Trust Center

Start your security review
View & download sensitive information
Search items
ControlK

Overview

The integrity and confidentiality of your information are fundamental priorities for Matillion, We are committed to transparent practices that uphold the highest levels of security, allowing you to trust the full range of solutions we provide, now and in the future.

To continually enhance our security posture, Matillion performs ongoing evaluations of potential risks across all aspects of our organization, from internal operations to our diverse portfolio of products and services. We understand that the landscape of security is ever-changing and accept that no product, person, or process is ever complete, as such, we are committed to ongoing improvements and innovations while demanding quality within our security program.

An independent third-party auditor has rigorously evaluated our comprehensive security program against industry-leading standards, confirming our adherence to SOC2 Type II requirements.

Start your security review
View & download sensitive information

Matillion is reviewed and trusted by

Slack-company-logoSlack
DocuSign-company-logoDocuSign
Cisco-company-logoCisco
Amazon-company-logoAmazon
Accenture-company-logoAccenture
TUI-company-logoTUI
Autodesk-company-logoAutodesk

Data Privacy

Privacy of customer data is top of mind. We follow industry best practices and follow all applicable privacy regulations.

Trust Center Updates

Command Injection Vulnerability in Palo Alto PAN-OS (CVE-2024-3400)

VulnerabilitiesCopy link

Matillion is aware of CVE-2024-3400 which is present in specific versions of Palo Alto PAN-OS software. We can confirm that Matillion is not impacted by this vulnerability.

Published at N/A

Redhat CVE-2024-3094 Discovered March 28

VulnerabilitiesCopy link

Matillion are aware of the Redhat CVE-2024-3094 incident discovered on March 28 (https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users). This incident affects base operating system components.

That said, the current default Matillion ETL base image is Centos Stream 8 (Centos 7, prior to 1.68.) and as such, per Redhat's CVE notes, this version is not affected. You can confirm this yourself by running the xz --version command in a Bash component or terminal; it will respond with a version prior to 5.6.0: $ xz --version xz (XZ Utils) 5.2.5 liblzma 5.2.5

For customers who have installed on another base operating system than our default, or have manually forced an upgrade to this package, they should check whether they have an affected version of this library immediately. The affected versions are 5.6.0 and 5.6.1. Any systems with these versions should be stopped immediately. The exploit appears to allow root access to an attacker via SSH connection and any system which may be so contacted must be assumed to be compromised.

Published at N/A

(Non Security) Critical Advisory - METL Update Required

GeneralCopy link

(Non Security) Critical Advisory: Has your Matillion ETL (METL) instance stopped responding and are you unable to log in? Due to Matillion ETL (METL) license management defect, you need to patch to restore functionality. Simple to follow remediation instructions can be found here: https://docs.matillion.com/metl/docs/critical-advisory-licence-management-defect/

Published at N/A*

libwebp image framework (CVE-2023-4863)

VulnerabilitiesCopy link

Matillion's security team is aware of and responding to the announcement of a critical vulnerability in the libwebp image framework (CVE-2023-4863).

We are prioritising the rollout of security patches and the implementation of appropriate mitigation strategies to reduce the risk to our internal applications and environments.

Matillion ETL: We can confirm that the vulnerable libwebp package is present in our Matillion ETL AMI, however it is not utilised by Matillion ETL and as such we assess the risk to be low. We would recommend customers to apply the patch as soon as it is available from the vendor(s). Example: https://access.redhat.com/errata/RHSA-2023:5309

Data Productivity Cloud: Data Productivity Cloud does not to have libwebp package and as such is not considered vulnerable.

Please reach out to support if you require any assistance

Published at N/A*

MOVEit Transfer and MOVEit Cloud Vulnerabilities

VulnerabilitiesCopy link

On May 31 and June 9, 2023, Progress Software announced the discovery of two critical vulnerabilities (CVE-2023-34362 and CVE-2023-35036) that could lead to escalated privileges and unauthorized access to their MOVEit file transfer product and environment.

On June 16, an additional critical vulnerability related to this issue, CVE-2023-35708, was announced.

Following our vulnerability response process, including a review of all environments, Matillion does not use MOVEit Transfer and MOVEit Cloud products and has no evidence at this time of any impact to customer data due to these vulnerabilities.

Published at N/A

User Awareness, Fraudulent site in Matillion's name.

GeneralCopy link

Matillion has been made aware of similar domains that claim to be operated by Matillion, these include matillion-okta.com and matillion-pro.com.

Abuse claims have been raised and as of today, all sites are now down. We will continue to keep our customers updated incase of any new developments.

Kind Regards,

Published at N/A

Matillion has been made aware of a recent fraudulent website (http://uk-matillion.com) that claims to be running a promotional program in an attempt to get victims to deposit money through the site.

Matillion is working to ensure that this site is taken down, however it felt important to make all customers aware of the situation.

Kind Regards,

Published at N/A*

Matillion's Response to the 2022 OpenSSL 3 Vulnerabilities

IncidentsCopy link

Matillion is aware of the current discussions around the OpenSSL 3.0.7 vulnerabilities. At present we do not use the library within our default images and therefore Matillion products and services are not exposed to this vulnerability. We have also found no instances of the vulnerable version within our estate but we are continuing to investigate and gain assurance. Should we determine any exposure, then the remediation of this vulnerability will be completed in line with our Vulnerability & Patch Management process. We are also assessing if there has been any exposure within our third party supply chain, but so far have found no impacted services.

Published at N/A

Welcome to the Matillion Security Trust Center

GeneralCopy link

As an organisation that is security conscious and values security, we are excited to announce the official launch of the Matillion Security Trust Center. By using this portal, you can request access to our compliance documents, review our standardized questionnaires such as the SIG and gain a general understanding of our security posture.

Over time, our team will be making changes to this portal as we implement new tools and processes in our environment. You can use the Subscribe button to receive email notifications for when our team has an important update, such as if we have an updated compliance report or if we have a status update regarding a major security vulnerability that has been recently discovered.

The Matillion Security Team

Published at N/A

If you think you may have discovered a vulnerability, please send us a note.

Powered bySafeBase Logo