Snapshot 257739
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content DataDome Trust Center Securing your digital ecosystem through transparency and rigorous standards. DataDome provides a secure traffic control plane trusted by global enterprises to defend critical applications against bots, fraud, and malicious AI agents. Trust is the foundation of everything we do: from analyzing trillions of signals daily to protecting your websites, mobile apps, APIs and MCP servers, without slowing them down. This Trust Center provides complete transparency into how we ensure continuous security, reliability, data privacy, and compliance, delivering on our promise of zero compromise for your brand and users. security@datadome.co Privacy PolicyOpens in new tab Filter by Compliance SOC 2 GDPR CCPA AWS Security Competency Resources View all DataDome SOC 2 Type 2 Bug Bounty Certificate DataDome - SIG LITE Penetration Testing Attestation - 2026 DataDome SA Cyber Insurance 2026 CyberVadis Certificate AI Responsible Use Policy Controls View all Infrastructure security Unique production database authentication enforced Unique account authentication enforced Unique network system authentication enforced View 7 more Infrastructure security controls Organizational security Asset disposal procedures utilized Portable media encrypted Code of Conduct acknowledged by contractors View 5 more Organizational security controls Product security Data encryption utilized Control self-assessments conducted Penetration testing performed View 1 more Product security control Internal security procedures Continuity and Disaster Recovery plans established Continuity and Disaster Recovery plans tested Cybersecurity insurance maintained View 26 more Internal security procedures controls Data and privacy Data classification policy established Data collected Customer personally identifiable information used to connect to the DataDome dashboard HTTP Traffic fingerprints from visitors on customers websites Subprocessors View all Amazon Web Services • Cloud provider Worldwide Processing, storage and CDN hosting Google • Cloud provider Worldwide Processing and storage OVH EUROPE • Cloud provider Europe Storage, data pipelines and data streaming analytics SCALEWAY (Online) • Cloud provider Europe Processing, data pipelines and data streaming analytics Updates View all Security Node2Shell vulnerability (CVE-2026-111497) Published October 26, 2026 On October 22, 2026, a critical vulnerability was published in the Brotli decoder used by Node.js and other software: CVE-2026-111497, also known as Node2Shell. DataDome server-side modules do not depend on Brotli. They run on the customer’s own runtime and do not ship Node.js. DataDome client-side components (JavaScript tag and mobile SDKs) do not include the affected decoder. The DataDome detection API does not use Brotli. No action is required from DataDome customers regarding DataDome components. As usual, we recommend keeping your own runtime up to date, in particular Node.js. Security PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Published October 21, 2026 On October 21, 2026, two critical vulnerabilities were published in the PHP engine: CVE-2026-109618 and CVE-2026-109619, also known as PHP2Shell. The DataDome dashboard (app.datadome.co) uses PHP. We applied the PHP security patch on the dashboard on the same day, October 21, 2026. Before the patch was available, we monitored the activity on the dashboard and did not identify any suspicious requests related to these vulnerabilities. We have also enabled additional runtime protection on our infrastructure. No action is required from DataDome customers regarding the DataDome dashboard. To protect our customers’ applications, our Threat Research team has also deployed a dedicated detection model that blocks known exploitation tools and request patterns observed in these attacks. Compliance SOC 2 Type II Report Renewal (April 2025 – March 2026) Published April 17, 2026 We are pleased to share that DataDome has successfully completed a new SOC 2 Type II report (April 2025 – March 2026). This independent assessment was conducted by Coalfire and covers the Security, Availability, and Confidentiality Trust Services Criteria across our entire Cyberfraud Protection Platform. The full SOC 2 Type II report is available in our Trust Center. General CISA Secure by Design Pledge Published December 30, 2025 DataDome has signed the CISA Secure by Design Pledge, reinforcing our commitment to embedding security throughout the product lifecycle. This initiative aligns with our long-standing approach to building secure, resilient products by design. Learn more: https://datadome.co/data-privacy/commitment-cisa-secure-by-design-pledge/Opens in new tab https://www.cisa.gov/securebydesign/pledge/progress-reportsOpens in new tab Media View all Dive into DataDome's Dashboard Opens in new tab DataDome’s dashboard simplifies your user experience with visually impactful and intuitive displays. You can see your overall threat landscape, drill into specific threats for detailed insights, and generate automated reports. SoundCloud customer story Opens in new tab Since 2007, SoundCloud has empowered artists to build and grow their careers by providing them with the most progressive tools, services, and resources. To keep the platform free from fraudulent traffic, SoundCloud teamed up with AWS and DataDome. By eliminating fake account creation, spam comments, automated plays, and other types of unwanted activity, the multilayered protection keeps user interactions safe and ensures that SoundCloud’s business decisions are based on reliable KPIs. How Leboncoin Blocks Millions of Malicious Requests Every Day Opens in new tab Leboncoin, France’s leading classified marketplace, is central to how people in France buy, sell, rent, and connect. Before turning to DataDome, the platform was facing rampant scraping used to steal user ads and data, posting them to third‑party sites without permission. Building sufficient in‑house defenses would have been a massive, expensive effort. By partnering with DataDome, Leboncoin was able to deploy bot and scraping protection across its website and mobile apps in a matter of days, not weeks. The company now blocks millions of malicious requests daily, saving significant time, thanks to AI-driven protection that evolves as quickly as attackers.