Snapshot 256406
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content The Keeper Trust Center is designed to provide current and prospective customers access to our security and compliance resources and reports. All information is for internal use only. Access to any nonpublic information in the Keeper Trust center is subject to the confidentiality terms presented to you for acceptance following your approval by Keeper. Compliance SOC 2 SOC 3 ISO 27001:2022 ISO 27017 ISO 27018 GDPR CCPA FedRAMP High Rev. 5 IL-5 Security Assessment Report Digital Operational Resilience Act NIS 2 Directive GovRAMP TX-RAMP Resources View all Financial 2023 Audited Financial Statement Bank Letter - Keeper U.S. Bank Letter - Keeper EMEA 2024 Audited Financial Statement View 2 more Compliance ISO 27001 - 27017 - 27018 Statement of Applicability (SoA) SIG Lite CCM and CAIQ v 4.0.1 View 14 more Security Testing BCP/DR Contingency & After Action Report - August 2025 PCI DSS Attestation of Scan Compliance Keeper's Internal Security Policies KSI Change Control Process KSI Personal Device Policy KSI Corporate Policy and Guidelines for Use of AI Tools KSI Candidate Selection Process View 19 more Privacy Diagrams Data Flow, Network Architecture & Application Architecture Diagrams Keeper Security GovCloud (KSGC) Keeper CMMC Controls AnalysisOpens in new tab KSGC Customer Responsibility Matrix (CRM ) - FedRAMP HighOpens in new tab IL-5 Security Assessment Report (SAR) Tax Documents Keeper Security EIN - SS4 Certificate of Incorporation - State of Delaware Keeper EMEA Tax Clearance Confirmation - 2026 Keeper EMEA Tax Residence Letter - 2026 View 2 more Accessibility HECVAT 4.0 Penetration Tests Keeper Admin Tool - Jan 2026 Keeper Vault Web & Desktop - Feb 2026 Keeper Android Mobile Penetration Test - March 27, 2026 Keeper Browser Extension QRC Penetration test - April 6, 2026 View 11 more Controls Updated less than a minute ago View all Infrastructure security Remote access encrypted enforced Organizational security Visitor procedures enforced Data retention procedures established Cybersecurity insurance maintained View 3 more Organizational security controls Product security Data encryption utilized Control self-assessments conducted Penetration testing performed View 1 more Product security control Internal security procedures Cybersecurity insurance maintained Development lifecycle established SOC 2 - System Description View 15 more Internal security procedures controls Data and privacy Data retention procedures established Data classification policy established Data collected Customer personally identifiable information Employee personally identifiable information Credit card information Personal health information Subprocessors View all Salesforce • Email and account license information United States Amazon Web Services • Cloud hosting provider United States, Ireland, Germany, Australia, Canada, Japan Cloud Infrastructure (Isolated to Customer in specified region) Hubspot • Email address for marketing communications United States HelpScout • Website chatbot United States FAQ View all Updates View all Security Security Update: eMudhra CA Certificate Incident Published November 4, 2026 Keeper Security is aware of the recently disclosed security incident involving eight intermediate CA certificates issued by eMudhra. Keeper’s zero-knowledge security architecture protects customer data independently of the TLS certificate ecosystem. All vault data is encrypted and decrypted locally on the user’s device using keys that are never transmitted to or stored by Keeper. TLS provides one layer of protection in transit, but customer data remains encrypted end-to-end beneath it. Customer data is not impacted by this incident. Security Security Update: PHP2Shell Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Published October 26, 2026 Keeper is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are Remote Code Execution (RCE) vulnerabilities, and each is rated with a 9.2 CVSS score. Keeper Security does not use PHP in the development of its applications, and therefore our customers are not impacted by this incident. Keeper's security team is closely monitoring developments and will continue taking proactive measures to ensure our systems remain secure. Security Keeper Users Protected From Transport-Layer Certificate Attacks Published October 22, 2026 Keeper Security is aware of the recently disclosed security incident involving eight intermediate CA certificates issued by eMudhra. Keeper’s zero-knowledge security architecture protects customer data independently of the TLS certificate ecosystem. All vault data is encrypted and decrypted locally on the user’s device using keys that are never transmitted to or stored by Keeper. TLS provides one layer of protection in transit, but customer data remains encrypted end-to-end beneath it. Customer data is not impacted by this incident. Security Keeper Security Unaffected by PHP Vulnerabilities Published October 22, 2026 Keeper is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are Remote Code Execution (RCE) vulnerabilities and each is rated with a 9.2 CVSS score. Keeper Security does not use PHP in the development of its applications, and therefore, is not impacted by this incident. Keeper's security team is closely monitoring developments and will continue taking proactive measures to ensure our systems remain secure.