PKWARE Trust Center
Fiserv
JPMorgan Chase & Co.
Truist
Western Union
As a provider of sensitive data discovery and remediation tools, PKWARE’s priority is to maintain a safe, secure, and compliant environment for hosted applications it provides to customers as well as providing secure development, professional, and support engineering services. To ensure the highest level of security and compliance, PKWARE is continually investing in our overall information security program, resources, and expertise.
We understand the importance of providing clear information about our security practices, tools, resources and responsibilities within PKWARE so that our customers can feel confident in choosing us as a trusted service provider.
Within this portal, we provide various information about our compliance controls, policies, practices, and evidence for your varying risk assessment and assurance activities. PKWARE is committed to transparent and open communication in order to provide you with the ability to make accurate decisions when it comes to your own data security.
Training
We provide recurring security awareness training to all employees to ensure that they are aware of security best practices. This training includes regular phishing tests, rotating cyber security topics, and secure application development training including OWASP Top 10.
PKWARE Trust Center Updates
Security Update: No Impact from php2shell
Update, October 26, 2026: php2shell is tracked as CVE-2026-109618 and CVE-2026-109619, two critical remote code execution flaws in PHP request handling. PHP fixed both in releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. pkware.com runs a fixed release.
On October 23, PHP published a related lower-risk issue, CVE-2026-115560, which will be fixed in its next regular release. pkware.com already has PHP's recommended mitigation in place (session upload progress disabled), and we will apply the fixed release when it ships.
PKZIP, SecureZIP, and PK Protect don't use PHP and are not affected by any of these CVEs.
We're aware of the php2shell vulnerability and have been following it since the advisories were published.
PKWARE products are not affected. PKZIP, SecureZIP, and PK Protect don't use PHP. Customers don't need to patch or change anything.
pkware.com is our public website. It runs PHP and is managed and hosted separately from our products. It has been updated to the fixed release, and we found no sign of unauthorized access or impact. The site doesn't hold customer or product data.
We'll post an update here if anything changes. For questions, contact us through the Trust Center.
Annual SOC 2 Type II Examination in Progress
PKWARE has moved from its initial three-month SOC 2 Type II examination to an annual twelve-month examination with our independent auditor, Sensiba.
- Examination period: September 1, 2025 to August 31, 2026, continuing directly from the end of the prior period
- Criteria: Security, Availability, and Confidentiality
- Report expected: mid-December 2026
Until the new report is issued, the auditor's engagement letter and our October 2026 management bridge letter are available in the Trust Center alongside the most recent SOC 2 Type II report.
Third-Party Penetration Test Scheduled for Q1 2027
PKWARE has scheduled an independent third-party penetration test of the PK Protect platform for Q1 2027. A summary of the results will be made available in the Trust Center once the test is complete.
Information Security Policies Reviewed and Updated
PKWARE completed a full review of its information security policies and plans in March and April 2026. Each policy, along with our Incident Response, Business Continuity, and Disaster Recovery plans, was reissued as version 2.0, and a new Change Management Policy was added.
The current versions are available in the Trust Center.
PKWARE Achieves SOC 2 Type II Certification
We’re proud to announce that PKWARE has successfully achieved SOC 2 Type II certification, demonstrating our ongoing commitment to the highest standards of security, availability, and confidentiality in the protection of customer data.
This independent audit, conducted by a third-party firm, validates that our policies, controls, and operational practices are designed and operating effectively over time to safeguard sensitive information. The audit covered critical aspects of our SaaS infrastructure, internal security processes, and organizational controls to ensure continuous compliance with the AICPA Trust Services Criteria.
What This Means for Our Customers
- Verified Security and Compliance: Independent validation that PKWARE’s security controls are robust and effective.
- Ongoing Commitment: SOC 2 Type II certification evaluates control effectiveness over an extended period, reflecting our dedication to maintaining strong operational discipline.
- Customer Confidence: Our customers can trust that their data is managed with the highest level of security and integrity.
Looking Ahead
Security and compliance are foundational to our mission. We will continue to invest in process improvements, transparency, and regular third-party audits to ensure that PKWARE remains a trusted partner for sensitive data discovery, protection, and compliance.
For more details or to request a copy of our latest SOC 2 Type II report, please visit our [Trust Center]
- How does PKWARE secure and manage the exchange of troubleshooting and debug files with customers?
- Does PKWARE host or have access to my sensitive data?