Snapshot 257704
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Expensify Expensify is the easiest way to do your expenses, travel, and corporate cards. Built for businesses of all sizes and trusted by 15 million members worldwide, Expensify is a top-rated app across G2, TrustRadius, Capterra, and more. concierge@expensify.com Privacy PolicyOpens in new tab Compliance SOC 1 SOC 2 PCI DSS 4.0.1 GDPR CCPA Digital Operational Resilience Act Resources View all Reports SOC 1 Type 2 Report SOC 2 Type 2 Report SOC 1 and SOC 2 - Bridge Letter View 2 more Policies Change Management Policy Information Security Policy Incident Response Plan Risk Management Policy Misc Documents (Finance) Expensify Vendor Form W-9 Expensify Bank Letter Misc Documents (Legal) US Customer DPA Opens in new tab Global Customer DPA Opens in new tab Certificate of Insurance Certificate of Good Standing Misc Documents (Security) Network Diagram Pentest Executive Summary Letter Expensify SIG Lite Questionnaire Subprocessors View all Amazon Web Services • Cloud Infrastructure Provider US Cloudflare • Cloud Security and Infrastructure US; Globally for CDN Evocative • Data Center Provider US Switch • Data Center Provider US FAQ Updates View all Security php2shell (CVE-2026-109618 and CVE-2026-109619) mitigations Published October 21, 2026 Expensify runs php for many of its services. We completed patching all of our php services for the "php2shellOpens in new tab" vulnerabilities this morning in line with our Emergency Patch Management Policy. All services were patched within 45 minutes of the patches becoming available. We have performed a review of activity and have no reason to believe either of these vulnerabilities were tested or used against our services. Additional mitigations include Cloudflare's managed WAF rules that target the php2shell attack vectors. Our team will continue to monitor activity related to these CVEs throughout the day. No customer action is required. Controls Updated less than a minute ago View all Infrastructure security Encryption key access restricted Unique account authentication enforced Production application access restricted View 14 more Infrastructure security controls Organizational security Asset disposal procedures utilized Production inventory maintained Employee background checks performed View 8 more Organizational security controls Product security Data encryption utilized Control self-assessments conducted Penetration testing performed View 2 more Product security controls Internal security procedures Continuity and Disaster Recovery plans established Continuity and Disaster Recovery plans tested Cybersecurity insurance maintained View 28 more Internal security procedures controls Data and privacy Data retention procedures established Customer data deleted upon leaving Data classification policy established