- Do you maintain an approved Physical Safety & Security Policy?
- Are you SOC 2 certified?
- Do you enforce Multi-Factor Authentication (MFA)?
- Do you comply with CCPA?
- Is customer data at rest encrypted with AES-256?
Risk Profile
We have secure, reliable hosting that customers can depend on. We are happy to provide details about our risk mitigation practices and recovery objectives upon request.
Trust Center Updates
Datadog's Response to the Node2Shell Vulnerability (CVE-2026-111497)
What Happened?
On October 27, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111497, known as "Node2Shell," to its Known Exploited Vulnerabilities catalog. The vulnerability affects the Brotli compression library, which is bundled with Node.js and included in many other software packages, such as the Python Brotli bindings and Linux distributions that ship the Brotli library.
What Has Datadog Done to Address This?
Upon learning about the vulnerability, the Datadog Security team investigated our production environment and customer-facing software to determine where vulnerable versions of the Brotli library are in use. Datadog's publicly distributed software, including the Datadog Agent, tracing libraries, and SDKs, is not impacted, however, as we release patches, we recommend upgrading to the latest available version to reduce the risk. For the Datadog platform, our investigation has found no evidence of exploitation and has not identified any publicly exposed paths to the vulnerable components. We are rolling out updated components across our infrastructure, including updated base images and dependency updates, and will continue to monitor the situation as our remediation efforts continue.
What Do I Need to Do?
No action is required from customers with respect to Datadog products at this time. Review your own environment for affected versions of Node.js, the Python Brotli bindings, and Linux packages that include the Brotli library, and apply updates according to guidance from your vendors.
For questions regarding this vulnerability, our Support team is here to help.
Datadog's Response to PHP2Shell Vulnerabilities
What Happened?
On October 21, 2026, PHP released security updates for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both have a Common Vulnerability Scoring System (CVSS) v4.0 score of 9.2. The vulnerabilities are fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 5 through PHP 8.1 are also vulnerable, but these versions are end of life and won't receive patches.
What Has Datadog Done to Address This?
Upon learning about the vulnerabilities, the Datadog Security team investigated our production and corporate surfaces to determine if we were running the vulnerable versions. After investigation, we determined that there is no impact to Datadog. The Datadog platform does not run PHP-based services. Although the Datadog APM and trace libraries do support PHP-based customer applications, these libraries themselves are not intrinsically impacted.
What Do I Need to Do?
Review your environment for affected versions of PHP and, where applicable, upgrade the underlying PHP engine to a fixed version. We released a companion blog post on Datadog Security Labs with security guidance for readers and for Datadog customers.
Datadog's Response to eMudhra Certificate Authority Compromise
What Happened?
On October 19th, Datadog became aware that eight intermediate certificate authorities operated by eMudhra (emSign) had been compromised, as disclosed by Mozilla. As a result, certificates issued by these certificate authorities can no longer be trusted. The affected certificate authorities are:
- EM EV TLS CA - G3B
- EM OV TLS CA - G3B
- EM DV TLS CA - G3B
- EM EV TLS CA - G3C
- EM OV TLS CA - G3C
- EM DV TLS CA - G3C
- EM OV CS CA - G3B
- EM OV CS CA - G3C
Additional details are available in Mozilla's incident report. Please note–this CA compromise is impacting the industry writ large and is not a Datadog-specific issue. We are responding urgently, as outlined below.
What Has Datadog Done to Address This?
We have reviewed where the compromised certificate authorities are trusted across our customer-facing software and components, as well as our internal systems, and have begun updating our root stores to remove compromised certificates. We have not identified any impact to customer data as a result of our investigations at this time, but we will continue to monitor the situation as our remediation efforts continue.
What Do I Need to Do?
Out of an abundance of caution, please review your environment for Datadog software and components that you are running (e.g., the Datadog Agent) and upgrade to the latest version. Given the scale and impact of this ecosystem-wide issue, we are pushing updates rapidly and recommend customers upgrade as quickly as possible.
For questions regarding the status of a particular Datadog component, our Support team is here to help.
*****Important: Customers Using the Datadog Agent*****
- We strongly recommend that you upgrade your fleet to the latest version of the agent
- Important: Upgrading to 7.84.5 or above will remove the vulnerability on Linux systems and upgrading to 7.84.6 or above will remove the risk on Windows systems
- Scanners that inventory CA bundles on disk will flag botocore/cacert.pem on 7.84.5 and 7.84.6. It is a false positive and will be addressed when 7.85.0 is released
- Additionally, Please Note that:
- The latest version of Helm chart (3.261.1) defaults to agent 7.84.6
- The latest version of the Operator (1.31.2) defaults to 7.84.1, and you’ll need to set an override: spec.override.<component>.image.tag: 7.84.6 (where <component> is replaced by nodeAgent, clusterAgent, otelAgentGateway…)
- If your host uses agent v6 and you cannot upgrade to 7.84.6, please instead upgrade to 6.53.2
- If your host uses agent v5 and you cannot upgrade to 7.84.6 or 6.53.2, follow this runbook
- If your host runs the unix agent, follow this runbook
If you run into any issues when trying to upgrade, or when executing the runbooks, please reach out to our Support team.
Cyber Essentials Plus (CE+) certification
We are pleased to announce that Datadog has achieved its first Cyber Essentials Plus (CE+) certification. CE+ is a UK Government-backed certification that independently verifies an organization's protections against common cyber threats.
The certification covers Datadog's UK operations, including the UK production environment, UK-based employees, their end-user devices and associated supporting infrastructure. All other Datadog networks, locations, and infrastructure are outside the certification scope.
2026 Penetration Test
We’re pleased to announce that summaries of the 2026 penetration tests for Datadog, Eppo, and Cloudcraft (performed by NCC Group) are available on our trust center. These summaries are accompanied by Letters of Engagement.