Our commitment to data privacy and security is embedded in every part of our business. This Trust Centre is designed to provide transparency into our security posture and give you confidence in how we protect your data.
You'll find publicly available information about our accreditations and sub-processors below. For access to our detailed security documentation - including policy overviews, compliance evidence, and risk management materials - simply request access using the button above. You'll be asked to accept a short confidentiality agreement before access is granted.
We're continually expanding the resources available here, so check back regularly for updates.
Subprocessors
Trust Centre Updates
PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
On 21 October 2026, the UK National Cyber Security Centre (NCSC) issued an alert about two critical vulnerabilities in PHP, a widely used web programming language. The vulnerabilities are in PHP itself and allow an attacker to run code remotely on unpatched web servers that use PHP.
Our position
Ciphr's products and services are not built on PHP, and none of our systems rely on PHP to operate. No action is needed from Ciphr customers.
What we've done
As soon as the alert was published, our teams:
- reviewed our hosting environments and configurations across all Ciphr products
- scanned our estate for PHP installations
- reviewed our sub-processors and key third-party suppliers to confirm whether their services are affected
What happens next
We'll keep monitoring guidance from the NCSC and our partners.