Welcome to Celigo's Trust Center. As a Gartner Magic Quadrant™ recognized Integration Platform as a Service (iPaaS) provider operating globally, we take a proactive, risk-based approach to protecting your data and ensuring operational resilience.
Our commitment to data privacy and security is embedded in every part of our business. Use this Celigo Trust Center to learn about our security controls, regulatory compliance, internal governance, and request access to our security documentation.
Subprocessors
- From which countries can Celigo personnel access customer data?
- Which AWS regions host the Celigo platform?
- How does Celigo protect international transfers of personal data?
- Do backups, logs and disaster-recovery copies stay in my selected region?
- Can I move my account to a different region?
Trust Center Updates
Security Advisory: eMudhra Certificate Authority Compromise
Summary
On October 20, 2026, it was publicly disclosed that eMudhra, a third-party certificate authority (CA), had generated the private keys for eight of its intermediate certificates—six used for TLS and two for code signing—with a weak method that allows the keys to be recovered. Anyone with these keys could issue certificates that systems trusting the affected intermediates would accept as legitimate.
The issue was first reported to major browser root programs on October 17, 2026. eMudhra revoked all eight intermediate certificates on October 18, 2026. Chrome, Firefox, and Android have distributed updates to block the affected certificates.
This is an industry-wide issue affecting systems that trust these certificates. It is not specific to Celigo.
Celigo’s assessment
- Celigo’s certificates are not affected. integrator.io, the Celigo APIs, all regional environments (NA, EU, AU, and CA), celigo.com, and our documentation sites use certificates issued by other certificate authorities.
- What we evaluated: Like many cloud platforms, our backend services use trusted-certificate lists built into standard software runtimes. At the time of our assessment, those lists still trusted the affected certificates. This applies to the outbound connections integrator.io makes to customer and third-party endpoints.
Actions we are taking
- We started our response on October 22, 2026, and have treated it as our highest priority.
- We are rebuilding and redeploying our services on updated runtimes that no longer trust the eight compromised intermediate certificates.
- The rollout begins on October 23, 2026, at 9:30 PM PT (12:30 AM ET on October 24) and will proceed in phases, with our core platform services updated first and adaptors updated afterward.
What this means for you
Most customers don’t need to do anything.
If an endpoint your integrations connect to uses a certificate issued under one of the revoked eMudhra intermediates, connections to that endpoint will fail with a certificate (TLS/SSL) error once the update reaches your account.
That certificate has already been revoked by eMudhra, and the affected intermediates have been blocked in major browsers. To restore the connection, the endpoint owner—your IT team or the vendor—must replace the certificate with one from a different certificate authority. You don’t need to change anything in integrator.io once the certificate is replaced.
On-premise agent customers
The on-premise agent also needs to be updated to stop trusting the compromised certificates. Agents already installed in your environment are not updated automatically by the integrator.io platform update.
We are preparing an updated agent release and will post the version number and upgrade instructions here when it is available. When it is released, all customers using the on-premise agent must upgrade to that version or higher.
Frequently asked questions
Is this a Celigo vulnerability?
No. This is a compromise at a third-party certificate authority that affects software across the industry. Celigo is updating its platform so it no longer trusts the affected certificates.
How do I know if I’m affected?
If any of your connections start returning a certificate error after the update, the endpoint may be using an affected certificate. We are also contacting customers we’ve identified as likely to be affected.
Can Celigo fix an affected endpoint for me?
No. The certificate belongs to the endpoint owner, who has to replace it. Celigo Support can help confirm the cause of the error.
Do I need to change my integrations?
No. Once the endpoint’s certificate is replaced, your connections will resume without any configuration changes.
Contact
For questions or help, contact Celigo Support.
Update log
- October 23, 2026: Initial advisory published.
References
Celigo Response to PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619
Last updated: October 22, 2026
Summary
Celigo’s Security team has assessed CVE-2026-109618 and CVE-2026-109619, two vulnerabilities affecting PHP. Our assessment found no impact on the integrator.io platform, Integration Apps, or the systems that support customer integration environments. Remediation for Celigo’s PHP-based marketing websites is complete. No action is required within your Celigo environment.
integrator.io Platform and Integration Apps
The integrator.io platform and Integration Apps are not built on PHP. Our assessment found no exposure to these vulnerabilities in the systems that support customer integration environments.
Celigo Marketing Websites
Some Celigo public marketing websites run on WordPress, which uses PHP. These websites are separate from the integrator.io platform and do not host or process customer integration data.
For these websites, Celigo has:
- Enabled managed web application firewall (WAF) rules for these CVEs in blocking mode to help block exploit attempts.
- Upgraded PHP to a release that addresses both vulnerabilities. The upgrade was completed on October 21, 2026, at 8:19 p.m. Central Time (CDT).
Evidence of Exploitation
As of October 22, 2026, Celigo has found no evidence of exploitation of these vulnerabilities against Celigo systems.
Customer Action
No action or configuration changes are required within your Celigo environment.
If your organization operates PHP-based applications that connect to Celigo, such as a self-hosted Magento or Adobe Commerce store, work with your application administrator or hosting provider to assess those systems and apply applicable security updates.
Additional Information
If your security team needs additional information or written confirmation of Celigo’s assessment, contact your Celigo account representative. General security and compliance documentation is available in the Celigo Trust Center.
Celigo’s New SOC 1 Type 2 Report is Now Available
Celigo is pleased to announce the availability of our latest SOC 1 Type 2 report, reflecting our continued commitment to maintaining strong controls and earning the trust of our customers.
The SOC 1 Type 2 examination provides independent assurance regarding the design and operating effectiveness of controls relevant to our customers’ internal control over financial reporting over the examination period.
This latest report reinforces Celigo’s ongoing investment in a strong security and compliance program and our commitment to providing customers with the assurance and transparency they need when evaluating and using our services.
Accessing the Report
The latest SOC 1 Type 2 report is available to eligible customers and prospects through the Celigo Trust Center.
If you require access, please request the report directly through the Trust Center.
We’re proud to continue strengthening our security and compliance program and providing our customers with independent assurance over the controls that support their use of Celigo.
2025 SOC 2 Type 2 Report Now Available
We’re excited to share that our 2025 SOC 2 Type 2 Report for the Celigo Platform is now available in the Celigo Trust Center.
The report is accessible to authorized users under NDA.
👉 Visit https://trust.celigo.com/
to request access, view, or download the report.