Snapshot 9187
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Center Start your security review View & download sensitive information Overview Webflow empowers teams to build and host securely - with trust at the core. Webflow is independently audited for SOC 2 Type II and certified ISO 27001 compliant, proving our commitment to protecting your data and your brand. Our security standards are continuously audited, refined, and embedded into everything we do. Our commitment doesn’t stop at compliance, we continuously invest in strengthening our security posture, improving resilience, and evolving our practices to stay ahead of emerging threats. Compliance SOC 1 Type 2 SOC 2 Type 2 ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 27018:2025 ISO/IEC 42001:2023 PCI DSS GDPR CCPA Privacy Shield DORA Swiss-US DPF EU-US DPF UK Extension to EU-US DPF DSA Webflow is reviewed and trusted by Okta Verifone Equals Money Stripe HealthStream Procter & Gamble Documents COMPLIANCESOC 1 Type 2 COMPLIANCESOC 2 Type 2 COMPLIANCEISO/IEC 27001:2022 COMPLIANCEISO/IEC 27017:2015 COMPLIANCEISO/IEC 42001:2023 REPORTSAnnual Pentest Report REPORTSWebflow Custom Hosting (WCH) Pentest Report DATA SECURITYBCP/DRP test letter DOCUMENTSCommon False Positive Vulnerability FAQ REPORTSWebflow's Shared Security Responsibility Model SELF-ASSESSMENTSCAIQ SELF-ASSESSMENTSSIG Lite Risk Profile Data access levelPublic Third party dependenceYes HostingMajor Cloud Provider View more Product Feature Security Audit & activity logging (Enterprise Feature) Custom SSL certificate (Enterprise feature) Single Sign-On (SSO) Login (Enterprise feature) View more Reports Past SOC2 Reports Annual Pentest Report Webflow Custom Hosting (WCH) Pentest Report View more Policies Policy governance Integrated management system (IMS) policy Business continuity/disaster recovery (BC/DR) policy View more Self-Assessments CAIQ SIG Lite AI AI overview AI training data AI security View more Access Control Personal data access Data & system access privileges Access log management View more App Security Responsible disclosure Bug bounty program Vulnerability management View more Software Development Lifecycle Software Development Lifecycle Separation of duties Corporate Security Physical security Personnel Security Email protection Infrastructure Amazon web services Environment segregation Status page Data Security BC/DRP tabletop exercises BCP/DRP test letter Data backups View more Endpoint Security Endpoint detection & response Mobile device management (MDM) Anti-malware protection Network Security Intrusion detection system (IDS) Distributed denial of service Protection (DDoS Protection) Firewall View more Incident Response Data breach notifications Incident response Incident reporting process View more Data Privacy Cookies Data privacy practice Data protection impact assessment (DPIA) Risk Management Risk assessments Third-party vendor management Training Secure code training Security and privacy awareness raining Legal Subprocessors Privacy policy Service level agreement View more ESG Anti-bribery and corruption Code of conduct Diversity, equity, and inclusion View more Security Grades Qualys SSL Labs webflow.com A Trust Center Updates Security Compliance Framework Announcements Compliance We Have Exciting News! The SOC 1 & 2 2026 reports and the ISO 27001:2022 2026 certification are now available to request and download from our Trust Center. Thanks for building with Webflow! We Have Exciting News! The 2026 ISO/IEC 42001:2023 is now available to request and download from our Trust Center. Thanks for building with Webflow! Supply Chain Vulnerability Announcements Vulnerabilities The Webflow Security team is investigating "Copy Fail" (CVE-2026-31431), a Linux flaw that could allow local authorized users to escalate permissions. This vulnerability cannot be exploited remotely over the internet. We have identified the affected infrastructure instances and are working on fixes. At this time, there is no evidence of exploitation in Webflow's environment. Customer data and services remain secure and fully operational. We will continue monitoring and provide updates as patches are deployed . No action is required from customers. Reference links: NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31431 Copy Fail (researcher site): https://copy.fail/ April 30, 2026 Webflow is aware of the recent security advisory regarding the pypi-lightning project (https://pypi.org/project/lightning - versions 2.6.2 and 2.6.3). At this time, we have no evidence to suggest any impact to customer data, accounts, or Webflow services and no indication that sensitive codebases were exposed. Webflow’s security team is continuing to conduct a thorough review of relevant systems. If anything changes, we’ll share updates. Thanks, Webflow Security The Webflow Security team is aware of Vercel's recently disclosed security incident. Webflow uses Vercel in a limited capacity for application hosting. At this time, we have no evidence of any impact to customer data, accounts, or Webflow services related to this incident. The Webflow team is following guidance and has rotated all related credentials. Additionally, Webflow is conducting a thorough audit of our supply chain and their potential exposure. If anything changes, we will provide updates. Thank you, Webflow Security We’re aware of the recent security advisory regarding the Axios project (https://www.npmjs.com/package/axios - versions 1.14.1 and 0.30.4). At this time, we have no evidence to suggest any impact to customer data, accounts, or Webflow services and no indication that sensitive codebases were exposed. Out of an abundance of caution, we’ve implemented additional security controls and are conducting a thorough review of relevant systems. If anything changes, we’ll share updates. Thanks, Webflow Security General Announcements General We’re excited to share our updated Security page: 👉 https://webflow.com/security This page provides a comprehensive overview of how Webflow protects customer data and maintains a secure, reliable platform. It outlines our security practices across infrastructure, monitoring, vulnerability management, incident response, compliance, and more. We’re committed to transparency and continuously strengthening our security posture. Visit the page to learn more about how we safeguard your data. Knowledge Base (FAQ) Is Webflow PCI Compliant? Does Webflow allow customers to perform penetration testing and vulnerability scan? Is Webflow HIPAA Compliant? View more