Snapshot 256040
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Security at Pendo At Pendo, security and data privacy are first-order considerations, the north star for how we design our products and policies as an organization. Language: EnglishOpens in new tab 日本語Opens in new tab Privacy PolicyOpens in new tab Compliance SOC 2 - Type 2 PCI DSS - SAQ D; SP HIPAA GDPR CCPA Data Privacy Framework (DPF) Verified Microsoft Supplier Security & Privacy Assurance Program TX-RAMP Resources View all Security One-Pagers Independent Audit Reports & Certifications PCI DSS v4.0 Service Provider SAQ-D and Attestation of Compliance (October 2025) Pendo 2026 Microsoft's Supplier Data Protection Requirements Report View 2 more Compliance Guides & Responsibility Matrices Pendo PCI DSS v4.0 Responsibility Matrix (October 2025) Self-Assessments Higher Education Community Vendor Assessment Toolkit CSA CAIQ (Consensus Assessments Initiative Questionnaire) Pendo SIG Lite (Standardized Information Gathering) FY 2026 Policies & Governance Code of Business Conduct and Ethics Pendo Policy Summaries - February 2026 Pendo ePrivacy FAQ Architecture & Data Flows Pendo Architectural Diagram Security Testing (Penetration Testing & Vulnerability Management) Pendo Penetration Test Report - October 2026 AI Model Cards Pendo AI Model Card: Account Descriptions Pendo AI Model Card: Agent Analytics Pendo AI Model Card: AI Insights Pendo AI Model Card: AI Tagging View 9 more Accessibility Resources View 1 more Controls Subprocessors View all Google Cloud Platform • Hosting provider, CDN, and AI-enabled functionality. Purpose: Hosting infrastructure services, (optional) AI services Location(s) of processing: US, EU, JPN, AUS (at customer's designation) Amazon Web Services • CDN and Email routing Purpose: Email routing, legacy CDN Location(s) of processing: US, EU, JPN, AUS (according to customer's hosting location) OpenAI • AI-enabled functionality Purpose: (Optional) AI functionality in product Location(s) of processing: US or EU (according to customer's hosting location) Elastic.co • Search provider Purpose: Logging and query solution Location(s) of processing: US, EU, JPN, AUS (according to customer's hosting location) FAQ Updates View all General Security Update: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Published October 22, 2026 We are aware of the recently disclosed critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Pendo’s Security team began assessing our exposure as soon as the vulnerabilities were disclosed. The Pendo platform is not built on PHP, and we have confirmed that Pendo products and customer data are not impacted. We continue to monitor this issue closely, including our third-party services. We will provide updates here if our assessment changes. Questions can be sent to security@pendo.io or your Pendo account team. Incident Klue Compromise Published June 23, 2026 Last week, an unauthorized threat actor compromised Klue, a third-party competitive intelligence platform we use, and appears to have gained access to data from our Salesforce CRM. Our investigation to date shows that the unauthorized actor accessed business and contact data within our Salesforce instance. Our product platform was not affected. There is no evidence that any customer product data, authentication credentials, or technical data was accessed or compromised to date. This is a third-party breach that Pendo is a downstream victim of, not a Pendo breach. Note that Pendo is one of many victims of this attack, including some of our own customers and vendors. To proactively provide our customers with information about this incident, we have published a blog post yesterday evening with more details. As noted in the post, we have set up a dedicated email address for any customers who have additional questions: klue-incident@pendo.io. https://www.pendo.io/pendo-blog/security-update-klue-breach-and-impact-on-pendo/Opens in new tab Compliance 📣 Updated SOC Reports Available 📣 Published February 24, 2026 Hey Pendo Community, We're thrilled to announce that our latest AICPA SOC reports are now available for your review on trust.pendo.io! 🎉 In our ongoing commitment to transparency and security, we've worked diligently to ensure you have the insights you need to trust our platform. Our latest reports provide a comprehensive overview of our security practices and controls. 🚀 Check them out today and see how we're continuing to keep your data safe and sound! Thank you for your continued trust in Pendo. Together, let's keep building a secure future! Stay safe and secure, Pendo Security General Pendo Subprocessor Update Published September 6, 2025 We’ve updated our subprocessor list pertaining to services provided by Pendo.ioOpens in new tab, Inc. as follows: We are adding LangSmith under LangChain, Inc. to provide enhanced diagnostic capabilities for our AI Services to the subprocessor list. We are removing GlowTouch and Forethought.ai that provide technical support to the Customer Service team. We are no longer using the services previously provided by these suppliers. We are removing Zendesk from our subprocessor list. You can view the complete list of subprocessors at https://trust.pendo.io/subprocessorsOpens in new tab.