Trust Center
- Do you maintain an approved Physical Safety & Security Policy?
- Are you SOC 2 certified?
- Do you enforce Multi-Factor Authentication (MFA)?
- Do you comply with CCPA?
- Is customer data at rest encrypted with AES-256?
Risk Profile
We have secure, reliable hosting that customers can depend on. We are happy to provide details about our risk mitigation practices and recovery objectives upon request.
Trust Center Updates
Datadog's Response to PHP2Shell Vulnerabilities
What Happened?
On October 21, 2026, PHP released security updates for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both have a Common Vulnerability Scoring System (CVSS) v4.0 score of 9.2. The vulnerabilities are fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 5 through PHP 8.1 are also vulnerable, but these versions are end of life and won't receive patches.
What Has Datadog Done to Address This?
Upon learning about the vulnerabilities, the Datadog Security team investigated our production and corporate surfaces to determine if we were running the vulnerable versions. After investigation, we determined that there is no impact to Datadog. The Datadog platform does not run PHP-based services. Although the Datadog APM and trace libraries do support PHP-based customer applications, these libraries themselves are not intrinsically impacted.
What Do I Need to Do?
Review your environment for affected versions of PHP and, where applicable, upgrade the underlying PHP engine to a fixed version. We released a companion blog post on Datadog Security Labs with security guidance for readers and for Datadog customers.
Datadog's Response to eMudhra Certificate Authority Compromise
What Happened?
On October 19th, Datadog became aware that eight intermediate certificate authorities operated by eMudhra (emSign) had been compromised, as disclosed by Mozilla. As a result, certificates issued by these certificate authorities can no longer be trusted. The affected certificate authorities are:
- EM EV TLS CA - G3B
- EM OV TLS CA - G3B
- EM DV TLS CA - G3B
- EM EV TLS CA - G3C
- EM OV TLS CA - G3C
- EM DV TLS CA - G3C
- EM OV CS CA - G3B
- EM OV CS CA - G3C
Additional details are available in Mozilla's incident report. Please note–this CA compromise is impacting the industry writ large and is not a Datadog-specific issue. We are responding urgently, as outlined below.
What Has Datadog Done to Address This?
We have reviewed where the compromised certificate authorities are trusted across our customer-facing software and components, as well as our internal systems, and have begun updating our root stores to remove compromised certificates. We have not identified any impact to customer data as a result of our investigations at this time, but we will continue to monitor the situation as our remediation efforts continue.
What Do I Need to Do?
Out of an abundance of caution, please review your environment for Datadog software and components that you are running (e.g., the Datadog Agent) and upgrade to the latest version. Given the scale and impact of this ecosystem-wide issue, we are pushing updates rapidly and recommend customers upgrade as quickly as possible.
If you have any further questions, our Support team is here to help.
Cyber Essentials Plus (CE+) certification
We are pleased to announce that Datadog has achieved its first Cyber Essentials Plus (CE+) certification. CE+ is a UK Government-backed certification that independently verifies an organization's protections against common cyber threats.
The certification covers Datadog's UK operations, including the UK production environment, UK-based employees, their end-user devices and associated supporting infrastructure. All other Datadog networks, locations, and infrastructure are outside the certification scope.
2026 Penetration Test
We’re pleased to announce that summaries of the 2026 penetration tests for Datadog, Eppo, and Cloudcraft (performed by NCC Group) are available on our trust center. These summaries are accompanied by Letters of Engagement.
Datadog's Response to the npm Supply Chain Worm (keyv / jaredwray Maintainer Account Compromise)
We are aware of a supply chain attack in which the npm maintainer account for jaredwray was compromised, resulting in ~1800+ malicious compromised package versions being published beginning August 4, 2026.
Upon learning of this activity, Datadog's security team investigated potential exposure across our products, public packages, customer-facing infrastructure, and internal development environments. One Datadog-published npm package, backstage-plugin-datadog-entity-sync-backend (versions 1.1.1, 1.1.2, 1.1.4, and 1.1.5), referenced a compromised package as a transitive dependency. We confirmed that Datadog was not impacted. As a precaution, we have blocked all known malicious package versions across our internal systems and continue to monitor for exposure.
This supply chain attack campaign involved a self-propagating worm that has continued to spread to maintainer accounts and packages beyond the initial set. We will update this post if the scope or our exposure assessment changes. We recommend checking the compromised package versions against your own dependencies. If you use the affected versions listed, review the potentially affected systems for the campaign's indicators of compromise.
For a detailed breakdown of the campaign and how to assess impact in your own environment, see our Security Labs post for the current authoritative list.
If you have any further questions, our Support team is here to help.