloud, and git-tanstack.com, have been added to our application security scanners and endpoint detection tooling to ensure early detection of any future related activity.
Impact Assessment: Supply Chain Attack Response - LiteLLM & axios
Vulnerabilities
Status: ✅ Reviewed & Remediated - No customer impact
Overview
FrankieOne's security team has completed a thorough review in response to two significant open-source supply chain attacks that emerged in late March 2026. Both attacks targeted widely-used packages and affected organisations across the industry. We want to be transparent with our customers about what happened, what we did, and what it means for you.
Incident 1: LiteLLM PyPI Compromise (March 26, 2026)
What happened: The maintainer account for LiteLLM - a widely used Python library for interfacing with LLM providers such as OpenAI and Anthropic - was compromised. Attackers published two malicious versions (1.82.7 and 1.82.8) to PyPI containing a multi-stage credential-stealing payload. The malware targeted environment variables, cloud credentials (AWS, GCP, Azure), SSH keys, Kubernetes configs, CI/CD secrets, and database credentials, exfiltrating them to attacker-controlled infrastructure. The malicious versions were available for approximately two hours before removal.
FrankieOne's response:
✅ Impact assessment: We conducted a comprehensive audit of all our repositories and found no usage of the compromised LiteLLM versions (1.82.7 or 1.82.8). No FrankieOne systems or customer data were affected.
✅ GitHub Actions pinning: We performed a review and hardening of our CI/CD pipeline by pinning all third-party GitHub Actions to specific commit SHAs, in line with GitHub's own security recommendations. This prevents attackers from introducing malicious code via tampered action versions and ensures we only run workflows we have explicitly audited and approved.
✅ Detection improvements: The Indicators of Compromise (IOCs) and event detection rules for this attack have been added to our application security scanners to ensure early detection of any future related activity.
Incident 2: axios npm Compromise (March 31, 2026)
What happened: The npm account of the lead axios maintainer - axios being one of the most widely downloaded JavaScript HTTP client libraries with over 300 million weekly downloads - was hijacked. Two malicious versions were published: axios@1.14.1 and axios@0.30.4. Both versions injected a malicious dependency (plain-crypto-js@4.2.1) that deployed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux. The malware contacted attacker-controlled infrastructure and self-destructed after execution to avoid forensic detection. npm removed both versions shortly after discovery.
FrankieOne's response:
✅ Impact assessment: We audited all repositories in our GitHub organisation and confirmed that none of our codebases referenced or resolved the malicious axios versions (1.14.1 or 0.30.4). No FrankieOne systems or customer data were affected.
✅ Package lockdown: We have pinned axios to a verified stable version and disabled automatic updates for the package, preventing any unreviewed future versions from being pulled into our builds.
✅ Detection improvements: The IOCs and event detection rules for this attack - including the C2 domain sfrclak[.]com and associated filesystem artifacts - have been added to our application security scanners.
What This Means for Our Customers
At this time, FrankieOne has found no evidence of compromise in relation to either attack. There has been no unauthorised access to customer data and no impact to the FrankieOne platform or services.
These incidents are a reminder of the systemic risk posed by open-source supply chain attacks. FrankieOne takes a proactive, defence-in-depth approach to supply chain security, including continuous dependency scanning, CI/CD hardening, and active monitoring of threat intelligence feeds.
If you think you may have discovered a vulnerability, please send us a note.
Report issue