Trust Center
At Fivetran we know that data movement is your foundation for innovation, and are committed to providing robust security and privacy programs that protect your data as we would our own.
Our Trust Center is at the core of our many transparency efforts, and we hope you will find accessing our comprehensive security, privacy, and compliance documentation as easy as setting up your first Fivetran pipeline.
Featured Documents
- Please describe the company/user data you require to provide your service: personal information, financial data, confidential/sensitive data, etc.
- Does Fivetran have a Disaster Recovery (DR) or Business Continuity (BC) Plan in place
- Is attack and penetration testing performed periodically?
- Does Fivetran encrypt data in transit and at rest?
- Does Fivetran have a Disaster Recovery Plan (DR) or a Business Continuity Plan (BCP)? How ofter are these plans tested?
Trust Center Updates
CVE-2026-111497 (Node2Shell)
On October 21, 2026, details of a high-severity vulnerability in the Node.js runtime, CVE-2026-111497 (known as "Node2Shell"), were made public. Attackers could use this flaw to run code on a server running a vulnerable version of Node.js when that server decompresses Brotli data sent by the attacker.
Our response is ongoing. Teams across Fivetran + dbt continue to assess the impact, monitor our services, and make progress on further remediation. We will keep Fivetran + dbt customers updated through our Trust Center.
Update - eMudhra Intermediate CA Compromise
Our security review to date has found no evidence of active exploitation on Fivetran + dbt systems. Our response is ongoing. Teams across Fivetran + dbt continue to assess the impact, monitor our services, and make progress on remediation. We will keep Fivetran + dbt customers updated through our Trust Center.
Update - CVE-2026-109618, CVE-2026-109619 (PHP2Shell)
We continue to monitor PHP2Shell. We have found no evidence of impact to any customers or Fivetran + dbt systems at this time.
CVE-2026-109618, CVE-2026-109619 (PHP2Shell)
On October 20, 2026, details of two critical vulnerabilities in the PHP language runtime, CVE-2026-109618 and CVE-2026-109619 (known as "PHP2Shell"), were made public ahead of the planned disclosure. Attackers could use these flaws to run code on any web server running a vulnerable version of PHP without logging in.
We immediately reviewed Fivetran services and infrastructure. The Fivetran platform and customer data pipelines do not run PHP and are not affected. Two legacy HVR support systems had an affected PHP version installed. We have fixed PHP on both systems. We have found no evidence of impact to any customers at this time. No action is required by customers.
eMudhra Intermediate CA Compromise
On October 19, 2026, private keys for eight widely trusted eMudhra intermediate certificates were reported compromised. Attackers could use these keys to impersonate websites and intercept or alter traffic.
We immediately prioritized updates to critical services that use public certificates to protect our customers. Our security review to date has found no evidence of active exploitation on our services.
Our response is ongoing. Teams across Fivetran + dbt continue to assess the impact, monitor our services, and make progress on further remediation. We will keep Fivetran + dbt customers updated through our Trust Center.