Snapshot 257888
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Welcome to the Trust Center Security You Can See it-security@ververica.com Privacy PolicyOpens in new tab In today's rapidly evolving digital landscape, managing complex data workflows and ensuring the highest standards of security and compliance is paramount for businesses worldwide. At Ververica, we understand the critical importance of maintaining a secure and robust environment for your data streaming needs. Our commitment to security is ingrained in every aspect of our operations, ensuring that your data is protected every step of the way. Ververica's Trust Center is your comprehensive resource for understanding our dedication to security, privacy, and compliance. We leverage cutting-edge security practices and compliance measures to safeguard your data, providing you with peace of mind and enabling your business to thrive. Compliance ISO 27001:2022 SOC 2 Type II CSA STAR Resources View all ISO 27001 ISO 27001:2022 Audit Report ISO ISMS 27001 SoA SOC 2 SOC 2 Type II Report SOC 3 Penetration test reports Penetration Test Controls Updated less than a minute ago View all Infrastructure security Information security for use of cloud services Information transfer Web filtering View 3 more Infrastructure security controls Organizational security Determining the scope of the information security management system Return of assets Information security roles and responsibilities View 8 more Organizational security controls Product security Secure development life cycle Secure coding Test information Internal security procedures ICT readiness for business continuity Planning of Changes Installation of software on operational systems View 35 more Internal security procedures controls Data and privacy Acceptable use of information and other associated assets Classification of information Labelling of information View 1 more Data and privacy control Subprocessors View all Amazon Web Services • Cloud provider EU, US Cloud computing platform used by Ververica to host and deliver its services. AWS provides the underlying infrastructure, including compute, storage, and networking resources, required to operate Ververica’s cloud-based solutions. Ververica leverages AWS to ensure scalability, high availability, and security of its services. AWS processes customer data solely for the purpose of enabling Ververica to deliver its platform functionalities in accordance with customer agreements and data protection requirements. Google Workspace • Identity provider Internal identity and access management solution, as well as support for business operations through productivity and collaboration tools HubSpot • Customer support US The customer relationship management (CRM) and customer support platform. It enables the management of customer relationships, tracking of communications, and delivery of support services. In this context, HubSpot may process customer contact information, account details, communication history, and support-related data in accordance with applicable data protection laws and the relevant data processing agreement. FAQ View all Updates View all Security Ververica response to the Brotli decoder vulnerability CVE-2026-111497 Published November 5, 2026 On 22 October 2026, a buffer overflow vulnerability was published in the Google Brotli decoder, versions 1.0.3 through 1.2.0 (CVE-2026-111497). A crafted Brotli-compressed stream can corrupt memory in the process that decodes it. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 27 October. Ververica has no indication that the issue was exploited against Ververica or its customers. The Ververica Control Plane has already been updated. Some container images for Ververica BYOC and the self-hosted Ververica Platform include the affected Brotli library as part of their operating system packages. This is standard for most Linux distributions. Ververica reviewed every program and library in these images: none of its services decodes Brotli data received from the network, and the library is used only by the curl HTTP client and the FreeType font library. Ververica rates the risk to its products as Medium, although vulnerability scanners will report the finding as Critical. Ververica is now rebuilding the affected images with the fixed library and verifying the change. Security Ververica response to the eMudhra intermediate CA compromise Published October 23, 2026 On 20 October 2026 a public disclosure showed that eight intermediate CA certificates issued by eMudhra have recoverable private keys. Major browser vendors distrusted the certificates between 17 and 20 October. Ververica's own certificates and services are not issued by eMudhra and are not affected. Ververica has no indication that the issue was exploited against Ververica or its customers. Container images for Ververica BYOC and the self-hosted Ververica Platform built before 21 October 2026 contained the parent root certificates in their trust stores. This is standard practice for most Linux and Java distributions. Ververica is now rebuilding all images with updated trust stores, verifying the change and deploying it to the Ververica Control Plane. Customers are being directly informed and advised to apply compensating controls while patches are being released. Compliance Ververica Achieves CSA STAR Level 1 Published January 20, 2025 We’re pleased to announce that Ververica has been officially included in the Cloud Security Alliance (CSA) STAR Registry at Level 1. This accomplishment reaffirms our commitment to maintaining the highest standards of security, transparency, and compliance. By meeting the stringent requirements for CSA STAR Level 1, Ververica demonstrates its dedication to safeguarding our customers’ data and continuously improving our security and risk management practices.